Controlled Scope
Each approved OI environment is bounded by defined use, participants, data classifications, systems, authority, and permitted activity.
Security, Governance & Control
Security and governed execution for enterprise OI
VEQSA applies scoped access, minimum-necessary data practices, role-aware authority, environment controls, and evidence-integrity mechanisms to its current controlled OI engagements.
Current public security information primarily describes the controlled-evaluation boundary. Broader production or licensed operating arrangements require separate technical review, security scoping, operating responsibilities, and applicable agreements.
Security principles
Principles that govern approved OI environments
These principles apply across approved OI environments; the current public boundary is controlled evaluation.
Minimum Necessary Data
Synthetic, masked, reduced-risk, or otherwise minimized data is preferred whenever it can answer the evaluation question.
Organization- and Project-Scoped Access
Access is governed by assigned roles, current authorization, and approved organization and project boundaries.
Evidence Integrity
Available signed evidence and applicable reports can be checked for integrity within the supported evaluation scope. A stored record is not automatically signed or verified. Integrity verification does not establish decision quality or business value.
Governed Execution
Workspace access does not itself authorize OI execution. Execution requires applicable scope, authority, configuration, and environment state.
Controls are applied according to the approved scope of each evaluation rather than asserted as universal guarantees.
Current controlled-evaluation boundary
Current controlled-evaluation boundary
Current controlled-evaluation access does not grant production operating rights, unrestricted autonomous authority, or an enterprise production license.
Deployment boundaries
Deployment aligned with enterprise requirements
Subject to Technical Scoping
Controlled Evaluation Environment
Evaluation execution requires an approved scope and an activated, appropriately configured environment.
Subject to Technical Scoping
Private or Isolated Deployment Assessment
Private or isolated deployment requirements are assessed separately for technical feasibility, security requirements, and operating responsibilities.
Deployment arrangements are engagement-specific. Not every deployment pattern is available for every evaluation.
Data handling
Data boundaries are defined before access begins
- 01
Classify
Identify the minimum data required and determine whether regulated or sensitive data is involved.
- 02
Approve
Document permitted data classes, users, systems, regions, integrations, and handling conditions.
- 03
Protect
Apply the approved access, storage, transmission, logging, and environment controls.
- 04
Retain and Preserve
Retention and evidence-preservation requirements are defined by data category, agreed purpose, and the applicable agreements.
- 05
Return or Delete Eligible Data
Return, retention, archival, and deletion requirements are defined by data category and agreement. Eligible operational copies may be deleted only after applicable preservation, retention, and legal-hold requirements are satisfied.
Closing an evaluation or engagement does not automatically authorize deletion of evidence, records, or other materials subject to retention, preservation, contractual, or legal requirements.
Do not submit credentials, private keys, or confidential technical materials through public inquiry forms.
Access and governance
Access follows approved roles and authority
Authorized Users
Access remains subject to current authorization and approved scope.
Role-Based Permissions
Permissions are aligned with each participant's evaluation responsibilities.
Administrative Review
Administrative access is itself permission-controlled and may be reviewed within the approved scope.
Change Control
Changes requiring approval follow the applicable governance process. Workspace access does not automatically authorize OI execution.
Incident and vulnerability handling
Disciplined response within the applicable agreement
Request security-review information through VEQSA's contact channel. Evaluation-specific escalation contacts and notification arrangements are established before activation through the applicable agreements.
Do not include credentials, sensitive data, or confidential vulnerability details in a public inquiry.
General security inquiries
Use the VEQSA contact channelEvaluation escalation
Evaluation-specific escalation contacts and contract-defined notification requirements are established in the applicable signed agreements and approved scope.
Shared responsibility
A clear division of responsibilities
For current controlled evaluations, responsibilities are established through the applicable agreements and approved scope. Production or licensed operating responsibility will be defined separately.
VEQSA responsibilities
- Operate the approved VEQSA evaluation boundary
- Enforce approved service-side access controls
- Protect VEQSA technology and retained evaluation materials
- Support evidence and verification capabilities within scope
- Coordinate evaluation security issues
Partner responsibilities
- Provide authorized and lawfully obtained data
- Protect partner-controlled identities, devices, and credentials
- Define permitted users and business authority
- Maintain partner-side cloud, endpoint, and network controls
- Prevent evaluation outputs from being used outside the signed scope
Security documentation
Security review through controlled disclosure
Prospective evaluation partners may request relevant security, privacy, deployment, and data-handling information. Disclosure is separately authorized and limited to the needs of the engagement. Confidentiality arrangements do not automatically grant access to protected implementation materials.