Disclosure

Disclosure

This page sets out what the project claims, the limit of each claim, and the evidence for both.

Entry 1

What the library is

Claim: The library is 360 organization-neutral governance, risk, and compliance documents in Markdown, each carrying its owner, classification, review cadence, and framework mappings.

Limitation: They are templates the adopting organization adapts and approves. Adopting them confers no certification, and legal advice is outside the library.

Evidence: README.md (opens in a new tab) taxonomy.yml (opens in a new tab) The adopter portal (opens in a new tab)

Entry 2

Counts and figures

Claim: Every count on this site is recomputed from the library at build time, and a build whose counts cannot be computed fails.

Limitation: A count describes the inventory. It never describes coverage of any obligation; the library's own gap register records what is not covered.

Evidence: The site generator (opens in a new tab) The generator health check (opens in a new tab) The coverage gap register (opens in a new tab)

Entry 3

Citations

Claim: Hand-written standard editions on the site are checked against the canonical citations register, and corpus citations follow the citation verification specification.

Limitation: External standards change after verification; the register records what was verified and when, not what a publisher released afterwards.

Evidence: The canonical citations register (opens in a new tab) The citation verification specification (opens in a new tab) The standards currency gate (opens in a new tab)

Entry 4

Licence boundary

Claim: The library's original content is under CC BY-SA 4.0, and the site template is under CC0 1.0 with the font and mark exceptions.

Limitation: Vendored third-party material, the quotations NOTICE.md allows, the fonts under the SIL Open Font License 1.1, and the owners' marks keep their own terms.

Evidence: LICENSE (opens in a new tab) NOTICE.md (opens in a new tab) The marks notice (opens in a new tab)

Entry 5

Change control

Claim: Every change to the library passes the automated audit programme's gates, including the pin gate that verifies the copied site-template files byte for byte.

Limitation: A gate checks the mechanical rule it is built to check. Passing the gates does not make an adopting organization compliant or secure.

Evidence: The audit programme specification (opens in a new tab) The audit runner (opens in a new tab) The baseline pin gate (opens in a new tab) The pin (opens in a new tab)

Entry 6

The site's data handling

Claim: This is a static site. Its own scripts are same-origin files that make no network requests and use no cookies.

The light and dark switch is the one script that uses browser storage: when the reader presses the switch, it saves the chosen scheme, the word light or dark, in the browser's local storage under the key "scheme", so later pages open in that scheme. It stores nothing else, and nothing until the switch is pressed.

The search form filters a list already on the page and does not submit the query. As the reader types, the search script writes the query into the page address (?q=), and on All Documents it writes the type and area the reader picks there too (?type=, ?area=), so the query and those choices can appear in the browser history; the script itself never writes the type or area of a chip marked unavailable, though a chip's link opened in a new tab or window carries it, as any link does.

This site's host, Cloudflare, receives that address, query and choices included, when the reader reloads the page and with later requests from the page to this site. Scripts the page runs, including the Cloudflare Web Analytics beacon, can read the page address.

Limitation: The host platform, Cloudflare, serves the pages with these features kept (JavaScript Detections, the Web Analytics beacon, Rocket Loader, and Speed Brain) and sees requests, under the privacy policy linked below.

Evidence: rail.js (opens in a new tab) scheme.js (opens in a new tab) search.js (opens in a new tab) The headers the site sends (opens in a new tab)

Your browser

If you use the light and dark switch, your choice is kept in your browser's local storage under the name scheme, so the site opens in that scheme next time. It is not sent to this site, and nothing is stored until you press the switch.

Security

To report a security vulnerability, see the vulnerability disclosure policy (opens in a new tab). The privacy policy that covers this site and the owner's other sites is at posluns.ca/privacy (opens in a new tab).