§Trust Page
ActiveDemo record
V3Code Verified
Example Cloud
Owner: Example Technologies · app.example.com
Cloud workspace for distributed teams: documents, tasks and an API for integrations.
14 / 14
14 of 14 checks passed
Critical 0High 0
A certificate is not a promise of absolute security. It confirms the results of the checks only within the published scope, on the stated date and under the stated version of the methodology.
Not covered by this certificate
- AI/Agent Security
- Mobile application (iOS, Android)
- Payment infrastructure of the third-party provider
Scope of the certificate
- Components in scope
- Web application, API, Source repository, Domains and DNS
- Domains in scope
- app.example.com, api.example.com
- Environment
- Production
- Methodology
- V-Standard 2026.3
- Level
- V3 · Code Verified
Verified checks
Each row names the check, its method, the date and a public evidence summary. Technical details are held privately by CyberSecurityV.
A · External perimeter
A01 TLS configuration and certificate validityPublic endpoints negotiate only modern protocol versions with a valid, correctly chained certificate. Automated check Passed
Public evidence summaryAll four public endpoints negotiate TLS 1.2 and 1.3 only; certificates are issued by a public CA, chain correctly and expire more than 60 days after verification.
CheckSupported protocol versions and cipher suites, certificate chain, expiry, revocation information, key strength and known TLS weaknesses on every public endpoint in scope.
A03 DNS configuration and zone hygieneNo dangling records or takeover conditions were found in the domains in scope. Automated check Passed
Public evidence summaryTwo authoritative providers, no dangling CNAME or unclaimed cloud resources across 14 records in the zones in scope; zone transfer refused.
CheckAuthoritative servers, DNSSEC where applicable, dangling records that allow sub-domain takeover, zone transfer exposure and consistency between public and expected records.
B · Application and API
B03 Authorisation and rolesEvery tested function and object enforces the declared role model. Manual scenario Passed
Public evidence summaryRole model (owner, admin, member, guest) exercised across 28 functions and object types with two test organisations; no horizontal or vertical escalation.
CheckRole model enforcement on every function and object: horizontal and vertical privilege escalation, insecure direct object references, mass assignment.
B04 Tenant and data isolationNo cross-tenant data access was found in the tested scenarios. Evidence review Passed
Public evidence summaryTenant identifier enforced at the data-access layer; exports, search index and background jobs reviewed. Cross-tenant requests returned no data in all 19 scenarios.
CheckSeparation of data between organisations or accounts in a multi-tenant product: queries, storage, caches, background jobs and exports.
B07 API authentication and object-level authorisationAPI resources enforce authentication and object-level authorisation. Automated and manual check Passed
Public evidence summaryBearer tokens with 1-hour lifetime and rotation; object-level authorisation confirmed on 41 resources; no undocumented endpoints reachable.
CheckToken handling, key rotation, object- and property-level authorisation on API resources, function-level access control.
C · Code and supply chain
C01 Dependencies and known CVEsNo dependency in scope carried an unresolved Critical or High vulnerability. SCA / CVE matching Passed
Public evidence summary412 direct and transitive dependencies matched against CVE/NVD, GitHub Advisory Database and OSV. Two Medium findings remediated before issue; no Critical or High.
CheckSoftware composition analysis of direct and transitive dependencies against published vulnerability records; unmaintained and end-of-life components.
C02 Secrets in code and historyNo live credentials were found in the repositories in scope. Secret scan Passed
Public evidence summaryRepository tree, full commit history and CI configuration scanned. One expired test token found in history and rotated; no live credentials.
CheckCredentials, tokens, keys and certificates in the repository tree, commit history, build configuration and container layers.
C03 Static analysis (SAST)Static analysis findings were triaged; none remained at Critical or High. Static analysis (SAST) Passed
Public evidence summaryRule-based analysis of the application and API code with manual triage of 37 findings: 31 false positives, 6 Low accepted with documented rationale.
CheckRule-based analysis of the source for injection, unsafe deserialisation, cryptographic misuse, insecure defaults and dangerous functions, with manual triage of findings.
C04 Software bill of materialsA software bill of materials is maintained and matches the deployed build. Evidence review Confirmed
Public evidence summaryCycloneDX 1.5 SBOM generated by the pipeline for every release; component list reconciled with the deployed build.
CheckA machine-readable SBOM (CycloneDX or SPDX) exists, matches the deployed build and can be regenerated by the pipeline.
C05 CI/CD securityThe delivery pipeline restricts permissions and protects its secrets. Evidence review Confirmed
Public evidence summaryPipeline runs with scoped tokens, secrets are injected from a vault at job level, third-party actions pinned by commit hash, production deploy requires an approval.
CheckPipeline permissions, secret handling in jobs, third-party actions and images, artefact signing and separation between build and deploy credentials.
D · Infrastructure
D07 Backup and recoveryBackups exist, are encrypted and a restoration has been tested. Evidence review Confirmed
Public evidence summaryDaily encrypted backups with a 35-day retention in a separate region; a full restoration was performed on 2026-08-19 and documented.
CheckBackup coverage of production data, encryption of backups, off-site copies, restoration tests and recovery time objectives.
E · Data and processes
E01 Encryption at restCustomer data is encrypted at rest with managed keys. Evidence review Confirmed
Public evidence summaryDatabases, object storage and backups encrypted with provider-managed keys; key ownership and rotation policy documented.
CheckEncryption of databases, object storage, backups and disks holding customer data; algorithms and key ownership.
E02 Encryption in transitInternal traffic between components is encrypted. Evidence review Confirmed
Public evidence summaryService-to-service traffic and database connections use TLS inside the private network; administrative access only through an authenticated bastion.
CheckEncryption of internal service-to-service traffic, database connections and administrative channels, not only the public edge.
E05 Incident responseAn incident response plan exists and has been exercised. Evidence review Confirmed
Public evidence summaryWritten plan with severity levels, on-call roles and customer notification rules; tabletop exercise held in June 2026.
CheckA written plan with roles, contacts, severity definitions, customer notification rules and evidence of at least one exercise or real incident review.
Verification history
- Application submitted
- Scope confirmed
- Verification started
- Expert review completed
- Certificate issued
Verify this record
The registry record behind this page is signed with the CyberSecurityV registry key. Your browser can verify the signature and the fingerprint without contacting anyone but the registry.
Record fingerprint (SHA-256): 7d1a57507efb2101b6604a5bfc863aff953a2d6e5d1d3c81997071d64d54334d
Registry signature (Ed25519): 3B3UMpc38zjve0Cg6tkaqC286YonIB9TvVHYbww3Lz0fIYk9sClVyN74U2wDwARlNn6B96it3PEY42/G0RGLAg==