Fewer sources. Better evidence.
The public register supports broad discovery. Continuous monitoring begins with a tightly controlled set of approved connectors.
Vendor-controlled sources
Official trust centers, security pages, privacy policies, DPAs, and subprocessor lists. Source identity and product scope must be established before monitoring.
Hosted trust portals
Portal records can be used when their relationship to the vendor is confirmed and the requested material is publicly accessible or explicitly authorized. Login and NDA boundaries are respected.
Authoritative registries
Official certification and authorization registries can provide evidence of specific listings and their scopes. A registry entry does not establish every control for every product.
Researcher and partner evidence
Authorized documents and review findings are scoped to the customer workspace. They should never enter the public search index or another tenant's retrieval context.
Pilot coverage
The imported register contains 5,839 company records from the existing site. Not all have discovered artifacts. Live pilot connectors are limited to approved OpenAI, Anthropic, Stripe, and Figma hosts. Historical and verification examples use the fictional Example Cloud record.