04 / Assurance & readiness
The platform has implemented security and integrity controls. Investment supports the independent testing and organisational assurance work required for the defined commercial service.
Technical controls support readiness. Certification requires a scoped information security management system and independent assessment.
Controls relate to Trust Services Criteria themes. A CPA examination must establish the scoped report; operating evidence is needed for a Type II period.
Internal maths and integrity checks prepare the evidence set. An approved test house determines the applicable independent testing outcome.
Control evidence map
A readiness guide, not an auditor-approved crosswalk or a clause-by-clause conformity assessment. Code references identify evaluation material; production operation and organisational effectiveness require separate evidence.
TOTP with RFC test vectors; staff identity, capability checks and tenant ownership tests.
TotpServiceTest.php; TwoFactorAuthTest.php; AdminCapabilityHardeningTest.php
Access policy, joiner/mover/leaver evidence, periodic reviews, privileged access inventory and removal of shared break-glass credentials.
ISO access-control themes · SOC 2 Security
Tenant resolution and scoped queries; cross-tenant ownership and isolation tests.
TenantIsolationTest.php; TenantOwnershipTest.php
Production boundary review, penetration testing and documentation of deliberately shared odds/exposure data. Demo brands may share a demo tenant.
ISO information access · SOC 2 Security / Confidentiality
Named actors and write-audit coverage; no public API route to edit or delete the audit trail.
AuditService.php; AdminWriteAuditCoverageTest.php
Log retention, independent storage, privileged database access controls and evidence of regular review. Application append-only behaviour is not immutable infrastructure.
ISO logging themes · SOC 2 Security
Ledger tests, reconciliation command, financial limit enforcement and settlement checks. Concurrency probes exist for controlled play-money environments.
WalletTest.php; LedgerAuditCommandTest.php; tools/concurrency.mjs
Reconciled production evidence, exception ownership, banking/funds arrangements and operator acceptance testing.
SOC 2 Processing Integrity
Player export, anonymisation and documented retention/refusal conditions exist.
docs/marketing-spec/12-security-trust.md
Legal review of retention, data inventory, processor agreements, privacy impact assessments and evidence of request handling.
ISO privacy themes · SOC 2 Privacy / Confidentiality
Automated PHP and front-end checks; static analysis configuration; smoke, abuse and adversarial probe tools.
backend/tests/; tools/engine-tests.mjs; tools/pentest.mjs
Formal approvals, asset/dependency inventory, vulnerability remediation targets, independent penetration test and retained release evidence.
ISO secure development · SOC 2 Security
Health service, alerting commands, deployment procedures and recovery-related game workflows.
HealthService.php; HealthAlert.php; docs/DEPLOY.md
Prove off-site backups and restoration, define RTO/RPO, exercise incidents and collect operational monitoring evidence for the scoped service.
ISO continuity themes · SOC 2 Availability
The codebase provides a starting evidence set. An engineering build cannot establish an organisation-wide management system.
ISO/IEC 27001:2022; AICPA Trust Services Criteria
Appoint owners; agree scope; risk assessment and treatment; Statement of Applicability; policies; training; supplier reviews; internal audit and management review.
ISO 27001 management system · SOC 2 common criteria
Independent assessment route
Agree company and service boundaries, infrastructure, customer responsibilities, selected Trust Services Criteria and the launch jurisdiction.
Assign control owners, maintain risk and policy records, rehearse incidents and recovery, and collect approval and operational evidence.
Obtain scoped engagements, submit the build, close findings and publish only the actual scope and outcome of independent reports.
Latest local evaluation
Run on 2026-10-07 against the live application database, read-only: the main brand reports 14 outstanding items (10 OK, 5 stub, 2 missing, 7 manual). The command reports outstanding obligations for regulated profiles, including licensing, testing, live providers and security assurance. It exits non-zero while obligations remain.
LAUNCH GATES OPEN2503 backend tests and 185135 assertions passed in the isolated MariaDB 11.8.2 run on 2026-10-07.
Default suite on a real MariaDB 11.8 server in strict SQL mode, with the slow simulation group run and passed separately; actual customer/provider acceptance and a production patch-level match are distinct checks. Internal tests are not certification.
Help take the engine to market
Explore the working engine, meet the team and discuss the investment that advances independent testing and first customer deployments. Bring your questions; we’ll show you the product behind the proposition.