Back to documentationdocs/guide/security-evidence.en.mdPrivate repository
Security evidence: scope and pending checks
Scope register dated 31 October 2026. A person must validate the evidence and actual deployment before admitting real data or acting. This document does not establish certification or a SOC 2 report.
What each status means
- Designed / implemented: architecture or code exists for the control. This does not show that it is deployed correctly or works with real identities.
- Tested locally: automated checks ran in the local test environment. Their scope ends at that environment and the providers identified as emulated.
- Operational validation pending: evidence from the hosted environment and review by the responsible people are still missing. This is not presented as a verified control.
Available evidence and limits
| Control | Local or design evidence | Pending validation |
|---|---|---|
| Tenant and roles | Membership, authorization and forced RLS policy tests in local PostgreSQL | Identities, permissions and cross-tenant access denial in the deployed environment |
| Approval | Signed diff and WebAuthn flow tested with a virtual authenticator | Personal review, a real key and an identified person approving the plan |
| Audit | Chain verifier and write restrictions checked locally | Completeness, effective Object Lock, S3 retention and a measured restore |
| Plane separation | Services, identities and networks declared in architecture and manifests | Check effective permissions and networks, and denied production access |
| Supply chain | Configured scanners, locked dependencies, signing and provenance pipeline | Checks for the same commit, published artifacts and image admission at the destination |
| Operations | Documented objectives and procedures | Load, delivered alerts, backups, restore, adversarial evaluation of the real model and independent review |
The integrity command python -m centinela_audit.cli verify checks the audit chain; it does not evaluate all operational controls. A green pipeline does not mean an absence of vulnerabilities.
Demo and real data
The public preview uses synthetic data. In the local functional demo, identity, GitHub, AWS and model providers are explicitly emulated or replayed. An emulator result is not a real Pull Request on github.com; a virtual authenticator does not demonstrate human approval.
The request register does not grant access either. The operator must review scope, roles and expiry before issuing an invitation. Before enabling intake of real personal data, the controller, privacy contact, retention and active-register purge must be validated. Backups require a separately reviewed retention scope.
This local verification does not provide sufficient evidence to advertise operational effectiveness in a hosted cloud or admit sensitive enterprise data. Evidence must be reviewed again for the version and environment intended for use.