Controlled access
Make information available to authorised people within established customer and service scope.
Security & Trust
Trust is a product requirement.
Pura's trust position is built around controlled access, understandable evidence and honest boundaries. The public site does not claim certifications or guarantees that have not been verified.
Evidence-ledControlled accessHuman judgement
Control principles
The foundations of honest assurance
Security and trust shape who can see information, what evidence a record supports and how uncertainty is communicated.
Auditability
Keep important records, changes and decisions understandable to later reviewers.
Evidence integrity
Retain provenance and relationship to the asset or activity.
Fail closed
Do not imply access or certainty when authorisation or evidence is missing.
Operational boundaries
Define customer data, service scope, responsibility and contractual arrangements.
Honest assurance
Distinguish known capability, current direction and UNKNOWN states.
Buyer questions
Specific due diligence matters
The appropriate assurance conversation is specific to the service and deployment.
Access
Which roles and scopes can retrieve which records?
Evidence
What record types are supported and how are they linked?
Actions
How are defects, follow-up and exceptions represented and reviewed?
Boundaries
Which environments, suppliers and data flows are in scope?
Contract
Where are support, retention, processing and service commitments defined?
Fail-closed communication
UNKNOWN is a control, not a weakness
A trustworthy system does not turn an incomplete record into a green status because a user wants an answer.
No unverified certifications
Pura does not claim ISO, Cyber Essentials, SOC 2 or other security certification here.
Service-specific assurance
Any assurance statement must be confirmed for the relevant service and date.
Trust review
Start with the controls Pura can explain.
The public site separates governed product capability from information that must be confirmed for the actual service, deployment and contract.
PRODUCT ACCESS CONTROLS
What the governed evidence shows
Role-aware access, customer and tenant scope, permission checks, denied-action handling and audit-event concepts are represented in the approved access model.
Governed product capabilityEVIDENCE / AUDIT CONTROLS
Keep the record connected
Approved proof shows activity, evidence context, results, actions, provenance and exception ownership as concepts for review.
Governed product capabilityDATA / CUSTOMER BOUNDARIES
Scope is established for the service
Customer data, users, assets, sites, environments, suppliers and responsibilities must be agreed for the relevant operating model.
Owner confirmation requiredSecurity information to establish during due diligence
Hosting location, encryption, backups, resilience, monitoring, incident response, penetration testing, subprocessors, data processing and service commitments are not claimed on this public page. Confirm them for the proposed service.
What Pura is not currently claiming
No ISO 27001, SOC 2, Cyber Essentials, uptime, recovery, encryption or certification claim is made here. UNKNOWN remains UNKNOWN until the responsible owner confirms it.
Enterprise evaluation path
Approved P1 architecture proof
Access is a governed path
This explanatory visual is derived from governed access-control implementations. It shows the concepts represented in source code and deliberately excludes certification, penetration-test and guaranteed-security claims.
Architecture-derived evidence
Security and access model diagram
Capability: Security and controlled access
The model shows role-aware access, customer scope, permission checks, denied actions and audit-event concepts as bounded product controls.
Architecture-derived evidenceDerived from governed product-control implementation. This is not certification or a security guarantee.
Review trust boundariesNext conversation
Discuss a defined requirement.
Discuss the evidence, access and decisions that currently create friction.