Assurance
Regulatory and assurance by design.
Oversight obligations are difficult to satisfy retrospectively. CipherQuay is designed so that the controls an organisation must demonstrate are produced by the operating record itself.
CipherQuay is designed to help organisations operationalise, monitor, and evidence relevant machine-authority controls. Alignment support is not legal advice, certification, or a guarantee of compliance. CipherQuay is not certified, independently audited, SOC 2 compliant, ISO certified, or EU AI Act compliant, and use of CipherQuay does not make any organisation compliant.
Control themes
What the operating record is designed to support.
Framework mapping
Referenced carefully, claimed conservatively.
The following describes design intent. It is not a statement of certification, audit outcome or compliance.
EU AI Act
Supports operationalising organisational accountability, risk management, human oversight, transparency, logging and traceability, technical documentation and post-deployment monitoring practices relevant to obligated organisations.
NIST AI Risk Management Framework
Supports govern, map, measure and manage activities for delegated machine authority, and follows emerging work on AI-agent identity and authorisation.
ISO/IEC 27001
Supports access control, logging and monitoring, supplier relationships, and incident-management control evidence where machine actors are in scope.
ISO/IEC 42001
Supports AI management-system practices: roles and responsibilities, impact consideration, operational controls and continual improvement.
SOC 2 readiness
Supports the production of control evidence relevant to security, availability, processing integrity and confidentiality criteria.
National, sectoral and regional obligations
Supports jurisdiction-aware policy so that authority can differ by region, entity, data category and environment.
Jurisdiction
Authority should differ by jurisdiction.
A machine action that is acceptable in one entity, region or data category may be unacceptable in another. Mandates and policy are designed to be jurisdiction-aware, so that permitted purpose, data handling, approval requirements and evidence retention can vary by context rather than being set globally.
Roadmap
Independent assessment roadmap.
An honest statement of where assurance work stands. No external certification is claimed or marked as achieved.
States are updated as work completes. Nothing on this page should be read as an independent attestation.
Threat and failure model
Designed around realistic failure, not worst-case theatre.
Model obedience, prompts and alignment measures are valuable safety properties, but they cannot be treated as independent enforcement boundaries. Enforcement must sit outside the system being constrained.
CipherQuay is designed to record authority decisions rather than to accumulate business content. The intent is to retain what is required to demonstrate that an action was authorised, decided and bounded — not to duplicate the underlying data an agent processes.
Evidence scope, retention periods and redaction expectations are configurable, and data-category restrictions can be written into mandates.
Deployment options are discussed at a high level during private preview and confirmed in writing. Considerations include data residency, separation between control plane and enforcement points, retention of evidence within customer boundaries, and operational continuity requirements.
Specific architectural detail is shared under engagement, not published here.
A formal responsible-disclosure policy and security contact route are being established ahead of general availability.
Placeholder: security reporting channel to be published. Until then, please use the enquiry form and mark the message as a security report.
No certification, audit outcome or regulatory compliance is claimed. No customer deployments, metrics, partners or testimonials are presented. Interface material on this site is illustrative.
CipherQuay reduces and evidences machine-authority risk; it does not eliminate it.
Next step
Understand the authority your machines already hold.
The Machine Authority Exposure Assessment is a read-only engagement that establishes what your agents can do today, who sponsors them, and what evidence exists if something goes wrong.