Audit log on every protected route. Privacy Policy live. Constitution published. RBAC + isolation + encryption in production. The substrate every certification asks for is in place.

What we don't have yet — SOC 2, ISO 27001, HIPAA — we say so plainly. No fake badges, ever.