Infrastructure
What cosmetiFULL runs on, and what those companies are certified for
In a regulated trade the question of who owns the foundations comes up sooner or later. Below are the companies the service runs on, what each one is certified for, and a link to the company that holds the certificate, on its own domain, so you read it from the owner rather than from us. The certifications belong to them, and what they actually cover is written out further down, in full.
Cloudflare, where the site and the apps run
ISO 27001:2022 · ISO 27018:2019 · ISO 27701:2019 · SOC 2 Type II
Cloudflare serves this site, runs the applications and holds their data and files. It states that it has been ISO 27001 certified since 2019 and is currently certified against ISO 27001:2022, ISO 27018:2019 certified since 2022, and ISO 27701:2019 certified as both a PII processor and a PII controller since 2021, with a SOC 2 Type II report since 2019. The certificates themselves are made available through a Cloudflare account or on request, and the SOC 2 report is released under a non-disclosure agreement.
Anthropic, the models that read and reason
ISO 27001:2022 · ISO/IEC 42001:2023 · SOC 2 Type I · SOC 2 Type II
LabelCheck sends your label to models built by Anthropic to produce the report, and the same models answer the questions you ask about it. Anthropic states it holds ISO 27001:2022 for information security and ISO/IEC 42001:2023 for AI management systems, plus SOC 2 Type I and Type II. ISO/IEC 42001 is the first international standard setting requirements for AI governance, and it is the one you can check without asking anybody: Anthropic announced the certificate publicly, issued by Schellman Compliance, LLC, an ISO certification body accredited by the ANSI National Accreditation Board. The other documents come through Anthropic’s trust portal on request.
Proton, the mail for cosmetifull.com
ISO 27001 · SOC 2 Type II
Mail to and from our addresses is carried by Proton, a Swiss company, under the Swiss Federal Act on Data Protection. Proton states that it has been ISO 27001 certified since 2 May 2024 and that it holds a SOC 2 Type II report. The certificate is linked from its own trust page.
Amazon Web Services, transactional mail from the applications
ISO 27001:2022 · ISO 27017:2015 · ISO 27018:2019 · ISO 27701:2019
Messages the applications send you, such as a password reset, go out through Amazon Web Services from its Frankfurt region. Amazon Web Services publishes the index of its compliance programmes, which anybody can read. The certificates and the audit reports themselves come through AWS Artifact, which needs an AWS account.
What their certificates actually cover
A certificate holds for the company that earned it and for the scope that company put under audit. Cloudflare’s ISO 27001 is about the way Cloudflare manages information security inside its own house. We are a customer of theirs, and the software that runs on top of it is ours to answer for. For anyone assessing a supplier that is the useful distinction: the foundations are covered by the certificates above, and our own part is set out in the section below, and on the Trust page.
What we do ourselves
Every page of this site carries the company’s legal identity, its trade register number and its VAT number, and the build fails if any of the three goes missing. Typefaces, images and stylesheets are served from our own domain, so opening a page sends your IP address only to us and to the company that hosts the site: no third party learns that you were here. Inline scripts run only if their fingerprint is authorised in the Content Security Policy. As for the privacy notice, the facts in it live in one file in our source, and every build compares the finished site against them, so the notice stays true. Secrets live in Cloudflare’s encrypted store, never in the repository. All of this runs in the same build that produced the page you are reading.
Ask for a certificate
Write to security@cosmetifull.com with the supplier and the certificate you need. Where the document is public we send you the link, and where it is not we tell you how its owner releases it.
security@cosmetifull.com