Map
Relate requirements to architecture, identities, data paths, owners, and source evidence.
Trust / Control evidence
Claims should have implementation receipts.
A transparent map of the controls Hyperoru implements today, the boundaries we still track, and the evidence a reviewer can inspect without confusing product behavior with certification.
Control map
Implemented, bounded, and still challengeable.
Each control pairs its intended protection with concrete engineering evidence and a known boundary. Release gates remain visible until they are actually complete.
Select a control
ImplementedRead the public security model
Workspace-scoped access
Application authorization and PostgreSQL row-level policies scope access to the active workspace.
Review evidence
API permission tests, RLS migrations, cross-tenant retrieval and cache tests
Known boundary
Some background workers require broader database visibility to claim jobs. Their queries and session context remain explicit review points.
This is a product control map, not a certification badge. Status describes the repository and deployment contract reviewed on 29 August 2026.
Assessment model
Compliance evidence is not a decorative checkbox.
Hyperoru can organise controls, artifacts, findings, exceptions, and review history. A qualified assessor and the applicable programme still determine certification or attestation.
Verify
Keep the exact artifact, freshness, collector, confidence, and contradiction behind each claim.
Review
Record supported, partial, gap, not applicable, or unknown without turning absence into assurance.
Decide
Preserve reviewer approval, exceptions, compensating controls, expiry, and change history.
Evidence capabilities
Code. Cloud. IaC. CI/CD.
Understand each source's scope and collection boundary. A configured integration does not prove that the required evidence has been observed.
What this source can tell you
Code in your architecture.
- Service boundaries and API routes
- Dependencies and data access
- Code-level controls and exposed secrets
Connect on your terms
GitHub, GitLab, Bitbucket, or a source archive
Evidence is tied to a source revision. Runtime behavior needs its own observations.
Read the integration guideTechnical implementation details, pinned versions, and third-party licenses are documented in the evidence collection reference.
Ask for the evidence behind a control.
Private launch teams can review current controls, accepted risks, data boundaries, deletion behavior, evidence provenance, and the release gates that still remain.