AES-256 at rest
Stored data encrypted with AES-256; key custody and rotation duties stated in the operations note.
- Storage encrypted
- Named key duties
Capability · Security & localised IT
Compliance is accepted through a topology, a permission matrix and a report
Security work has to leave behind things a reviewer can re-check: a deployment topology with its encryption chain, a permission matrix that goes down to field level, and an assessment or compatibility report whose conclusion is issued by a qualified third party. Those three sit on our deliverable list. The applicable compatibility scope follows your locality and supervisory authority.
Position
We answer for what produces evidence; the conclusion belongs to the assessor
Data security in these engagements has two layers. The technical layer is encryption at rest, encryption in transit and where the permission boundary falls. The organisational layer is who may see, who may change, and what remains when they do. Both must yield something presentable — a topology, an encryption-chain note, a permission matrix, an operation log — rather than an unfalsifiable claim of being secure.
The compatibility layer works the same way. Xinchuang qualification and localised-environment adaptation is engineering scope: runtime, dependencies and deployment pattern are verified item by item against your locality and supervisory authority. The applicable list follows that requirement; we do not enumerate chip or operating-system models absent from published scope, and we do not decide compliance on behalf of a regulator.
Company qualifications on public record
CMMI Level 3ISO 9001High-tech EnterpriseXinchuang (localised IT) readyAAA credit rating
Six steps, and the first two decide whether acceptance is possible
Hardening before the applicable requirement is confirmed usually spends the budget outside the regulator’s field of view.
Confirm the applicable requirement
Collect the filing and IT-management rules that bind your institution, existing policy and past remediation items, then state what each one constrains in this delivery. Output: requirement list with responsibility split across you, us and the assessment body.
Design topology and encryption chain
The hosting mode sets the boundary. Data is encrypted at rest with AES-256 and in transit over TLS 1.3; key and certificate duties are written into the operations note. Output: topology and encryption-chain description.
Build the three-tier permission matrix
Function level decides which module, row level which entities and funds, field level whether valuation, cost and LP contact data can be read or written. Output: role-to-permission matrix aligned with dictionary owners.
Configure behaviour evidence and alerts
Desktop behaviour control records sensitive operations and attempted egress. Rules and visibility are set by the client; records export for internal review.
Verify adaptation and support the assessment
Deploy, regress and measure performance in the nominated environment. During assessment we supply evidence, run demonstrations and take interviews; the conclusion is the assessor’s.
Close remediation and archive the report
Each finding gets an owner and a deadline, is remediated and re-tested, then archived with the compatibility report as next year’s baseline.
Artefacts, duration, acceptance
3–8 weeks is the standard range from agreement of the work-breakdown structure. Third-party assessment scheduling sits with the assessor: it is neither inside our range nor replaced by our work.
| Artefact | Typical duration | Acceptance method |
|---|---|---|
| Applicable requirement list | Within 3–8 weeks | Client compliance owner confirms scope line by line |
| Topology and encryption-chain note | Within 3–8 weeks | At-rest and in-transit settings verified on site |
| Permission matrix (function, row, field) | Within 3–8 weeks | Role sampling; escalation cases must fail and be kept |
| Behaviour evidence and alert configuration | Within 3–8 weeks | Sampled replay of operation chains, exportable |
| Localised-environment verification record | Within 3–8 weeks | Deployment and regression completed in the nominated environment |
| Assessment materials and remediation report | After assessment | Findings closed item by item; conclusion rests with the third party |
Boundaries
What we do, and what we refuse to do
We deliver software and engineering support: topology, encryption settings, permission model, evidence capture, adaptation verification and remediation. Certification conclusions, filings and compliance determinations come from supervisory authorities and qualified third parties. We also do not provide asset management, fundraising or investment advice, which are licensed activities.
- No compliance determinations
- No answering the regulator for you
- Reports are the exit point
Technical base
Six controls you can open on screen
Each maps to a configuration location, so acceptance is a walk-through rather than a reading of documents.
TLS 1.3 in transit
External and internal service hops run TLS 1.3, with ports and certificates listed in the topology.
- Version stated
- Certificates checkable
Three-tier permissions
Function, row and field layers; valuation, cost and LP contact fields carry separate read-write rights.
- Role-to-field map
- Escalation testable
Behaviour evidence
Sensitive-operation monitoring produces a replayable compliance record, kept separate from effort capture.
- Chain replay
- Client-set rules
Encrypted disclosure delivery
The fundraising and LP reporting document service permissions by disclosure audience instead of circulating attachments by mail.
- Per-audience rights
- Delivery logged
Localised-environment adaptation
Backed by Xinchuang qualification: deployment, regression and performance verified in the environment you nominate, with the scope following your authority’s requirement.
- Verified in place
- Record issued
Environment layers covered by verification
Layers, not brand models: chip, operating-system and database combinations absent from published scope are not listed. The applicable set is confirmed item by item against your locality and supervisory authority.
Server and chip architectureOperating systemDatabaseMiddleware and runtimeBrowser and endpoint environmentNetwork boundary and egress policyKey and certificate managementLog and evidence storage
Hosting modes
Who holds which duty in cloud, private cloud and intranet
In public cloud, boundary and key duties split between client and vendor per the operations note. In private cloud the client operates and we hold the configuration baseline and remediation. On an isolated intranet, data has no outbound path, every action is logged, and verification and assessment happen inside your environment. All three run the same permission and encryption baseline; the intranet edition does not lose functions.
- One encryption baseline
- No egress on intranet
- Duties written down
Who reads it
One record answers three separate challenges
A supervisory authority asks about the filing chain and its timestamps; an auditor asks about field permissions and formula versions; an internal review asks whether a sensitive operation replays. The emphasis moves with the type of capital: SOE platforms weight filing and egress, quasi-financial work weights operation and authorisation.
- Filing chain replayable
- Permission versions traceable
- Evidence exportable
Published method
Where vendor and assessor stop, in print
A vendor cannot certify itself, conclusions belong to the assessor, and field-level control has an operational payoff — these arguments are published, so they can be quoted in tender preparation rather than taken on trust.
Read the articleWho should not buy this
Anyone who needs us to guarantee a pass or a particular conclusion: those are issued by qualified assessors and supervisory authorities, and we commit only to materials, demonstrations and closed remediation. Institutions that want to outsource accountability also do not fit — field ownership, alert adjudication and filing actions have to sit on your posts.
Security and localised-IT questions
Answers match our delivery boundaries and can be used in internal and tender preparation.
Does the platform run on a localised (Xinchuang) stack?
The company holds Xinchuang qualification and localised-environment adaptation capability; verification runs in the environment your institution nominates. The applicable compatibility list follows your locality and supervisory authority, and we do not publish model combinations we have not verified.
What does field-level permission buy in practice?
Within one post-investment dataset, valuation and cost fields can stay with risk and finance while deal staff see progress and indicators, and LP contact details sit behind a separate boundary. Field control expresses those differences in configuration instead of asking someone to maintain a redacted copy.
How are updates handled on an intranet?
Versions and changes are applied inside your maintenance window and logged within your audit perimeter. Any assistance runs only where your network policy allows and stays reviewable end to end. The split is recorded in the topology and operations note and checked at acceptance.
Is desktop behaviour control employee surveillance?
It targets sensitive operations and attempted egress for compliance evidence. Collection scope, alert rules and visibility are set by you, and the module can be disabled independently; effort capture is a separate module.
Can you supply the security certification itself?
No. An accredited assessor performs the test and issues the conclusion. We provide evidence, run demonstrations and close findings with owners and deadlines. Any offer to be judged compliant by the vendor does not survive a review.
Does encryption slow a filing peak?
Encryption acts at the storage and transport layers, not on query paths. Performance is measured in the nominated environment during adaptation, and the outcome is written into the verification record rather than asserted.
Next step
Bring the rules that bind you and we will map them to artefacts
We read your requirement list against our topology, permission matrix and evidence mechanisms, and separate what a third party must assess from what we close inside the 3–8 week range.