VibeLock is an application-level tool. It verifies the application and its code, and nothing else. The requirements it reports against are the ones whose truth can be observed there.
Coverage per framework is not tracked separately. It is derived: each control maps to the requirements it satisfies, and a requirement is met when every control mapped to it is verified. There is nothing to mark complete.
The four frameworks
- OWASP ASVS 5.0
- The spine. Level 1 is the minimum set as OWASP defines it. Level 2 is the recommended set. Level 3 is excluded. Always applies.
- GDPR
- Fourteen application-level articles: minimisation, security of processing, lawful basis and consent, transparency, access, erasure, portability, protection by default, processors, and breach notification. Applies when EU users is true.
- EU AI Act
- Article 5, the prohibited practices, and Article 50, the transparency duties. Applies when both AI feature and EU users are true.
- OWASP Top 10 for LLM Applications
- Prompt injection, improper output handling, excessive agency, system prompt leakage and unbounded consumption. Advisory: reported, never blocking. Applies when AI feature is true.
What is excluded, and why
Of the 345 ASVS 5.0 requirements, 92 are Level 3 and excluded as a whole. The OAuth and OpenID chapter describes identity-provider and authorization-server duties and is excluded. Requirements about hosting, network, memory safety, media servers and organisational process live outside the application and are excluded. Requirements that describe documentation with no published document to check are excluded. Each exclusion states its reason on the requirement.
Sixty-four Level 2 requirements are in scope but beyond what four signals can observe. They appear on your dashboard as a count, never in a denominator, and never on the public page.
What is deliberately not covered
SOC 2, ISO 27001, PCI DSS, HIPAA and NIST CSF assess an organisational or infrastructure programme: staff, vendors, physical premises, cloud configuration, monitoring. An application-level tool cannot see any of that, so coverage against those frameworks would describe nothing. VibeLock does not report it and there is no tier that changes this.
What VibeLock does do is evidence the application-level controls those audits will also ask about. If a buyer is asking for SOC 2, the verified controls are a genuine head start on the application section of that work, and no more than that.
A VibeLock Trust Center is not a certification, an attestation or an audit against any standard. The page says so on its face, and that wording is not configurable.