Security Posture
Every kind states which technical controls it enforces, with evidence, and how those controls serve the frameworks your reviewers ask about. Nothing is called compliant, because nothing should be.
For the security reviewer who will read every word here looking for the one that over-claims.
What You Get
Shipped behavior, stated as it works today. The record beside it is the shape of what the product stamps; its figures are examples.
Seventeen Controls, Six Categories
The platform has one vocabulary of technical controls: data protection, network exposure, identity and access, observability, resilience, and change safety. Every claim a kind makes cites one of them.
Evidence, Per Kind
Every covered kind states which of a fixed list of 17 technical controls it enforces, with evidence for each claim.
Four Framework Crosswalks
The HIPAA Security Rule, SOC 2 Trust Services Criteria, FedRAMP Moderate, and the CIS AWS Foundations Benchmark are mapped onto the control vocabulary, requirement by requirement, quoted from the published source.
Computed, Never Stored
A kind’s framework posture is computed when you look at it, from its controls and the crosswalks. No verdict is ever stored on a kind.
Least-Privilege Runners
The deploy runs under an identity built from the kind’s own permissions file: exactly the actions that kind needs to create and manage itself, and nothing else.
Control profile · S3 bucket
encryption at rest
enforced · every new object is encrypted at rest by default; an unencrypted object is not representable
customer-managed keys
exposed · set encryption.kms_key_id
encryption in transit
enforced · TLS on every request
no public exposure
enforced · public access blocked at the bucket
HIPAA 164.312(a)(2)(iv)
served by encryption at rest, customer-managed keys
SOC 2 CC6.1
served by no public exposure, role-based access control
verdict
none
An illustration of the record the product shows. Two crosswalk rows are shown; evidence is quoted from the kind’s profile. There is no verdict that says compliant, because a kind enforces controls and is never called compliant.
What We Will Not Say
The words this page holds itself to, so a reviewer does not have to find the over-claim.
- Posture never becomes “compliant.” The correct sentence is: this kind enforces these controls, which serve these requirements. SOC 2 reports on an organization’s controls, not a product’s; HIPAA compliance is a property of an entity’s program.
- “FedRAMP authorized” is never said of any kind, chart, or deployment. The crosswalk is evidence an assessment consumes.
- Requirements only organizational process can serve (incident response, physical security, personnel screening) are left out of the crosswalks on purpose, and the page says which ones rather than blurring them.
- A kind without a control profile is honestly uncovered, and every surface says so.
Read Next
Your Cloud, Your Keys
Planton runs in your account with your keys, your state, and your bill. Keyless connections store nothing; every module is open source; you can leave with your manifests.
What It Proves →The Record
Every infrastructure change is one Infra Job, kept and queryable with its configuration, cost fact, verdicts, approvals, and the snapshot of what exists afterward.
What It Proves →