Trust should be evidenced, not implied.
AnayaWorld builds security, accessibility, privacy and accountable engineering into the way digital systems are designed and delivered. We publish what we can substantiate, distinguish engineering practice from independent assurance, and do not use certifications or compliance claims we cannot verify.
What we say here has a boundary.
Some evidence comes from controls we can verify directly in our engineering and delivery systems. Independent certification, formal compliance assurance and third-party audits are different things. Where those do not exist or are not verified for publication, we say so.
Changes should be testable before they become somebody else's problem.
For this website, the release pipeline runs type checking, linting, automated unit testing, end-to-end testing and a production build before release. Architecture, content evidence and release readiness are reviewed as separate gates rather than treated as one deployment decision.
BoundaryWe do not describe this as an audited software-development lifecycle or an externally certified engineering process.
Security controls belong in the system, not in a badge beside it.
The current AnayaWorld platform uses explicit security headers, origin checking, server-side input validation, anti-spam controls, private CMS content access and server-side credentials. Its Content Security Policy has been exercised in enforcement testing but remains in report-only mode until the production third-party integrations are finalised.
BoundaryWe do not currently claim SOC 2, ISO 27001, PCI DSS, third-party penetration-test certification or any other security certification on this site.
Collect what the interaction requires. Keep the boundaries visible.
The enquiry flow records the information a visitor chooses to submit together with consent and policy-version information. Contact information is not stored in the browser's draft state, and network-address information used by the service is retained only as a salted hash rather than a raw IP address.
BoundaryWe are not using these engineering choices as a claim of DPDP, GDPR or other regulatory compliance. Formal privacy-policy, retention and data-rights documentation must stand on their own legal basis.
Reliability starts with architecture; uptime claims require operating evidence.
Public content is designed around static caching and controlled revalidation, with graceful handling when the CMS is unavailable.
BoundaryWe do not publish an uptime percentage, SLA, recovery-time objective or recovery-point objective today. Those numbers will only be published when they are backed by real production operating evidence.
Accessibility is a design and testing target, not a certification label.
AnayaWorld is designed toward WCAG 2.2 AA. Automated accessibility checks, keyboard and focus behaviour, reduced-motion handling, responsive reflow and target-size requirements are part of the website's test suite.
BoundaryWe do not currently claim independently audited WCAG conformance. Manual screen-reader and complete zoom testing remain part of the pre-production verification work.
Engineering controls and regulatory compliance are not the same claim.
We do not currently publish certification or formal alignment claims for ISO, SOC, DPDP, GDPR or other named compliance frameworks on this website.
Where a future engagement requires a specific regulatory or contractual framework, that requirement must be assessed against the actual system, data, jurisdiction and evidence involved.
Incident readiness should be documented before it is advertised.
AnayaWorld does not currently publish incident-response SLAs, severity models, response-time metrics or breach-notification commitments on this website.
Enterprise security and procurement discussions can include the operating requirements relevant to a proposed engagement before delivery begins.
AI does not remove human accountability.
In our AI and automation work, automated or AI-assisted steps retain an explicit human checkpoint. Repeatable work is a candidate for deterministic automation; AI is applied where judgement benefits from it and where review can remain visible.
BoundaryWe do not currently claim alignment with ISO 42001, NIST AI RMF, the EU AI Act or another named AI-governance framework.
Third-party dependencies should be visible rather than assumed away.
Third-party dependencies are reviewed as part of architecture and release decisions.
BoundaryWe do not currently publish a formal subprocessor register, vendor-assurance programme or DPA inventory on this site.
What we can evidence today
Self-attested engineering evidence
- Origin checking and honeypot anti-spam protection
- Private CMS content access through server-side credentials
- Security headers and server-side validation
- Consent-version recording and hashed network-address handling
- Automated release gates
- Accessibility automation, keyboard and focus testing, and reduced-motion testing
Absence of a badge is not filled with marketing language.
Unless separately evidenced and published, AnayaWorld does not currently claim SOC 2, ISO 27001 or another security certification; a published third-party penetration-test result; guaranteed uptime or an SLA for this website; independently audited WCAG conformance; DPDP/GDPR certification or blanket regulatory compliance; a published incident-response SLA; or a certified AI-governance framework.
Need evidence for a procurement or technical review?
Tell us what your organisation needs to assess — architecture, data handling, security controls, accessibility, AI governance or another requirement — and we will separate what can be evidenced today from what would need to be established for the engagement.
Start a conversation →Recognition is not certification.
Industry and event recognition is documented separately from security, compliance and engineering assurance. Award-category wording is reproduced as issued and does not represent an independent certification of AnayaWorld's controls.
View Awards & Recognition →