Compliance
Controls
HyperMemory security, privacy, resilience, and AI governance controls
Controls
HyperMemory’s control catalogue summarizes the approved policies, procedures, control designs, and operating safeguards used across the service. It is organized by operational domain so customers can quickly find the controls relevant to their security and compliance review.
Public readiness
Green labels identify the approved policy, procedure, control design, or operating safeguard represented by each entry. Detailed programme administration and controlled records are maintained in HyperMemory’s internal compliance documentation.
Control domains
AI governance and security
Responsible AI use, provider oversight, and AI-specific risk management.
Encryption and key management
Cryptographic protection for data, credentials, and service traffic.
Access control and authentication
Identity, authorization, tenant isolation, and privileged access.
Compliance and assurance
ISMS governance, regulatory mapping, audit, and independent assurance.
Application security
Secure development, testing, review, and application safeguards.
Data protection and privacy
Data lifecycle, rights handling, minimization, retention, and deletion.
Incident response
Detection, triage, containment, communications, and lessons learned.
Business continuity and disaster recovery
Backup, recovery, resilience, and continuity planning.
Network and infrastructure security
Segmentation, network exposure, encrypted transport, and infrastructure baselines.
Vulnerability management
Discovery, prioritization, remediation, and independent testing.
Monitoring and logging
Audit trails, alerting, centralized review, and forensic readiness.
Third-party risk management
Supplier inventory, due diligence, agreements, and ongoing review.
People security
Screening, training, confidentiality, and access lifecycle safeguards.
Physical and environmental security
Facility, equipment, environmental, and inherited datacentre controls.
Endpoint security
Managed devices, endpoint protection, encryption, and remote response.
Change management
Review, testing, approval, deployment, rollback, and emergency changes.
AI governance and security
Controls for responsible AI use, AI supply-chain risk, transparency, and protection of customer information during model-assisted processing.
| Control | Description | Public readiness |
|---|---|---|
| AI system inventory and classification | Maintain an inventory of AI-enabled features, their intended purpose, affected users, system role, risk classification, owners, and applicable regional obligations. | |
| AI provider governance | Approve model and routing providers using security, privacy, retention, residency, contractual, and monitoring criteria. | |
| AI data-use and retention restrictions | Define and enforce what information may be sent for inference, whether providers may retain it, and whether it may be used for model training. | |
| AI transparency and human oversight | Document limitations, material automated processing, review responsibilities, escalation paths, and human override requirements. |
Encryption and key management
Controls protecting service traffic, stored information, secrets, and cryptographic material throughout their lifecycle.
| Control | Description | Public readiness |
|---|---|---|
| Encryption in transit | Use TLS or mTLS for external and internal service traffic, with documented protocol, certificate, and exception requirements. | |
| Secrets and token protection | Generate, store, transmit, rotate, and revoke application secrets and tokens through approved protected mechanisms. | |
| Encryption at rest and in backups | Apply approved encryption to databases, object storage, snapshots, and backups and verify provider and configuration coverage. | |
| Cryptographic lifecycle management | Maintain an algorithm standard, key inventory, ownership, rotation, recovery, revocation, and destruction requirements. |
Access control and authentication
Controls ensuring people and services receive only the access required for authorized work.
| Control | Description | Public readiness |
|---|---|---|
| Tenant and graph isolation | Enforce organization, tenant, and graph boundaries and test that unauthorized cross-boundary access is denied. | |
| Secure authentication | Protect password, OAuth, session, and API-key flows, including recovery, expiry, revocation, and anti-replay safeguards. | |
| Privileged access governance | Inventory privileged roles, require separate administrative identities, strong authentication, approval, monitoring, and periodic review. | |
| Access review and removal | Approve access based on least privilege, review it under the approved procedure, and remove it promptly when responsibilities change. |
Compliance and assurance
Controls for establishing, operating, measuring, and evaluating the compliance programme.
| Control | Description | Public readiness |
|---|---|---|
| Information Security Management System | Define ISMS scope, context, leadership, policies, objectives, risk method, treatment plan, and Statement of Applicability. | |
| ISO/IEC 27001 alignment | Operate the ISO/IEC 27001:2022 management-system requirements and applicable Annex A controls. | |
| SOC 2 alignment | Define the system boundary, map all five Trust Services Categories, and assess control effectiveness. | |
| Internal audit and management review | Perform proportionate documented internal audits, management reviews, nonconformity handling, and corrective-action effectiveness checks. |
Application security
Controls integrating security and privacy requirements into software design, development, review, testing, and release.
| Control | Description | Public readiness |
|---|---|---|
| Secure development lifecycle | Define security requirements, threat modelling, review, testing, release approval, controlled records, and vulnerability response across the lifecycle. | |
| Source-code protection and review | Restrict source access and require protected branches, appropriate review, required checks, and auditable approvals for production changes. | |
| Automated security and quality testing | Run enforced unit, integration, policy, dependency, static, dynamic, and abuse-case tests appropriate to each change. | |
| Secure coding standard | Maintain approved coding, secrets, error-handling, input-validation, dependency, unsafe-code, and remediation requirements. |
Data protection and privacy
Controls governing personal and customer data from collection through use, transfer, retention, deletion, and rights handling.
| Control | Description | Public readiness |
|---|---|---|
| Data inventory and classification | Record data categories, purposes, systems, owners, sensitivity, legal bases, recipients, locations, and retention requirements. | |
| Retention and deletion | Apply approved retention rules, legal holds, customer requests, residual-data testing, backup expiry, and supplier deletion requirements. | |
| Privacy rights operations | Authenticate, track, and fulfil access, correction, deletion, portability, restriction, and objection requests where applicable. | |
| Privacy by design | Assess new features, integrations, regions, and high-risk processing for minimization, transparency, transfers, and required impact assessments. |
Incident response
Controls for preparing for, detecting, evaluating, containing, recovering from, and learning from security and privacy incidents.
| Control | Description | Public readiness |
|---|---|---|
| Incident response plan | Maintain an approved plan with roles, severity criteria, on-call coverage, escalation, forensic handling, legal review, and communications. | |
| Event assessment and escalation | Define when an event becomes an incident and who decides containment, customer notice, regulator notice, and executive escalation. | |
| Security response playbooks | Maintain playbooks for credential theft, isolation failure, exfiltration, ransomware, supplier incidents, and insider events. | |
| Post-incident review | Perform root-cause analysis, record lessons, assign corrective actions, and verify that remediation is effective. |
Business continuity and disaster recovery
Controls maintaining essential security and service capabilities through disruption and restoring systems within approved objectives.
| Control | Description | Public readiness |
|---|---|---|
| Business impact analysis | Identify critical services and dependencies and approve recovery time and recovery point objectives. | |
| Backup protection | Operate encrypted, access-controlled backups for every required data store with retention and integrity monitoring. | |
| Recovery and restoration testing | Test restoration and loss-of-host, store, region, and supplier scenarios; record results and remediate gaps. | |
| Security during disruption | Preserve access control, logging, encryption, change approval, incident response, and privacy obligations during degraded operation. |
Network and infrastructure security
Controls reducing infrastructure exposure and limiting unauthorized or unnecessary network communication.
| Control | Description | Public readiness |
|---|---|---|
| Network segmentation | Separate public, control, data, monitoring, and service-to-service paths and permit only documented required flows. | |
| Restricted service exposure | Apply deny-by-default network rules and restrict administrative and observability services from public access. | |
| Infrastructure configuration baselines | Maintain approved, version-controlled baselines with ownership, drift detection, review, and exception handling. | |
| Egress and network threat monitoring | Restrict outbound destinations where proportionate and detect suspicious traffic, scanning, and policy violations. |
Vulnerability management
Controls identifying, prioritizing, remediating, and independently validating security weaknesses.
| Control | Description | Public readiness |
|---|---|---|
| Continuous vulnerability discovery | Scan application, dependency, container, operating-system, infrastructure-as-code, and web surfaces under the approved security-operations standard. | |
| Risk-based remediation | Apply approved severity-based remediation and exception handling and immediately contain active exploitation. | |
| Security advisories and threat intelligence | Monitor relevant upstream advisories and threat sources and connect actionable findings to tracked remediation. | |
| Penetration testing | Perform authorized testing under approved rules of engagement and track findings through validated closure. |
Monitoring and logging
Controls providing traceability, timely detection, and investigation support for security-relevant activity.
| Control | Description | Public readiness |
|---|---|---|
| Structured audit logging | Record security-relevant events with actor, action, target, time, outcome, correlation context, and appropriate data minimization. | |
| Alerting and operational monitoring | Monitor service health and security signals, validate alert delivery, assign response ownership, and tune detection rules. | |
| Centralized log protection | Centralize required logs, restrict access, protect integrity, synchronize clocks, and apply approved retention and deletion. | |
| Privileged activity monitoring | Log and review changes to administrative roles, sensitive configuration, secrets, production data access, and break-glass use. |
Third-party risk management
Controls governing suppliers and subprocessors before engagement and throughout the relationship.
| Control | Description | Public readiness |
|---|---|---|
| Supplier inventory and tiering | Maintain owners, services, data access, processing locations, dependencies, criticality, and risk tier for each supplier. | |
| Security and privacy due diligence | Assess critical suppliers against security, privacy, resilience, AI, transfer, breach, and assurance requirements before approval. | |
| Supplier contractual controls | Require applicable confidentiality, security, DPA, transfer, breach-notice, subprocessor, deletion, continuity, audit, and exit terms. | |
| Ongoing supplier review | Reassess critical suppliers under the approved procedure and after material service, location, ownership, incident, or subprocessor changes. |
People security
Controls establishing workforce responsibilities and supporting secure behavior throughout the employment and contractor lifecycle.
| Control | Description | Public readiness |
|---|---|---|
| Screening and contractual duties | Apply lawful role-based screening and documented security, privacy, confidentiality, acceptable-use, and incident-reporting obligations. | |
| Security and privacy training | Provide onboarding and role-specific education with completion records and effectiveness measurement. | |
| Joiner, mover, and leaver process | Approve access, adjust it when duties change, revoke it promptly on departure, recover assets, and transfer ownership. | |
| Security-event reporting | Give personnel an accessible reporting channel, define urgent categories, and protect good-faith reporting. |
Physical and environmental security
Controls protecting offices, remote work, equipment, media, and inherited datacentre facilities from physical and environmental threats.
| Control | Description | Public readiness |
|---|---|---|
| Cloud facility assurance | Review provider assurance for datacentre physical access, monitoring, utilities, environmental protection, and resilience. | |
| Office and remote-work safeguards | Define physical access, visitor, clear-screen, secure storage, travel, privacy, and loss-reporting requirements. | |
| Equipment and media protection | Inventory, protect, maintain, transport, sanitize, reuse, and dispose of equipment and media using approved methods. |
Endpoint security
Controls protecting workforce devices that can access HyperMemory systems, source code, credentials, or customer information.
| Control | Description | Public readiness |
|---|---|---|
| Managed endpoint inventory | Record device ownership, assignment, operating system, support status, security posture, and access eligibility. | |
| Endpoint detection and response | Deploy approved endpoint protection with protected configuration, monitoring, alerting, and response procedures. | |
| Device encryption and configuration | Enforce disk encryption, screen lock, least privilege, patching, approved software, and configuration compliance. | |
| Lost-device response | Provide rapid reporting, access revocation, remote lock or wipe, investigation, and incident escalation for missing devices. |
Change management
Controls ensuring application and infrastructure changes are traceable, reviewed, tested, approved, and recoverable.
| Control | Description | Public readiness |
|---|---|---|
| Traceable change records | Link source, infrastructure, configuration, migration, and documentation changes to an owner, purpose, review, tests, and release. | |
| Review and protected branches | Require pull requests, passing CI/security checks, restricted merges, no force-push, and risk-based review for protected production branches. | |
| Pre-production validation and promotion | Test changes outside production and promote approved immutable artifacts using separate credentials and environments. | |
| Rollback and emergency changes | Define rollback criteria, preserve recoverable versions, tightly authorize emergency changes, and complete retrospective review. |
Review and access
The catalogue is reviewed when a control, system boundary, risk, supplier, legal obligation, or material implementation changes. Detailed control administration is maintained in the controlled internal documentation set.