The security frameworks and legal requirements On-Kare is designed to align with, and the certifications planned.

Compliance officers, DPOs and procurement teams running a vendor assessment.

Which problem does it solve?

A certification badge without a scope or an expiry date cannot be verified, so it should not be trusted.

No certification table is shown because no certificate is held yet; a certification will only appear with an auditor name and a validity date.

Security documentation and answers to security questionnaires are available on request through the security contact. A BAA will be offered once the contracting entity is incorporated.

Compliance officers and procurement teams checking frameworks and certification status

Compliance and certification roadmap

Each framework is stated for what it is today — a design target, not a certificate. On-Kare holds no certification or attestation yet: ISO 27001-ready with certification planned, SOC 2 attestation planned.

Request security documentation Read the DPA

Frameworks

ISO 27001-ready (ISO/IEC 27001:2022)
Information security controls that are ISO 27001-ready. Certification planned; not yet audited.
SOC 2: attestation planned
Controls over security, availability and confidentiality of the service. SOC 2 attestation planned; no report yet.
HIPAA-ready
Safeguards designed to meet US health-data handling requirements. BAA to be offered once the contracting entity is incorporated.
GDPR-aligned
Processing and consent flows designed to meet EU data-protection requirements.

The six questions

What is it?: The security frameworks and legal requirements On-Kare is designed to align with, and the certifications planned.
Who is it for?: Compliance officers, DPOs and procurement teams running a vendor assessment.
Which problem does it solve?: A certification badge without a scope or an expiry date cannot be verified, so it should not be trusted.
How does it work?: Information security management that is ISO 27001-ready (ISO/IEC 27001:2022, certification planned), SOC 2 attestation planned, a HIPAA-ready architecture and GDPR by design for the markets that require them.
How is it different?: No certification table is shown because no certificate is held yet; a certification will only appear with an auditor name and a validity date.
What is the proof?: Security documentation and answers to security questionnaires are available on request through the security contact. A BAA will be offered once the contracting entity is incorporated.

This page is part of a platform of 2,156 clinical and operational capabilities across 8 business domains.

Explore the catalogue

Continue

ISO 27001-ready · certification plannedSOC 2: attestation plannedGDPR · DPOHIPAA-ready architecture30+ jurisdictionsSee certification status

Security contact

Coordinated disclosure and documentation requests: security@on-kare.org.

security@on-kare.org

Legal review: 2026-08-24