IDSENTRASecurity evidence
Know what each security statement actually means.
Review product foundations separately from deployment-specific validation, framework alignment and independent assurance.
Evidence status model
Four statuses. No blurred claims.
Use the status that accurately describes the evidence.
Implemented foundation
Present in the product or operating architecture.
Deployment validation
Depends on the selected customer environment.
Framework alignment
Organized against recognized guidance where applicable; not certification.
Independent assurance
Represented only when formally completed and awarded.
Implemented foundations
Start with controls that can be examined in the product architecture.
The selected deployment can add further evidence requirements.
- Authentication & access
- Server-side sessions, role-based permissions, passkeys, TOTP and controlled recovery are part of the security model.
- Organization boundaries
- Operational data remains scoped to authorized customer environments.
- Credential handling
- Protected integration credentials and service secrets stay outside public surfaces.
- Auditability
- Relevant decisions and privileged changes can retain actor, time, source and disposition context.
- Public data boundary
- The public website accepts business evaluation information rather than protected operational records.
- Human review
- Ambiguous and consequential results remain available for authorized human review.
From evidence to launch
Turn the evidence map into deployment acceptance criteria.
Security review becomes operational when the selected environment, integrations, roles, resilience plan and acceptance scenarios are validated.