Proposed hypothesis
Regulated teams (CMMC, HIPAA, SOC 2)
Mid-size and enterprise teams that need software or AI delivered inside a compliance boundary they will be audited against.
Who we serve here · Proposed hypothesis
Who is involved, and what each person receives at the end.
Mid-size and enterprise teams that need software or AI delivered inside a compliance boundary they will be audited against.
Process owner
Named workflow decision owner
Needs: Define scope, permitted work and acceptance.
Doubt: Responsibility becoming unclear between people.
Proposed deliverables · agreed in scope
- • Proposed acceptance, approval and handover responsibilities as agreed
User
Compliance or programme lead
Needs: Evidence paths designed in, not retrofitted.
Doubt: Certification claims need evidence.
Proposed deliverables · agreed in scope
- • Evidence and audit-trail design
- • A control-to-feature mapping
Approver
CISO / security
Needs: Access control, secrets and logging that pass review.
Doubt: AI features leak data outside the boundary.
Proposed deliverables · agreed in scope
- • Security architecture notes
- • Honest list of what is not yet cleared
Buyer
Procurement
Needs: Clear contracts, named team, continuity.
Doubt: A small firm is a continuity risk.
Proposed deliverables · agreed in scope
- • Proposed accountable lead and agreed continuity arrangements
- • Agreed-scope phase contracts
Affected
Auditors and end users
Needs: Records that prove what happened.
Doubt: Logs that cannot be trusted.
Proposed deliverables · agreed in scope
- • Purpose-limited evidence design
- • Redacted export requirements for review
Responsibilities, not a promised roster: economic buyer, process owner, user, technical approver and operator may overlap. Explore the Finance illustrative example →·MSP illustrative example →.
Our promise
We design access control, evidence and AI authority limits into the system and state plainly what it is not yet cleared to do.
Holds when
- • Your control framework is shared with us
- • A security reviewer is available each phase
Limits — what we don't promise
- • We do not certify you; your assessor does
- • We do not claim a framework certification we do not hold
- • Applicable requirements and assurance must be reviewed for each scope
Before
Compliance is a spreadsheet and a yearly scramble; AI is blocked because nobody can prove its boundaries.
After
Systems where access, evidence and AI authority limits are designed in and documented.
What it takes from you
Access to your control framework, security reviewers and existing evidence.
Constraints we respect
We work inside your boundary and your assessor's interpretation.
The experience
From first conversation to handover.
01
Scoping brief
Framework, boundary, systems and deadline.
02
Architecture session
Written position on one decision.
Scoped quote
03
Build and run
Agreed-scope phases with evidence per release.
Scoped quote
Evidence, labelled honestly
- Regulated workflow examples are proposed; no accepted client delivery evidence is published hereProposed
- Portfolio ownership and permitted case-study evidence require confirmationUnknown
- DeftSpan makes no certification claim hereUnknown
Context = portfolio direction, not operational acceptance · Proposed = our method, not yet proven for this audience · Unknown = we won't claim it yet.
Access we ask for — and how you take it back
- • Least-privilege accounts inside your environment
- • No data leaves your boundary without written approval
Agree exact access grants and their review evidence before each phase.
Initial inquiry: non-sensitive summary only. Later assessment: authorised redacted samples or read-only access. Sandbox and production write access require separate approval, minimisation, access expiry and retention agreement.
Agree access expiry, removal, retained evidence and confirmation responsibilities for each phase.
Something useful to pass along
A control-to-feature map your assessor can review.
Useful to: Assessors, auditors and internal risk committees.. Shared only if you choose to.
Why you'd come back: Each new feature inherits the same evidence model.
What we watch for harm: Open audit findings attributed to the system.
Not a fit: Requests to bypass or soften a control · Classified work requiring clearances we do not hold
Next step
Tell us which of these people you are.
Request an assessment of fit and proposed next steps; timing, scope and follow-up require confirmation.