Movahedi Solutions
Compliance
1000823315 ONTARIO INC., operating as Movahedi Solutions, Mississauga, Ontario, Canada. Contact: mohammad@movahedi.ca. The grid below lists only verified items, each with its date and its link. Regulatory mappings are on a separate page, labelled as mappings only. No item in the grid is a certification, and no mapping is a compliance claim.
Verified items grid
| Item | What is verified | Date | Check it |
|---|---|---|---|
| Website Privacy Policy | Policy for the website itself, published on movahedi.ca | Last updated October 29, 2026 | Privacy Policy |
| Privacy and data handling for engagements | Client material used only for its engagement, not sold, not used to train models, returned or deleted at engagement end on client instruction | October 27, 2026 | Privacy and Data Handling |
| Header scan | Third-party header scan; see Security Practices for the dated result | October 28, 2026, at 00:59 UTC | Security Headers scan |
| SSL Labs grade | Grade A on all four endpoints tested | Assessed October 28, 2026, at 01:00:26 UTC | SSL Labs: movahedi.ca; detail DNS and SSL Checks |
| Self-assessments | Privacy, AI governance, cybersecurity, website self-check, CAIQ-Lite, NIST CSF matrix, CIS and MVSP alignment, each labelled as a self-assessment | October 27-29, 2026 | Self-Assessments |
| Founder personal credentials | ISC2 CC, CIPP/C, Lean Six Sigma coursework (LinkedIn Learning, 2022), personal only | October 27, 2026 | Certificates |
| DNS and mail records | SPF hard fail, DKIM for the Google selector, DMARC at quarantine policy, Google mail routing | October 28, 2026 (UTC) | DNS and SSL Checks |
Regulatory mappings, labelled as mappings only
Structured cross-mappings for NIS2, DORA, GDPR, HIPAA, and ISO/IEC 42001, plus EU AI Act readiness, to services and to buyer questions, are on the Regulatory Mappings page. Each mapping is labelled as a mapping only. No mapping is a compliance claim, a certification, or a legal opinion. A client program's compliance depends on that client's decisions, systems, and records, confirmed per engagement.
Third-party risk
Public-site tools, verified, are listed on the Subprocessors page: Cloudflare, GitHub, Google Workspace, MailerLite, and Cal.com. Engagement tools are agreed per engagement. Detail: Vendor Security Questionnaire, Category J.
Related pages
Scope and limits, stated briefly
Nothing on this page is a certification, a compliance claim, or a legal opinion. Where a matter is to be confirmed per engagement, it is stated as such, and it is confirmed in writing for that engagement before work starts. Contact: mohammad@movahedi.ca.