Compliance, questionnaires and your trust page

What is the Compliance page?

Open Compliance in the app. Stableship maps your app to SOC 2, ISO 27001, GDPR and UK GDPR, CCPA and other US state privacy laws, PCI DSS, HIPAA, children's privacy, accessibility, marketing email, AI transparency, OWASP and cyber insurance. For each one you see:

• Proven or Seen in code: what Stableship tested, or found in your code and database structure.
• Problem found or Missing: a gap, with what to do. Gaps your coding agent can fix are also on Problems.
• Answer this: something only you can say, like whether two-step sign-in is on for your company accounts.
• Ask a professional: a question for a lawyer, an auditor or a broker, with the questions to bring.

It is a map, not an audit, a certificate or legal advice. Stableship never says your app meets a framework.

Where does it get this from?

From what it already reads: the outside services your code uses, which tables and columns hold personal data (from column names, never rows), how people sign in, your privacy policy page, and what each audit proved. Your answers on the Answers tab fill in the rest; they are asked again after 90 days.

While Stableship reads your app during setup, you can answer four quick questions: where your users are, who asks you about security, whether children under 13 could use the app, and whether it handles health information. They decide which laws apply, and the frameworks the people who ask you want come first. You can change them later on the Answers tab.

How do I answer a security questionnaire?

Open Compliance, then Questionnaires. Paste the questions (one per line) or upload the spreadsheet (Excel .xlsx or CSV); Stableship reads the first sheet and takes the column named like "Question". It drafts each answer from what it proved, what your code shows and what you stated, and says which answers only you can give. Review and edit each one, mark it reviewed, then export the answers as CSV. When an answer only you can give matches one of your Compliance answers, you can save it there too, so the next questionnaire starts from it. Protect includes some each month; see Plans and pricing for more.

What documents can I download?

Open Compliance, then Documents. Every plan gets an incident response plan written for your app. Protect adds starter policies (information security, access control, vendors, retention, change management, backups), a GDPR record of processing draft, DPIA questions, and SOC 2 and ISO 27001 evidence packs with the control matrix and the last 90 days of checked changes and fixed problems. Each is a draft to review before you adopt it.

How do I share evidence with my auditor?

On Protect, an owner or admin opens Compliance, then Documents, and makes a link under Share with an auditor. Stableship builds the SOC 2 or ISO 27001 pack on its side and signs it, so your auditor's browser can check that nothing changed since. Anyone with the link can read it for 30 days, open problems included. A new link replaces the old one, and Take down stops it at once. A pack is evidence of what was tested, not an audit opinion.

What is the trust page?

A public page you can share with customers: the outside services your app uses, what Stableship proved and what you state, and when it was last tested. It never lists problems. An owner or admin publishes it from Compliance, then Trust page, chooses what it shows, and copies the badge for the site footer. The badge greys out if the app goes 30 days without a check or a problem that holds releases stays open for a week. Taking the page down stops the link and the badge.

Does Stableship watch whether my app is up?

On a plan, once you verify you own your app's address, Stableship checks it every 5 minutes and emails the owners and admins when it stops answering and when it is back. It also checks your security certificate and your domain once a day and warns 30, 14 and 3 days before either expires.