Trust · Pilot security requirements
What would have to be true before we trust it with real data?
A private pilot has a gate with twenty items. Today none is verified on a deployed environment, and the gate is closed. That is a finding, not an aim, and it is shown as one.
No certification, audit or independent assessment is held. Each statement below shows how sure the project is of it.
What exists, and how sure we are
- Not in placeThe real-customer-data gate is closed, with no item verified on a deployed environment.Recorded in the pilot evidence pack.
- Not in placeNo certification, audit or independent assessment is held.Recorded in the pilot evidence pack.
- Not establishedNo independent penetration test has been commissioned or performed.Recorded in the pilot evidence pack.
- Not in placePilot terms and data-processing terms have not been reviewed by qualified counsel.Recorded in the pilot evidence pack.
- Partly in placeSeparation between organisations is covered by many local and pipeline tests, but no independent party has tested it.Recorded in the pilot evidence pack.
- Partly in placeAn incident procedure is written, but no alert is deployed to reach a named person.Recorded in the pilot evidence pack.
- Not in placeNo map follows a customer's content from upload to export, so a statement about where it goes cannot yet be checked.Recorded in the pilot evidence pack.
See it in an example
Simulation. A scripted example on fictional data. The wording is scripted and no model is called; the figures are computed from what you decide, and a person’s approval covers exactly what you decided.
See when the real-data gate could open
- What happened
- Meridian Textiles (fictional) will share real data only when the gate is open, and wants to understand what would have to change.
- The question
- How many critical items must be verified, on evidence how old, before the gate could open? Asked by: Pilot sponsor at a customer (fictional).
See when the real-data gate could openMove the evidence. The gate counts only items verified on a deployed environment, with evidence no older than ninety days.Open
Move the evidence. The gate counts only items verified on a deployed environment, with evidence no older than ninety days.
Change the assumptions. Every result and the answer below are recomputed from them, and a warning appears when a result crosses a stated limit.
- Evidence still counts (1 if within ninety days, 0 if older)
- 1
- Critical items still open
- 11
- Items still open, of twenty
- 20
The gate stays closed while any critical item is open.
With 0 of 11 critical items verified, on evidence 30 days old, 11 critical item(s) are still open and 20 of 20 items are open in all.
As recorded in the pilot evidence pack today, no item is verified on a deployed environment, so the gate is closed [S1].
Evidence older than ninety days, or for a different build, does not count, so an item that was verified can fall back out [S2].
Relies on: S1 · The pilot evidence pack: its twenty items, eleven of them criticalS2 · The gate's rules: which environments count and how old evidence may be
The customer's pilot sponsor decides. Approving records the conditions the customer would require before sharing real data. It does not open the gate, and it is not an assessment of the platform.
Ready.
Not done here. It does not open the gate or assess the platform: the gate opens only on evidence from a deployed environment, and none is held yet.
What a reviewer can have, and what not yet
- We can hand overThe pilot evidence pack: each of the twenty items, what exists for it and what is needed to verify it.
- We cannot yetAny item verified on a deployed environment, an independent penetration test, and counsel-reviewed pilot terms.
The capabilities behind this
- A Trust and Security area for customersSecurity and procurement teams ask the same questions again and again, and the answers are scattered.
- Assurance and evidenceWhen an auditor or an inspector arrives, evidence has to be found in a hurry, and gaps appear for the first time.
The other nine
- Customer-controlled accessAccess by organisation, role and location, decided on the server, and what stops when it is withdrawn.
- Read-only database connectionsWhat a read-only connection proves before every use, what it cannot do, and what a customer's administrator should check first.
- Uploaded dataLimits, what is read and what is not, and the checks that are not done.
- AI provider disclosuresWhich features can send content outside the platform, what they may send, and what has not been established.
- Encryption and access controlsWhat protects sign-in, sessions and secrets, and the controls that only a live inspection can settle.
- Audit evidenceA tamper-evident decision record, what it proves, and what it cannot.
- Human approvalsWhat an assistant may draft or propose, what it refuses, and how a person's decision is recorded.
- Data retention and deletionWhat can be deleted now, what must wait, what is kept by design, and what is not finished.
- Customer-hosted and dedicated deploymentUpload, read-only connection, natural-language questions, a customer-hosted connector and a dedicated environment: what exists.