01
Scope recorded
The reviewed AWS account, environment, workloads, and responsible owner are documented.
Evidence: Scope sheet and ownership record
PrivateStack Verified Deployment
Evidence your deployment can carry with it.
A published technical standard for a defined Enterprise AWS BYOC deployment, paired with a time-limited mark, public verification record, and private Evidence Pack.
Example status
PrivateStack
Verified
Deployment
Standard
PSV-1.1
Scope
Enterprise AWS BYOC
Record
PSV-SAMPLE
Validity
Time-limited
PSV-1.1
10 mandatory checks. No partial-pass mark.
The review is bounded to one named deployment. Every criterion must be evidenced before the mark and record are issued. Earlier PSV-1.0 records retain their original scope and criteria version; PSV-1.1 requires a new review against all ten checks.
02
Deployment boundary evidenced
The reviewed PrivateStack Enterprise deployment is placed in the customer-controlled AWS account and VPC.
Evidence: Architecture and placement evidence
03
Access configuration reviewed
Administrative roles, least-privilege intent, and credential handling are documented for the reviewed scope.
Evidence: Role and access configuration
04
Data path reviewed
Model routing, retention configuration, and relevant data-flow boundaries are documented.
Evidence: Data-flow and retention record
05
Audit evidence available
Request records and available export evidence can be produced for the review period.
Evidence: Dated audit export sample
06
Model inventory recorded
The enabled model set and relevant configuration are captured for the reviewed deployment.
Evidence: Model inventory snapshot
07
Operational ownership recorded
Patching, monitoring, incident ownership, and material-change notification responsibilities are assigned.
Evidence: Operating responsibility record
08
Evidence Pack produced
Available review artifacts are packaged with dates, scope, criteria version, and reviewer notes.
Evidence: Private, date-ranged Evidence Pack
09
Network egress inventoried
Every route out of the reviewed data plane is recorded with its destination, purpose, and approval. PrivateLink and VPC endpoint coverage, remaining public paths, and exceptions are reviewed against the named deployment boundary.
Evidence: Dated egress inventory, route and endpoint configuration, and exception decisions
10
Key custody reviewed
Record the key owner and customer-managed key configuration. Review key-policy principals, grants, service restrictions such as kms:ViaService, and encryption-context scoping where supported; document gaps and exceptions for the reviewed configuration.
Evidence: Key inventory, redacted key policies and grants, and custody review findings
Review path
Scope first. Evidence second. Mark last.
- 01
Freeze the scope
Name the deployment boundary, environment, workload, owner, and review period before evidence is collected.
- 02
Review and remediate
Evaluate every mandatory criterion, document qualifications, and close gaps before a mark can be issued.
- 03
Issue and monitor
Publish the scope-limited record, deliver mark assets and the Evidence Pack, then track expiry and material change.
Shareable proof
Public verification record
Shows the customer-approved display name, deployment scope summary, standard version, status, review date, valid-through date, and any approved qualifications.
It never exposes cloud account IDs, network identifiers, secrets, internal findings, or the private evidence file.
Review detail
Private Evidence Pack
Gives the customer the available review artifacts, dates, scope, criteria version, qualifications, and reviewer notes for internal evaluation or controlled sharing.
Badge files and usage rules are delivered only after every mandatory criterion passes.
Validity
Proof has a clock.
An issued mark is valid for up to 12 months. A material change to the reviewed deployment or evidence boundary requires re-review and may end validity sooner.
Only active records may display the mark. Every issued mark must link to its public verification record.
A record expires or can be revoked when
- The review period expires.
- The deployment materially changes without re-review.
- Evidence becomes invalid or misleading.
- The mark is used outside the verified deployment scope.
- Failure to remove or correct a mark after notice.
The boundary matters
Technical verification, stated precisely.
PrivateStack Verified Deployment is a vendor-issued, scope-limited technical verification. It is not an accredited certification, independent audit opinion, compliance attestation, or guarantee of regulatory outcomes.