- Trust Centre
- Roadmap
Trust Centre
Public trust roadmap
Pocket PMO is a small, independent UK company. We publish everything we have chosen not to do yet so procurement teams can make informed decisions. Nothing on this page is a commitment — dates are directional and will move as customer demand and regulatory posture evolve. If any item here is a blocker for your organisation, tell us at admin@pocketpmo.co.uk and we will prioritise it.
Certifications & attestations
External badges we do not yet hold. We prefer to earn trust through honest architecture rather than badges we have not achieved.
| Item | Status | Target / notes |
|---|---|---|
| Cyber Essentials | Deprioritised | 2027 (under review) |
| Cyber Essentials Plus | Not planned | Under review |
| SOC 2 Type I | Deprioritised | 2027 |
| SOC 2 Type II | Not planned | 2028+ |
| ISO 27001 | Not planned | 2028+ |
Independent testing
Third-party assessment of the platform.
| Item | Status | Target / notes |
|---|---|---|
| CREST/CHECK annual penetration test | Deprioritised | H1 2027 |
| Public bug bounty | Not planned | Private disclosure via admin@pocketpmo.co.uk in the interim |
Contractual guarantees
What we do — and do not — commit to in writing today.
| Item | Status | Target / notes |
|---|---|---|
| Contractual uptime SLA with service credits | Not planned | Enterprise plan, 2027 |
| Formal RTO / RPO commitments | In progress | Q1 2027 Awaiting Lovable Cloud confirmation of platform-level backup + recovery targets. |
| Contractual breach-notification SLA (72 h) | Live | Included in DPA today |
Product & governance
Governance items shipping or under consideration.
| Item | Status | Target / notes |
|---|---|---|
| Formal DPIA solicitor sign-off | In progress | Q3 2026 Draft published; commercial legal review runs in parallel with launch. |
| Meeting-recording retention policy default | Deprioritised | Q4 2026 |
| Mandatory MFA for admin / support personas | Live | Shipped |
| SAML SSO | Available on request | Self-serve UI: 2027 |
| Data residency choice (UK vs EU) | Not planned | Under review |
| Automated RLS regression tests in CI | Deprioritised | Q4 2026 |
Sub-processors & AI
Third-party providers and AI supply-chain commitments.
| Item | Status | Target / notes |
|---|---|---|
| Annual re-attestation from AI providers | In progress | Q4 2026, then annually |
| Customer-configurable AI provider | Not planned | Under review |
Why publish this?
Enterprise procurement teams reward transparency over silence. Rather than leave gaps for buyers to discover, we set out clearly what we do today, what we are working on, and what we have deliberately parked. This page is reviewed each quarter alongside the rest of the Trust Centre.