Where will information reside?
Confirm regions, subprocessors, source systems and any requested residency commitments for the selected product.
01BOUNDARIES AND SYSTEMS
Understand the system.
Then assess the data.
Information assurance must reflect the actual system. This page describes published corporate-site architecture; product-specific data handling is a separate review.
01CORPORATE WEBSITE
The public site
and its boundaries.
PUBLICVisitor browserHTML, CSS, images
COMPANY GCPCloud Run websiteApproved public pages
GATED / DISABLEDInquiry deliveryValidation → provider → mailbox
Illustrative architecture, not a network audit. The deployed service uses a project-scoped Cloud Run revision. Domain DNS and independently approved controls require their own verification.
02DATA INVENTORY
Know what is stated.
Know what is open.
| Area | Currently described | Additional evaluation |
|---|---|---|
| Hosting | Company-specific Cloud Run service and containerized website. | Data location, underlying provider configuration, contract scope. |
| Website measurement | Aggregate HTTP request totals reported privately without visitor tracking scripts. | Cloud logs, retention and administrative access policy. |
| Inquiry form | Disabled while privacy notice or operational prerequisites remain unapproved; no website inquiry database. | Verified mailbox, email provider, retention, consent and complaint process. |
| Product data | This website makes no claim about actual Academra or Acceredra tenant data environments. | Product-specific data model, hosting, access control, integrations, deletion and audit evidence. |
03QUESTIONS TO RESOLVE
Evidence should follow
the intended deployment.
Who is allowed access?
Review identity roles, administrative access, audit evidence and separation between relevant tenants or organizational units.
How long is information kept?
Confirm backups, log retention, exports, deletion and recovery responsibilities as they actually exist.
Where is AI processing involved?
Identify actual models, prompts, permitted context, human approval paths and external provider terms, if applicable.