Trust, people, and policies that read themselves

A public Trust Center, a register of the people behind every account, and an import that suggests the controls a policy covers.

TrustIdentitiesPolicies

Three weeks in one entry, because three things landed that are easier to explain together than apart.

The Trust Center. Every organization gets a public page at its own address, built from what is already in Cyberwiz: the frameworks you run, the documents you are willing to share, and the posture behind them. A stranger asks for what they need, the request lands in an inbox, and you grant or refuse it under the access rules you set. The public page reads a rendered copy rather than your data, so nothing reaches it that you did not put there.

People. Compliance keeps asking who, and the answer used to live in whichever system you happened to check. The identity register answers it once: a row per person, the accounts behind them in every connected source, and the orphans that belong to nobody. A sync shows what it is about to write before it writes it. People can be grouped, and a policy aimed at a group instead of at everyone.

Policies that read themselves. Importing a policy used to mean uploading a document and then mapping it to controls by hand. The import now reads the document, suggests the controls it covers, and quotes the sentence behind each suggestion, so a claim you accept is a claim you checked. Publishing the policy asks the people in scope to sign it.

Trust Center
  • A document replaces in place, so a renewed report keeps its row and its link.
  • The access inbox opens on everything, newest first, and filters on several states at once.
  • An accent colour picker, so the portal reads as yours rather than ours.
  • Open the portal from the access-granted menu, to see what you just handed over.
  • The portal is laid out like the trust page on our own site, and asks for access in a dialog rather than on a page of its own.
Compliance and evidence
  • A Program's scope is a settings page. One tab per population, each picking from the same table as the rest of the product, with a single save across all of them. A population can be set to None, which is not the same as leaving it empty.
  • A Program assesses a set of Targets, and can change that set after adoption. The whole organization is one of the things it can assess.
  • Add evidence in a sheet that stages first. Pick the files, see what each one is thought to prove, link what already exists in the library, then commit the lot.
  • The evidence library is one tab away from every upload button, so reusing a document no longer starts on another page.
  • A Target's evidence tab links in bulk, keeps a Linked view, and says which programs inherit the organization-wide library.
  • Evidence type suggestions are scoped to the control you uploaded from, not to the whole catalog.
  • Required or optional is authored, not inferred. A validation's gate is set on the common control and overridden per framework control, instead of being read off severity.
  • Cyberwiz is an evidence source for its own controls. The registers you already keep here answer the controls that ask for them, with nothing to upload.
  • An unsure AI verdict asks for a review rather than failing the control. It stays out of the readiness percentage and holds the control back from passing until someone looks.
  • Integration evidence keeps itself current instead of ageing between syncs.
  • Export a framework's controls with their requirements, guidance and evidence examples.
  • Frameworks split into a table and a browsable catalog, and the catalog can ask us for a framework it does not have.
  • A common control opens as a drawer, and a framework control's drawer lists the policies that cover it.
  • The compliance overview fills three rows and sizes its widgets to the space it has.
Policies
  • Import a policy from a document already uploaded as evidence, and land on the policy rather than back in the list.
  • An upload recognised as a policy offers to join the register, one row or a whole bulk upload at a time, with a single Confirm all for the suggestions behind it.
  • A coverage run suggests up to 60 controls, each with a confidence and the quote it read.
  • A policy's scope carries onto the evidence it mints.
  • The template catalog was rebuilt on the Bindsec documents.
  • Export from the toolbar, and aim a new policy at a group without opening it first.
  • An open draft saves itself again, and leaving with unsaved words asks first.
  • The register pages, sorts and totals on the server, so a large register opens like a small one.
Vendors and assets
  • Add a vendor from a catalog of known providers, instead of describing one from scratch.
  • Create a system straight from a vendor row.
  • Findings carry an audit trail, and a risk change asks for a reason.
  • Asset filters pick from what exists, and survive a reload.
Across the app
  • Agent opens on what you can ask from where you are, and renders its own markdown.
  • Integrations show a validation count per connection, expandable to the list, with one status colour across every surface and errors that say why.
  • A second dark palette, dark classic.
  • Tasks gained an add button where the next card would go.
  • cyberwiz.ai was rebuilt around a single resources shelf, a page per framework, a demo page the calls to action point at, and this changelog.
Fixes
  • A dropped folder gives one evidence per file, rather than one for the folder.
  • A coverage suggestion must quote the policy sentence behind it, so a claim with nothing under it cannot pass.
  • A cancelled policy import leaves nothing behind, and says so when it had already become a draft.
  • An imported DOCX or PDF reads its section titles as headings, not its page markers.
  • Evidence tables sort and page again, and the evidence filters say what they filter.
  • Cancelling a single upload leaves it in the Inbox instead of dropping it.
  • Selecting text no longer swipes a side drawer shut, and a drawer slides out however it was closed.
  • An owner contact with no email stops blocking scheduling.
  • A bare stored website stops blocking every vendor edit.
  • A failing GitHub App reports its own error, rather than a 403 from an unrelated call.
  • File sizes read left to right in Hebrew, and the Hebrew itself was reviewed rather than counted.
  • The questionnaire builder survives dark mode.