> For the complete documentation index, see [llms.txt](https://docs.novalink.technology/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.novalink.technology/compliance-and-regulatory/compliance-and-certification-roadmap.md). # Compliance & Certification Roadmap Public commitments — what we have, what is coming, by when **Published notice — status, accuracy and right to amend.** This document is published by the Company in good faith for general information and transparency. It is current only as of its stated date and is provided “as is,” without warranty of completeness or accuracy; it may contain errors or omissions and does not constitute legal, financial, tax, or investment advice, an offer or solicitation, or any guarantee. The Company may revise, correct, update, supplement, or withdraw this document at any time without prior notice, and the version published on the NovaLink Transparency Portal is the controlling current version and supersedes any earlier copy. Where this document conflicts with a signed agreement between you and the Company, or with applicable law, that signed agreement or applicable law prevails. If you believe anything here is inaccurate or out of date, please contact so we can review it and, where appropriate, correct it. To the maximum extent permitted by law, the Company accepts no liability for any reliance placed on this document. **Document ID:** NL-ROAD-01 **Version:** 1.0 **Status:** Issued — quarterly refresh **Issuing entity:** Group-wide policy — adopted by each NovaLink entity listed in the Corporate Structure & Entity Register (NL-ORG-01) **Applies to:** the NovaLink product, network and Nx1/Hx1 Home Stations, regardless of which Community Platform a participant joined through **The NovaLink entities:** Ntech Link Technologies Ltd, Co. No. 2195904 (Store Operator) · Auralink Nova Technology L.L.C, Dubai, Reg. No. 1607764 (Technology Provider) · NodeLink USA, Inc., Delaware, File No. 10606222 (US Distribution) **Effective date:** 22 May 2026 **Contact:** ### 1. Why we publish a roadmap Sophisticated technical reviewers, enterprise prospects, regulators, and Node Operators are right to ask not only "what controls do you have?" but also "what controls will you have, by when, and with what independent evidence?" This Compliance and Certification Roadmap (the "Roadmap") is the Company's public commitment in that direction. It is updated quarterly; the version date is on the front cover. Items shown here as "targeted" or "in flight" are intended commitments, not declarations of present achievement. ### 2. Snapshot — what we already have * BVI company registration . * Published Terms and Conditions, Privacy and Cookies Policy, and Risk Disclosure Policy on the NovaLink Transparency Portal. * KYC / KYB onboarding via a third-party provider; mandatory MFA for accounts; encryption in transit and at rest for sensitive data; access restricted to authorised personnel. * A product-based model: the Company sells products (the Nx1/Hx1 Home Station machine and the Node Telemetry License) and distributes participation rewards, which participants withdraw to their own external crypto wallets. The Company is not a custodian and does not hold customer assets on the customer's behalf. ### 3. Foundation (initial deliverables shipped; remaining items retargeted to December 2027) | Workstream | Deliverable | Status | | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ | | Network policies | Publish: Acceptable Use Policy (NL-AUP-01); Data Minimisation & Retention Policy (NL-LOGS-01); LE Request Policy (NL-LE-01); Vulnerability Disclosure Policy (NL-VDP-01); Sanctions Policy (NL-SANC-01); Node Operator Agreement (NL-NOA-01) | Issued with this document pack | | Sanctions screening | Weekly re-screening of full base operational | In flight; target December 2027 | | Nx1/Hx1 Home Station security | TPM-anchored boot attestation on all units shipped from Q3 2026 | In flight | | Australian operations | Australian privacy contact published (); AUSTRAC DASP applicability assessment for the Community Operators being finalised with counsel as a priority | Privacy contact: done. DASP assessment: in flight — priority | ### 4. 2027 — First independent assurance | Workstream | Deliverable | Owner / vendor type | | -------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | | Penetration test | First independent black-box + grey-box pentest of Nx1/Hx1 Home Station firmware, Workload Runtime, Coordination Plane, and Platform web/API | Specialist application-security firm (Cure53-class / Trail of Bits-class / NCC-class) | | Workload-publisher onboarding controls | Independent design review of Workload Publisher KYB, code-signing, and Workload risk classification | Same vendor or independent compliance firm | | AUSTRAC | If registration is required, file DASP registration | Australian regulatory counsel | | BVI VASP | File VASP Act application with the BVI FSC if the BVI counsel's view confirms the Company's functions fall within the VASP Act perimeter (this is being assessed) | BVI counsel | ### 5. Q4 2026 / 2027–2028 — MicroVM isolation (Q4 2026); no-content-logging assurance (2027); insurance placement (cyber Q4 2027, other lines 2028) | Workstream | Deliverable | | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | No-content-logging assurance | Independent reasonable-assurance engagement on the no-content-logging position in the Logs Policy. Target: 2027; annual thereafter. | | MicroVM isolation | Gating control for the Consumer Connectivity Relay Workload class. Class remains disabled until microVM isolation has been independently reviewed. Target: Q4 2026 (integration we control). | | Cyber insurance | Bind cyber-liability cover (target USD 5 M per claim / USD 10 M aggregate). Target: Q4 2027. Tech E\&O cover: target 2028. | ### 6. Q1 2027 — First transparency report; bug bounty | Workstream | Deliverable | | --------------------------------- | ---------------------------------------------------------------------------------------------------------------- | | Transparency report | Publish first annual transparency report covering: law-enforcement requests; abuse takedowns; security incidents | | Bug bounty | Open a funded bug-bounty program (HackerOne-class or Intigriti-class) | | Network/Media liability insurance | Bind cover (target USD 2 M aggregate). Target: 2028. | ### 7. Q2–Q4 2027 — SOC 2 and standards alignment | Workstream | Deliverable | Target | | -------------------------------- | ---------------------------------------------------------------------------------------------------- | ----------------- | | SOC 2 Type I | Independent CPA-firm SOC 2 Type I (Trust Services Criteria: Security, Availability, Confidentiality) | Q2 2027 | | SOC 2 Type II | Type II covering minimum 6-month observation period | Q4 2027 / Q1 2028 | | CSA STAR Level 1 self-assessment | Cloud Security Alliance STAR Level 1 | Q3 2027 | ### 8. 2028 — ISO 27001 and beyond | Workstream | Deliverable | Target | | ------------------------ | ------------------------------------------------------------------------- | ---------------------- | | ISO/IEC 27001:2022 | Certification by accredited body | Q3 2028 | | ISO/IEC 27701 (privacy) | Extension to 27701 | Q4 2028 | | PCI DSS scope assessment | Confirm whether the Platform comes into PCI scope and respond accordingly | 2028, as scope evolves | ### 9. How to track this Roadmap * A live dashboard on the NovaLink Transparency Portal will track each item and its current status. * The annual Transparency Report will reconcile commitments against delivery. * Material slippage will be announced in advance with a revised target date. ### 10. Contact