§Trust Page
ActiveDemo record
V4Assured
Example Platform
Owner: Example Technologies · platform.example.com
Managed data platform for enterprise customers with dedicated tenants and an administration console.
24 / 24
24 of 24 checks passed
Critical 0High 0Monitoring: Active
A certificate is not a promise of absolute security. It confirms the results of the checks only within the published scope, on the stated date and under the stated version of the methodology.
Not covered by this certificate
- AI/Agent Security
- Customer-managed on-premises connectors
Scope of the certificate
- Components in scope
- Web application, API, Source repository, Domains and DNS, Cloud infrastructure, Database, CI/CD pipeline
- Domains in scope
- platform.example.com, console.example.com, api.platform.example.com
- Environment
- Production
- Methodology
- V-Standard 2026.3
- Level
- V4 · Assured
Verified checks
Each row names the check, its method, the date and a public evidence summary. Technical details are held privately by CyberSecurityV.
A · External perimeter
A01 TLS configuration and certificate validityPublic endpoints negotiate only modern protocol versions with a valid, correctly chained certificate. Automated check Passed
Public evidence summaryPublic endpoints negotiate only modern protocol versions with a valid, correctly chained certificate.
CheckSupported protocol versions and cipher suites, certificate chain, expiry, revocation information, key strength and known TLS weaknesses on every public endpoint in scope.
A02 HTTPS enforcement and HSTSAll traffic in scope is forced to HTTPS and protected by HSTS. Automated check Passed
Public evidence summaryAll traffic in scope is forced to HTTPS and protected by HSTS.
CheckPlain-HTTP requests are redirected to HTTPS, HSTS is present with an adequate lifetime, and no content in scope is served over an unencrypted channel.
A03 DNS configuration and zone hygieneNo dangling records or takeover conditions were found in the domains in scope. Automated check Passed
Public evidence summaryNo dangling records or takeover conditions were found in the domains in scope.
CheckAuthoritative servers, DNSSEC where applicable, dangling records that allow sub-domain takeover, zone transfer exposure and consistency between public and expected records.
A04 Email authentication (SPF, DKIM, DMARC)Sender authentication is configured with an enforcing policy for the domains in scope. Automated check Passed
Public evidence summarySender authentication is configured with an enforcing policy for the domains in scope.
CheckSender authentication for the product's domains: SPF syntax and scope, DKIM signing, DMARC policy and reporting, MTA-STS where present.
A05 HTTP security headersSecurity headers are present and configured without unsafe exceptions on the pages in scope. Automated check Passed
Public evidence summarySecurity headers are present and configured without unsafe exceptions on the pages in scope.
CheckContent-Security-Policy, frame protection, content-type sniffing, referrer policy, permissions policy and cache directives on sensitive responses.
A06 Exposed services and open portsOnly the intended services are reachable from the internet. Automated check Passed
Public evidence summaryOnly the intended services are reachable from the internet.
CheckInventory of listening services on the public perimeter, unexpected management ports, databases or message brokers reachable from the internet.
A07 Known-vulnerable software versionsNo component on the perimeter matched a published vulnerability at the time of verification. Automated check Passed
Public evidence summaryNo component on the perimeter matched a published vulnerability at the time of verification.
CheckIdentified server software, frameworks and components on the perimeter are matched against published vulnerability records (CVE/NVD, CISA KEV, vendor advisories).
B · Application and API
B01 AuthenticationAuthentication resists brute-force and enumeration and offers multi-factor protection. Automated and manual check Passed
Public evidence summaryAuthentication resists brute-force and enumeration and offers multi-factor protection.
CheckCredential policy, multi-factor availability, brute-force and credential-stuffing protection, safe handling of failed logins and enumeration.
B02 Session managementSessions are generated, rotated and invalidated correctly. Manual scenario Passed
Public evidence summarySessions are generated, rotated and invalidated correctly.
CheckSession identifier generation, rotation on privilege change, expiry, revocation on logout and concurrent-session handling.
B03 Authorisation and rolesEvery tested function and object enforces the declared role model. Manual scenario Passed
Public evidence summaryEvery tested function and object enforces the declared role model.
CheckRole model enforcement on every function and object: horizontal and vertical privilege escalation, insecure direct object references, mass assignment.
B04 Tenant and data isolationNo cross-tenant data access was found in the tested scenarios. Manual scenario Passed
Public evidence summaryNo cross-tenant data access was found in the tested scenarios.
CheckSeparation of data between organisations or accounts in a multi-tenant product: queries, storage, caches, background jobs and exports.
B05 Input handling and injectionServer-side input handling resisted the injection classes in scope. Automated and manual check Passed
Public evidence summaryServer-side input handling resisted the injection classes in scope.
CheckServer-side injection classes — SQL, NoSQL, command, template, path traversal, server-side request forgery, XML external entities — across the endpoints in scope.
B07 API authentication and object-level authorisationAPI resources enforce authentication and object-level authorisation. Automated and manual check Passed
Public evidence summaryAPI resources enforce authentication and object-level authorisation.
CheckToken handling, key rotation, object- and property-level authorisation on API resources, function-level access control.
B09 Rate limiting and abuse controlsResource-intensive operations are rate-limited. Automated check Passed
Public evidence summaryResource-intensive operations are rate-limited.
CheckLimits on authentication, messaging, export and other resource-intensive operations; protection against automated abuse.
C · Code and supply chain
C01 Dependencies and known CVEsNo dependency in scope carried an unresolved Critical or High vulnerability. SCA / CVE matching Passed
Public evidence summaryNo dependency in scope carried an unresolved Critical or High vulnerability.
CheckSoftware composition analysis of direct and transitive dependencies against published vulnerability records; unmaintained and end-of-life components.
C02 Secrets in code and historyNo live credentials were found in the repositories in scope. Secret scan Passed
Public evidence summaryNo live credentials were found in the repositories in scope.
CheckCredentials, tokens, keys and certificates in the repository tree, commit history, build configuration and container layers.
C03 Static analysis (SAST)Static analysis findings were triaged; none remained at Critical or High. Static analysis (SAST) Passed
Public evidence summaryStatic analysis findings were triaged; none remained at Critical or High.
CheckRule-based analysis of the source for injection, unsafe deserialisation, cryptographic misuse, insecure defaults and dangerous functions, with manual triage of findings.
C04 Software bill of materialsA software bill of materials is maintained and matches the deployed build. Evidence review Confirmed
Public evidence summaryA software bill of materials is maintained and matches the deployed build.
CheckA machine-readable SBOM (CycloneDX or SPDX) exists, matches the deployed build and can be regenerated by the pipeline.
C05 CI/CD securityThe delivery pipeline restricts permissions and protects its secrets. Evidence review Confirmed
Public evidence summaryThe delivery pipeline restricts permissions and protects its secrets.
CheckPipeline permissions, secret handling in jobs, third-party actions and images, artefact signing and separation between build and deploy credentials.
D · Infrastructure
D01 Cloud identity and least privilegeCloud identities follow least privilege with multi-factor protection on administrative access. Evidence review Confirmed
Public evidence summaryCloud identities follow least privilege with multi-factor protection on administrative access.
CheckRoot and administrative accounts, MFA enforcement, role scoping, long-lived keys and cross-account trust in the cloud accounts in scope.
D03 Network segmentation and firewallingData stores are isolated from the public network. Evidence review Confirmed
Public evidence summaryData stores are isolated from the public network.
CheckSecurity groups, network ACLs, private subnets for data stores, bastion access and east-west restrictions.
D06 Logging, monitoring and alertingSecurity events are logged centrally and generate alerts. Evidence review Confirmed
Public evidence summarySecurity events are logged centrally and generate alerts.
CheckSecurity-relevant events are logged centrally with retention, alerting on authentication anomalies and administrative actions, and protected from tampering.
D07 Backup and recoveryBackups exist, are encrypted and a restoration has been tested. Evidence review Confirmed
Public evidence summaryBackups exist, are encrypted and a restoration has been tested.
CheckBackup coverage of production data, encryption of backups, off-site copies, restoration tests and recovery time objectives.
E · Data and processes
E05 Incident responseAn incident response plan exists and has been exercised. Evidence review Confirmed
Public evidence summaryAn incident response plan exists and has been exercised.
CheckA written plan with roles, contacts, severity definitions, customer notification rules and evidence of at least one exercise or real incident review.
Verification history
- Application submitted
- Scope confirmed
- Verification started
- Expert review completed
- Certificate issued
- Monitoring check passed
Verify this record
The registry record behind this page is signed with the CyberSecurityV registry key. Your browser can verify the signature and the fingerprint without contacting anyone but the registry.
Record fingerprint (SHA-256): 725692ee52218fa81ea4f592eb3cf66b7b49643f3df6cb4bdd329297312c85ea
Registry signature (Ed25519): KqihSaybhwsya9oxTLGScPqwP6AVx82Gg6bFALakUfzRiSd/f1Z7EfqJ7OxAbxq3nU7rbtLuC736nVJXsmuwDw==