Oasis Stack Oasis Stack A CloudHost Initiative
EN
Talk to us
Architecture · Compliance & evidence

Certified by the operator.
Evidenced by the platform.

Oasis Stack does not hold a certificate on your behalf. Each deployment is certified by the operator who runs it — and the platform’s job is to produce the evidence that makes the certification achievable, and keep producing it afterwards.

Talk to our team How security works
NCA ECCPDPLRegional programmes
The operator certifies
The deployment is theirs, so the certification is theirs. We do not claim it for them.
The platform evidences
Controls produce their own record, continuously, instead of being reconstructed for an audit.
Mapped, not marketed
Controls are organised against frameworks so coverage can be demonstrated rather than argued.
Continuous, not annual
Evidence is generated as the estate runs, not assembled the week before a review.
Scope

The deployment and its infrastructure build.

Compliance here covers the partner’s physical deployment and the infrastructure it is built on — not what the partner’s customers run in their tenancies, which they answer for themselves.

Oditr
CloudHost’s compliance as a service checks the controls and produces the evidence, continuously.
VirtueSuite and Observa
Identity, access and observability records feed the same evidence trail.
Additional frameworks
Where a deployment is assessed against more, controls are mapped on request, as additional scope.
The honest position

A platform cannot be compliant on your behalf.

A certificate attaches to an organisation, a scope and a set of operating practices — to the operator running the cloud, not to the software inside it. What software can do is make the controls enforceable and the evidence automatic, so the operator’s certification is achievable and stays true between audits. That is what Oasis Stack does, and it is all it claims.

Security & sovereignty
What the operator holds
The scope, the audit relationship, the certificate and the obligations to their regulator.
What the platform supplies
Enforcement before provisioning, and the continuous evidence an assessor asks to see.
What the customer holds
Their own data classification, their users, and their own regulatory obligations.
Frameworks

Structured for the rules our operators answer to.

The platform’s control model is organised against the frameworks that govern regulated work in the region, so an operator can demonstrate coverage rather than reconstruct it.

NCA ECC
Controls organised so an operator can demonstrate coverage against the Essential Cybersecurity Controls rather than assemble it per audit.
PDPL
Data residency, retention and access obligations enforced by policy in the platform, not by convention in a runbook.
Regional programmes
Structured for the region’s sovereign and public-sector programmes, including in-country and air-gapped deployments.
Certificates

Oasis Stack holds no certificate on an operator’s behalf, and publishes no audit reports or control matrices on a public website. During evaluation, under an NDA, we walk your compliance team through the control model and how it maps to the framework you are assessed against. CloudHost, as the supplier, holds ISO certifications, shared on request. Certifications for a deployment are obtained by the partner that runs it, after deployment, because each deployment is white-labelled.

Ask for the compliance pack
What an assessor gets

Evidence that was already there.

The difference between a platform that helps at audit time and one that does not is whether the record existed before anyone asked for it.

An immutable audit trail
Who ordered, approved, changed and accessed what, across every module and every tenant.
Policy as written and as enforced
The rule, and the provisioning decisions it actually governed — not two separate documents.
Continuous control status
Where a control has drifted, surfaced by Amin when it happens rather than at the next review.
Scoped reporting
Evidence filtered to a tenant, a zone or a classification, so a scope can be evidenced without exposing the rest.
Identity and access history
Every grant, change and revocation, against the directory the operator controls.
Residency and movement records
Where data has been stored and processed, and the policy decisions that allowed it.
Control mapping

How a capability meets a control domain.

Framework control identifiers and versions are confirmed with your assessor against your scope — they are not a website claim. What is stable is which platform capability answers which kind of control.

Identity and access management
One identity layer across every module, role and attribute-based access per tenant, project and environment, and an immutable record of every grant, change and revocation.
Asset management
The catalogue is the asset register: nothing is provisioned that is not a catalogue item attributed to a tenant, so the inventory is a by-product rather than an exercise.
Change management
Every provisioning, modification and teardown is an approved, recorded event. The record of what changed and who approved it is the same record the platform used to allow it.
Data protection
Classification-aware policy applied before provisioning, encryption in transit and at rest, key custody held inside the operator’s boundary, and residency enforced rather than documented.
Logging and monitoring
A platform-wide event stream every module writes to, with Amin surfacing drift and exposure from the live estate rather than from a periodic scan.
Third-party and supply chain
Alliance and marketplace services are provisioned through the same catalogue, policy and metering path as first-party services, so they inherit the same controls.
How to start

Bring your framework, not ours.

The useful conversation starts from the controls you are actually assessed against.

1
Map
Your control framework against what the platform enforces, control by control.
2
Identify
What the platform evidences, what your operating practices must cover, and where the gaps are.
3
Evidence
The reporting your assessor needs, scoped to your deployment and produced continuously.
Who builds what

Built in-house. Extended with alliances.

The evidence is produced by the platform. The certificate, and the assessor, stay yours.

Built in-house
  • The audit trail, produced continuously
  • The record of policy as written and as enforced
  • Control status, with drift surfaced when it happens
CloudHost products, integrated
  • Oditr — compliance as a service
  • VirtueSuite and Observa — identity and observability records
Built with alliances
  • Security event and configuration systems the evidence flows into, through integration alliances
  • Alliance and marketplace services, which inherit the same controls through the catalogue
How alliances join
Evidence, not assurance.

Walk it against your own framework.

A conversation with your compliance team about what you are assessed on and what the platform can evidence.

Talk to our team The governance module