Estado de certificaciones
Para qué está certificado ShelfTap y, sobre todo, para qué no lo está.
Estas políticas se publican en inglés. El texto en inglés es la versión vinculante; las traducciones se ofrecen solo como referencia.
Última actualización: 2026-08-01
Los datos registrales de la sociedad que presta este servicio aún no se han publicado. Aparecerán aquí y en el pie de página en cuanto se confirmen.
What we hold
Nothing. ShelfTap holds no information-security or privacy certification.
Stated plainly
- ISO/IEC 27001: not certified. No certification, no audit in progress, and none currently planned.
- SOC 2 (Type I or Type II): not attested. No report exists, no audit is under way, and none is currently planned.
- ISO/IEC 27701, PCI DSS, HIPAA, FedRAMP, Cyber Essentials: none of these apply to us and none are held.
- No independent penetration test has been commissioned or published.
If a procurement questionnaire asks for any of the above, the answer is no. We would rather lose the deal than imply a certification we do not have. If certification becomes a requirement for your organisation, tell us at support@shelftap.com — we will say honestly whether and when we could pursue it, and we will not put a date on this page until an auditor is engaged.
What we offer instead
In place of a certificate we publish the underlying detail, so it can be assessed directly:
- The Resumen de Seguridad page lists every control that is actually implemented — and a "what we do not claim" section listing the gaps.
- The Conservación de Datos page publishes the exact retention windows compiled into the service, plus the known limitation of the purge job.
- The Subencargados del tratamiento page names every third party and what each receives.
- The Respuesta a Incidentes page states our breach-notification window.
- The Acuerdo de Tratamiento de Datos is available for signature.
Ranking neutrality
A related commitment, since it is the other thing buyers ask us to certify: no payment of any kind affects the ranking of buyer search results. The result ordering is computed from an evidence-based ranking score and a contact-quality score only; no billing, verification or promotion field is read anywhere in that path. Paid verification and promotion apply solely to the separate supplier directory, where promoted entries are ordered above unverified ones. The two surfaces are kept apart deliberately.