Implemented controls, local evidence and pending checks. The scope of each claim must be reviewed before admitting real data or acting.
Evidence and scope
A scope register based on local project checks. It is not a current operational measurement and does not establish deployed controls, certification or an independent report.
Register date:
Local tests checked tenant membership, roles and row-isolation policies in PostgreSQL.
Pending: check effective identities and permissions in the hosted environment.
Read evidence and limitsLocal integration checks the signed diff and WebAuthn flow with a virtual test authenticator.
Pending: personal diff review, a real key and approval by an identified person.
Read evidence and limitsThe chain verifier and write restrictions were checked in the local environment.
Pending: S3 retention, effective Object Lock, completeness, backups and a measured restore.
Read evidence and limitsThe architecture and manifests separate analysis, decision and execution through services and identities.
Pending: verify network boundaries, denied access and actual permissions in the authorized deployment.
Read evidence and limitsThe pipeline configures scanners, locked dependencies, artifact signing and provenance.
Pending: review checks for the same commit and verify signing and admission of each published artifact.
Read evidence and limitsAvailability, recovery and response objectives need measurements and responsible people in the deployed environment.
Pending: load, delivered alerts, a restore drill, evaluation of the real model and independent review.
Read evidence and limitsA person must validate the evidence and actual deployment before admitting real data or acting. An automated result and register date do not replace that decision.
Execution checks an approval bound to the signed plan. A person must review evidence and approve before acting; an automated test does not establish that review.
The architecture separates analysis, decision and execution through services and identities. Effective network and permission separation must be verified for each deployment.
The design treats external content as untrusted data. Defenses and evaluations must be tested again with the providers and models intended for use.
Least privilege and short-lived credentials are deployment objectives. No absence of persistent secrets is asserted for environments that have not been inventoried and validated.
The audit chain supports integrity verification. Retention, Object Lock protection, backups and restoration require operational checks.
The repository contains a threat model and control tests. Results have a specific scope; they do not prove an absolute absence of vulnerabilities or replace a pentest or human review.
These references guide control preparation. No ISO 27001 certification or issued SOC 2 report is asserted. A person must validate the scope, evidence and deployed controls; that review remains pending.
GDPR and Chile's Ley 21.719: references for reviewing processing, retention and erasure with the people responsible for privacy. Applicability and compliance require human validation.
ISO 27001:2022 A.8.8: a reference for mapping technical vulnerability management evidence. The mapping requires human review and does not establish certification.
SOC 2 preparation: criteria mapping and human evidence review remain pending. “python -m centinela_audit.cli verify” checks audit-chain integrity; it does not replace an independent evaluation of the controls.