Framework posture
A framework-by-framework view of where Wentzel Investments LLC stands across the Wentzel Compliance Baseline — both the self-attestation track (CMMC L2, CAIQ v4, GDPR, PCI SAQ-A) and the paid-certification roadmap (SOC 2 Type II, ISO/IEC 27001, ISO/IEC 42001; SOC 3 rides SOC 2). Quote the enterprise diligence evidence table first: those rows are live-repo facts. Readiness percentages appear only when the Confluence snapshot is the primary source. We say Aligned / Operational, never Certified, until an independent auditor issues a report — and today that count is zero.
Enterprise diligence evidence
Repo-verifiable answers for a prospect walkthrough. Status is Aligned / Operational / Partial — never Certified. Quote this table, not seed-fixture percentages.
| Topic | Status | Honest answer | Verify |
|---|---|---|---|
| SOC 2 Type II | Aligned | Aligned — engagement pending. SOC 2 issues a report, not a certificate. Zero reports on file. | Trust Center home |
| ISO/IEC 27001:2022 | Aligned | Aligned — ISMS scope and SoA are maintained. No certificate has been issued. | ISO 27001 scope |
| PCI DSS SAQ-A | Aligned | Aligned — Stripe-hosted checkout; no cardholder data environment on Wentzel origins. | Confidentiality |
| GDPR / CCPA data-subject rights | Partial | Public DSR intake is live. Fulfilment is a manual team process; @wentzel/data-export is not wired. | DSR form |
| CMMC L2 (voluntary) | Aligned | Voluntary NIST 800-171 self-assessment only. No CUI, FCI, or DoD data. Not contractual. | Framework posture |
| CSA CAIQ v4 | Partial | Self-assessment in progress. Not published to the CSA STAR registry. | Framework posture |
| Third-party reports issued | Zero | Zero. Nominated auditor (Prescient Assurance) engagement is pending. Nothing is Certified. | Framework posture |
| Immutable audit archive (S3 Object Lock) SEC-81 | Pending | Pipeline pending operator apply. Do not claim a live WORM store or Athena query surface. | Security controls |
| Dedicated status hostname | Not live | status.wentzel.ai is not live. Fleet availability is the Nexus board at nexus.wentzel.ai/status. 99.5% figures are targets, not measured guarantees. | Availability |
| Support intake | Operational | Support desk is support.wentzel.ai + JSM customer portals. The Trust Center is not a paid SKU. | Contact |
Adherence snapshot 2026-06-14-wcb1 · generated Sun, 14 Jun 2026 02:00:17 GMT · source: Confluence COMP / WCB / Adherence Snapshot
How to read this
- Self-attestation track — frameworks we can stand behind today on our own assessment (CMMC L2 self-assessment with an SPRS score, CAIQ/CCM answer set, GDPR readiness, PCI SAQ-A). No external auditor is required for these, but they are still our attestation, not a certificate.
- Paid-certification track — SOC 2 Type II and ISO/IEC 27001/42001, where an independent auditor (nominated: Prescient Assurance) must issue the report or certificate before we describe ourselves as anything beyond Aligned. The percentages here are readiness toward that engagement.
- Per-control detail — the control-by-control matrix, evidence pointers, and live issue tracking are available to enterprise customers under NDA on request to security@wentzel.ai (request instructions). Packets are not self-serve downloads. No penetration-test report or dated disaster-recovery drill report is on file yet; both are pending.
8 frameworks tracked. Source content lives in Confluence (COMP space); this page renders the latest published adherence snapshot. Reviewing us? Reach our security team at security@wentzel.ai or see our Security controls.