Map
Relate requirements to architecture, identities, data paths, owners, and source evidence.
Trust / Control evidence
Claims should have implementation receipts.
A transparent map of the controls Hyperoru implements today, the boundaries we still track, and the evidence a reviewer can inspect without confusing product behavior with certification.
Control map
Implemented, bounded, and still challengeable.
Each control pairs its intended protection with concrete engineering evidence and a known boundary. Release gates remain visible until they are actually complete.
Select a control
ImplementedRead the public security model
Workspace-scoped access
Application authorization and PostgreSQL row-level policies scope access to the active workspace.
Review evidence
API permission tests, RLS migrations, cross-tenant retrieval and cache tests
Known boundary
Some background workers require broader database visibility to claim jobs. Their queries and session context remain explicit review points.
This is a product control map, not a certification badge. Status describes the repository and deployment contract reviewed on 29 August 2026.
Assessment model
Compliance evidence is not a decorative checkbox.
Hyperoru can organise controls, artifacts, findings, exceptions, and review history. A qualified assessor and the applicable programme still determine certification or attestation.
Verify
Keep the exact artifact, freshness, collector, confidence, and contradiction behind each claim.
Review
Record supported, partial, gap, not applicable, or unknown without turning absence into assurance.
Decide
Preserve reviewer approval, exceptions, compensating controls, expiry, and change history.
Deterministic scanner set
Pinned tools, visible versions, upstream terms.
The runner uses digest-pinned scanner images. Upstream project licenses apply to those tools; Hyperoru product rights are governed by its terms and customer agreement.
| Tool | Pinned version | Evidence role | Upstream license |
|---|---|---|---|
| Trivy | 0.72.0 | Vulnerabilities and configuration | Apache-2.0 |
| Semgrep | 1.172.0 | Static code patterns | LGPL-2.1 |
| Gitleaks | 8.30.0 | Secret detection | MIT |
| Checkov | 3.2.527 | Infrastructure policy | Apache-2.0 |
| Syft | 1.51.0 | Software bill of materials | Apache-2.0 |
Versions are read from the runner lockfile reviewed on 29 August 2026. Digests remain the deployment authority. Third-party names and marks belong to their respective owners.
Ask for the evidence behind a control.
Private launch teams can review current controls, accepted risks, data boundaries, deletion behavior, scanner provenance, and the release gates that still remain.