What is in place, and what is not.

Keystone is not a shared service that every customer logs in to. Each organisation has its own installation and its own databases. Another organisation's data is not a permission check away from yours, because it is not there.

Each Keystone product is its own application with its own database and credentials, and products do not read each other's data. This separation is built and tested in our pipeline. It has not yet been proved on a production installation.

Keystone uses the security mechanisms of its framework and platform as they are designed to be used. We do not invent our own schemes, and we remove a feature rather than build one.

One rule sits under every list, count, search and action in KeystoneIT. A figure on the dashboard never includes a request the person looking could not open.

If KeystoneIT cannot confirm a person's access with Keystone Platform, it shows a warning, then withholds figures, then stops agent work. It does not carry on with what was true earlier.

Permissions are granted for a school or for the Trust centrally. What an agent sees also depends on the teams they belong to, and an agent's own request is only ever shown to them as a requester.

Keystone has no passwords of its own. Sign-in through a Trust's Microsoft Entra ID is built and tested against recorded responses. It has not yet been proven against a live tenant.

Your data is held in your own installation, in PostgreSQL databases that belong to it. Keystone does not stop working because maintenance is not renewed, and the data stays where it is.

The intent is that a Keystone installation sends nothing to Alresford unless you turn that on. This is a design position for the first release, not yet a shipped setting.

Every change writes an audit record of who did what, where and with what result, and the database refuses to edit or delete those records. There is no screen to view or export the audit record yet.

Recovery to a point in time is part of the design and is rehearsed on test data in our pipeline on every change. The tooling you would use in production is not built yet, and recovery objectives are not set.

Releases will be signed, and an installation will check the signature before it updates. No release has been published yet.

The licence is intended to include source-code continuity rights. The terms are being written; nothing here is a legal promise.

Every change must pass static analysis, security scanning for known weaknesses and leaked secrets, dependency advisories, the automated test suites, browser journeys with accessibility checks, and a recovery rehearsal.

Each stage is reviewed by someone other than its author before it is accepted. This is an internal engineering control. It is not an external audit, a penetration test or a certification. The current KeystoneIT evaluation build has not been accepted.

No external penetration test has been carried out. One is planned before any internet-facing installation holds real personal data.

KeystoneIT is built to WCAG 2.2 AA and checked automatically on every page. A manual screen-reader test has not yet been carried out, and we do not publish a conformance claim until it has.