Compliance and assurance

Start a compliance review with the obligation you need to answer. Lithi provides contracts, product controls, focused tests, and provider materials that address different parts of that question. They do not create a Lithi certification or decide your organization's legal obligations for you.

Start with the obligation

Name the framework or contract duty, data class, operation, customer role, environment, and review period. Then choose the narrowest source that addresses that question. Use the Privacy Policy and Data Processing Agreement for terms, roles, instructions, security measures, retention, transfers, and related duties.

Your organization remains responsible for its legal basis, notices, instructions, configuration, and decisions. Lithi can explain product boundaries and available review material, but it cannot provide a legal conclusion for your organization.

Separate contracts, product controls, and tests

Keep the scope and date with the evidence you share.

Review provider reports carefully

A provider may publish a report or certification for its own service. That material can support a provider-specific review when it identifies the issuer, report or certificate date, covered service, criteria, exclusions, review period, and verification link.

Lithi does not claim SOC 2 or ISO/IEC 27001 certification. UK GDPR certification schemes can exist for a defined processing operation and scope under an approved scheme. They do not transfer from a provider to Lithi or establish that every use is compliant. The ICO guide to certification schemes explains this bounded mechanism.

For HIPAA, the U.S. Department of Health and Human Services says the Security Rule does not require an organization to obtain certification. A third-party certificate does not replace the underlying duties (HHS guidance).

A provider's SOC 2, ISO/IEC 27001, HIPAA, PCI DSS, or GDPR material remains provider-specific. It does not become Lithi's certification or establish that your use is compliant.

Choose the evidence you need

Start with the decision, not with a large document bundle. Ask for the smallest useful set. For example, a review of Compute security boundaries may need the Compute security page, how Compute encrypts your data, and a current environment-specific check. A review of contractual duties belongs with the DPA and your agreement.

Check the review date, product version, environment, and operation covered by each item. A recent source review can still lack an environment check. A provider report can remain genuine while excluding the service or data path you are evaluating. Keep conclusions narrow: a passing check supports the cases it names, not an untested configuration or data class.

The Compute Kit's security profiles, evidence indexes, and questionnaires can support a scoped review by pointing to the applicable controls and evidence. They are not an audit, certification, or proof that every customer configuration meets a requirement.

Accessibility

Lithi aims to make its public pages and product controls operable for people with different access needs, including keyboard use, readable text and contrast, clear labels, reduced motion, and assistive-technology support. This page does not claim complete conformance, a fixed audit schedule, or a guaranteed repair time.

To report a barrier, contact us and name the page or product surface you used, what you tried to do, and which browser, device, or assistive technology was involved. Share the minimum context needed to reproduce the problem; do not include credentials, private customer content, payment details, identity documents, or unrelated personal data.

Keep conclusions scoped

Mark a question open when its source lacks an issuer, date, scope, environment, period, exclusion, or verification link. Request updated material after a material product, provider, configuration, or obligation change. Do not fill a gap with a badge, inherited statement, or undated summary. Keep each conclusion beside the source that supports it and the limit that qualifies it.

What this review covers

For contractual processing terms, read the Data Processing Agreement.