Environment separation (non-production mirror)
A schema-synced non-production project holding synthetic data mirrors production for migration verification, and the separation is enforced in code rather than by convention: the shared database client asserts at startup that a deployment which is not production is not pointed at the production database, so a misconfigured preview or development build fails instead of reading real student data. Proven in both directions against a real build on 10 August 2026, and every build now records in its own log which database it accepted, so a passing build is evidence rather than silence. Verified that way on 11 August 2026 across all three applications with a database client: previews on non-production, production on production, six builds. The honest residual is that both are separate projects inside one cloud organisation and one owner account, so this is environment separation, not account separation.
Standards mappings
This control maps to the following standards and frameworks. Each entry states our real relationship with the standard, and the specific requirements this control helps satisfy.
ISO/IEC 27001:2022InfoSec complianceSelf-assessed
A full 93-control Annex A Statement of Applicability is maintained and honestly dispositioned, and the ISMS went live on 26 July 2026 with its first completed management review. Not certified: no external audit has occurred, the clause 9.2 internal audit is openly unmet, and the certification trigger (a named tender, funding, or first hire) was formally decided at the first management review.
- A.8.31Separation of development, test and production environments
SOC 2 (AICPA Trust Services Criteria)InfoSec complianceAligned
Controls are explicitly mapped to the criteria — change management to CC8, logging and monitoring to CC7, access control to CC6 — but no SOC 2 attestation of any type exists. Independent attestation is a tracked roadmap item, offered as a contractual milestone for a pilot.
- CC8.1Change management
Policy mapping
The written standard this control enforces:
Request access and we can share the full policy set, assessment reports, and completed questionnaires under NDA — or answer your security questionnaire directly.