Security and data boundaries
Authorize every access path and propagate tenant context through content, search and evidence.
Identity and privileges
Configured SSO/federation; MFA/step-up for risk; RBAC/ABAC for role/context. Privileges need scope, expiry, approval and audit; delegated support needs owner authorization.
Channels, storage and keys
TLS/mTLS, at-rest encryption, HSM/KMS and key lifecycle are reference controls. Verify ciphers/configuration, decrypt privileges, rotation/revocation, key backups and secret-free logs per project.
Isolation and operations
Check tenancy/projects in APIs, async jobs, viewers, downloads, snippets and exports. SDLC/releases, dependencies, incidents/DR and observability need test evidence. Architecture alone does not establish blanket security assurance.
Continue the workflow
Two journeys, one records lifecycle
Connect paper and born-digital records through persistent identifiers, policies and evidence.
Read detailsIntegration quickstart
Exercise ingest → job tracking → registration → verification with synthetic data.
Read detailsIntegrity, provenance and evidence
Each evidence type answers a different question; hashes, timestamps and approvals are not interchangeable.
Read detailsStart with a verifiable scope.
Agree record classes, quality criteria, permissions and evidence before scaling.
Plan assessment