Disclosure

Disclosure

This page sets out what the project claims, the limit of each claim, and the evidence for both. For each thing the project does, the claim and its limitation stand side by side, each pointing to the page that supports it.

Entry 1

What the prompts produce

Claim: The planning prompt asks you the intake questions, reads the project and the references it triggers, and produces a 16-section assessment plan. The audit prompt executes that plan. It reports each applicable item with exactly 1 of 5 status labels (DEMONSTRATED, REASONED, GAP, UNTESTED, NOT APPLICABLE) and the evidence or the stated reason behind it.

Limitation: You run both prompts yourself, with your own AI assistant, against your own project. The result depends on that assistant, on what it could fetch, and on the authorizations you give it. A reference it cannot fetch leaves the items that depend on it UNTESTED. This site runs no assessment and sees none of its results.

Evidence: The planning prompt The audit prompt The 5 status labels The 2 prompts and their stop points

Entry 2

The references

Claim: The prompts select from 28 openly published sources. The register records each one's source, the licence as read from it, its trigger, and its verification date, and the assistant fetches each from its own repository at run time.

Limitation: This site reproduces no text from any source; the descriptions are this site's words, and each source's own licence governs its use. A verification date ages: an entry older than 180 days is marked for re-verification on the register page. The 1 exception to open publication is the CSA Cloud Controls Matrix and AI Controls Matrix. You supply those under CSA's terms when you opt in; the assistant never fetches them.

Evidence: The reference register Source handling The CSA matrices

Entry 3

Prior assessments you supply

Claim: A penetration test report, a SOC 2 report, an ISO/IEC 27001 certificate, a PCI DSS attestation, a privacy impact assessment, or an internal audit report is accepted as input, registered with its scope, period, and provenance (third-party attested or self-reported), and weighed accordingly.

Limitation: A supplied document supports a REASONED or a GAP status only, never DEMONSTRATED, and never substitutes for a check the audit runs itself. A scope or period mismatch is recorded, and a conflict between a document and observation is reported as a finding. Supplied documents are confidential input: they are referenced by title and section, and their contents are not reproduced.

Evidence: Supplied documents and provenance Principle 8: prior assurance is input, never proof

Entry 4

What the report is

Claim: The report states, per requirement and per item of evidence, what was demonstrated, what was reasoned, what is a gap, what was untested, and what did not apply, with severity and the rationale for it, and with likelihood and impact stated with assumptions and confidence. Remediation happens only on named approval and is re-verified with the same labels.

Limitation: An assessment made with these prompts is no audit service, certification, or attestation, and nothing here makes a project compliant, secure, or complete: the report never characterizes the target as a whole as compliant, certified, secure, or complete. Where you name external recipients, a distribution version removes confidential content and keeps the scope, status labels, severity rationale, and limitations in full.

Evidence: Principle 6: no compliance claims Severity and risk The report and its recipients

Entry 5

What this site collects and runs

Claim: The pages load this site's stylesheet, fonts and images, and 2 small scripts from the shared site template: one powers the copy buttons on the prompt pages, and one marks your place in the page contents on the longer pages. They set no cookies. The site stores no project data, accepts no uploads, and runs no code of yours.

Limitation: Cloudflare, which serves the site, adds its own scripts to every page for the features the owner has switched on in its zone: its bot detection, Rocket Loader, Speed Brain, and its Web Analytics beacon, which counts visits without cookies so that the maintainer can see how many people use the site. The site's Content-Security-Policy allows those Cloudflare scripts and nothing else from outside this site. What you paste into your assistant goes to that assistant's vendor under the vendor's terms, exactly as it would without these prompts.

Evidence: What an assistant fetches

Security

To report a security vulnerability, see the vulnerability disclosure policy (opens in a new tab). The privacy policy that covers this site and the other 5 is at posluns.ca/privacy (opens in a new tab).