Procurement & trust
Trust center
Engineering controls, readiness mapping, and draft commercial artifacts. This page does not claim SOC 2, ISO 27001, FedRAMP, or DORA certification until an accredited issuer says so. Use the ASR kit to accelerate Infosec, VRM, and Legal review without treating stubs as certificates.
What does the CyberHalluciNet Trust Center include?
The Trust Center packages Architecture Security Review (ASR) and vendor risk materials: CAIQ/SIG-Lite stubs, data-flow diagrams, threat-model summaries, SOC2/ISO mapping templates, Bonterms/DPA drafts, and marketplace private-offer checklists. These are engineering and procurement aids for staging conversations, not third-party attestation.
Is CyberHalluciNet SOC 2 or FedRAMP certified?
No certification claim is made until an accredited issuer says so. Published materials are readiness mapping and engineering controls, not certificates.
Architecture Security Review (ASR) kit
- ASR / VRM index asr-vrm/README.md
- CAIQ / SIG-Lite stub caiq-sig-lite-stub.md
- DFD dfd.md
- Threat model summary threat-model-summary.md
- DPA draft stub dpa-draft-stub.md
- SOC2 / ISO mapping template soc2-iso-mapping-template.md
Contracting
- Bonterms / DPA draft bonterms-dpa-draft.md
- Commercial / OEM COMMERCIAL.md
- License CyberHalluciNet Public Source License
Marketplace private offers
Channel checklist for AWS / Azure / GCP private offers and committed-spend conversations. Completing the checklist does not imply marketplace listing approval.
Private offer checklist · Per-facility price sheet
Product security posture
- Zero-egress sensor default: Ops plane optional sinks only
- Split authority: Sensor policy owns wire bytes; AI broker is schema-bound over UDS
- Telemetry ≠ policy: scores never auto-block without Propose→Approve→Execute
- Supply-chain baseline: govulncheck, SBOM/VEX hooks, OpenSSF track
- Agentic Attack Defense, Phase A advisory controls wired (defaults off); Phase C Enforcement Plane Beta (LocalState + BYO webhook; ADR 0009 Accepted); native vendor EDR/IdP SDKs GA-train only; requires customer workload identity; maturity-train observe pilot; no online entitlement check; attestation add-on for forensic packs. Lab install:
make agentic-lab-install· tutorials install-agentic-phase-a / install-agentic-phase-c-beta. Canonical: docs positioning page. - License §8: released PSL-1.0 versions perpetual for that version; future versions may use different terms with notice