Planned verification service
Tested software and report registry
The registry will answer one narrow question: what was tested, under which scope, and what later certification and approval records apply to that exact build?
Current registry status
No statutory SASFA test reports have been issued
SASFA is not yet accredited or licensed as a national testing agent. This page defines the public record that will be implemented before operational reports are issued; it is not an empty list of certified products.
The provider page will be an index, not the assurance
A company may supply several products and many releases. The assurance attaches to the tested build and stated scope. Provider pages will aggregate those records without implying that every product or future version has been tested.
Four records that must remain separate
| Record | Issuer | What it establishes |
|---|---|---|
| Provider licence | Provincial licensing authority | The legal bookmaker or supplier and its licensed activities |
| SASFA test report | SASFA | The named product, version, exact build and defined test scope |
| Letter of Certification | NRCS | The certified system identified by the external record |
| Deployment approval | Provincial licensing authority | Use of the approved system by a named licensee |
What each public record will show
- Legal supplier and verified trading name
- Product, category, version and cryptographic build fingerprint
- SASFA report number, issue date, scope and applicable SANS editions
- Conditions, limitations and requirements outside the test scope
- NRCS Letter of Certification reference when independently verified
- Provincial approval references and the licensee to which each applies
- A permanent history of corrections, supersessions or withdrawals
Verification, correction and withdrawal
Each report will have a stable public reference and QR verification URL. Issued records will not be silently edited or deleted. A correction will create a visible revision; a changed build will require a new or delta report; a superseded or withdrawn record will remain discoverable with its reason and replacement.
Public summaries will contain no source code, security-sensitive findings or private evidence. The operational evidence store and public registry will remain separate.