A certificate describes a management system. Not where your code sits.

Security, IP and Compliance in Distributed Engineering breaks down what the usual diligence misses. None of it is fraud. It is scope. Verizon’s 2026 breach report puts third-party involvement at 48% of all breaches, up from 15% two years earlier, and unapproved AI tool use at 45% of employees, up from 15% in a single year. Meanwhile a SOC 2 carve-out leaves your partner’s subcontractor untested, the user entity controls section quietly assigns work to you, and ISO 27001:2013 certificates stopped being valid on 31 October 2025.

The fix is architecture, not paperwork. This paper supplies four control planes covering identity, environment, movement and evidence, a four-tier triage that matches controls to what the work actually touches, and an evidence pack that swaps ten stock assurances for the artefact proving each. It also covers the regime most buyers miss: if your codebase holds export-controlled technology, granting repository access to a foreign engineer may itself require a licence. Rocketeams delivers from South Asia and says plainly where local law offers no cover. Read it before your next repository invitation, then run the evidence pack on us.