Security & Compliance

Last updated: January 19, 2026

At Atelier Socle, security is not a feature — it's a foundation. Our SDKs are designed for the most demanding applications: banking, healthcare, retail, government.

Our Commitment

Zero External Dependencies

All our security SDKs (CryptoSecurityKit, RetailKit) use exclusively native Apple frameworks:

  • CryptoKit

  • Security.framework

  • LocalAuthentication

Why it matters:

  • No supply chain attack possible

  • Simplified audits (less code to review)

  • Apple-validated crypto implementations

  • Guaranteed compatibility with iOS updates

Auditable Code

MetricValue

Unit & integration tests

670+

DocC documentation guides

100+

Audit event types

27

External dependencies

0

Modern Architecture

  • Actor-based — Thread-safety guaranteed by Swift compiler

  • Sendable — Secure transfer between execution contexts

  • Swift 6 ready — Prepared for language evolution

Implemented Standards

Cryptography

StandardDescriptionOur SDKs

NIST FIPS 197

AES (Advanced Encryption Standard)

✅ AES-256-GCM

NIST FIPS 180-4

SHA-2 (Secure Hash Algorithm)

✅ SHA-256, SHA-512

NIST FIPS 186-4

ECDSA (Elliptic Curve Digital Signature)

✅ P-256

RFC 2104

HMAC (Hash-based MAC)

✅ Constant-time

RFC 5869

HKDF (Key Derivation Function)

✅ Complete

RFC 2898

PBKDF2 (Password-Based KDF)

✅ 310K iterations

RFC 8032

Ed25519 (Edwards-curve DSA)

✅ Complete

RFC 7748

X25519 (Curve25519 ECDH)

✅ Complete

Certificates & TLS

StandardDescriptionOur SDKs

RFC 5280

X.509 PKI (Certificate validation)

✅ ~85%

RFC 6125

Hostname verification

✅ ~95%

RFC 7469

HTTP Public Key Pinning

✅ 3 modes

RFC 6960

OCSP (Revocation checking)

✅ Via system

RFC 6962

Certificate Transparency

🔜 In progress

NIST SP 800-52

TLS configuration

✅ TLS 1.2+

NIST SP 800-57

Key management

✅ Compliant sizes

Post-Quantum (iOS 26+)

StandardDescriptionOur SDKs

NIST FIPS 203

ML-KEM (Key Encapsulation)

🔜 Roadmap Q3 2026

NIST FIPS 204

ML-DSA (Digital Signatures)

🔜 Roadmap Q3 2026

Regulatory Compliance

Enterprise Certifications ✅

CertificationStatusNotes

ISO 27001

Architecture compliant

Audit-ready

SOC 2 Type II

Architecture compliant

Built-in audit trail

PCI-DSS

Crypto compliant

AES-256, key management

GDPR

Privacy by design

On-device data

eIDAS

Compatible

Qualified signatures possible

Certification Roadmap

CertificationLevelTimeline

CSPN (ANSSI)

French first-level

2027

Common Criteria EAL4+

International

Long-term vision

We are actively seeking partners and sponsors to accelerate the certification process. Contact us if you're interested.

Development Practices

Secure Development Lifecycle

  1. Design — Threat modeling before each feature

  2. Code — Mandatory code review, static analysis

  3. Test — Unit tests, integration, fuzzing

  4. Release — Package signing, verifiable checksums

  5. Monitor — CVE monitoring, proactive updates

Vulnerability Management

If you discover a vulnerability in one of our SDKs:

  1. Do not disclose publicly before fix

  2. Contact us via our contact form

  3. Include: description, reproduction steps, potential impact

  4. Timeline: We commit to responding within 48 hours

We practice responsible disclosure and credit researchers who help us improve our SDKs.

Transparency

Open Source

Our SDKs are open source (Apache 2.0 or MIT depending on the project). The code is public, auditable by everyone.

Public Documentation

All our technical documentation is public:

  • Algorithms used

  • SDK architecture

  • Known threat models

  • Documented limitations

Security Changelog

Each release includes a detailed changelog with security fixes clearly identified.

Security FAQ

Are your SDKs audited?

Our SDKs are designed according to best practices and exclusively use Apple's crypto implementations (already audited). We are preparing an independent external audit for 2026-2027.

Why no certification today?

CSPN or Common Criteria certifications cost between €30,000 and €300,000. We are first building a solid foundation and seeking partners to fund these certifications. Become a sponsor.

Can I use your SDKs for a banking/healthcare application?

Yes, our SDKs are designed for these use cases. The architecture complies with ISO 27001, PCI-DSS requirements. However, your application's compliance also depends on your implementation and infrastructure.

How do I report a vulnerability?

Via our contact form. We respond within 48 hours and practice responsible disclosure.

Contact

For any questions regarding security or compliance: