Sealed at rest, end to end
Sensitive data must be unreadable wherever it is stored, including backups, replicas and exports.
What properly protected means, written down.
The Ghostables Standard sets out what it takes for sensitive data to count as properly protected. Deployments assessed against it are certified, and their status is shown on a live verification page.
Four requirements at the heart of the Standard
Keys kept from the operator
The people who run a system must not hold what it takes to read the data it protects.
Evidence for every protected write
Changes to protected records must leave evidence that cannot be removed or rewritten later.
Contained impact
A stolen key must expose no more than a narrow recent window, never the full history.
A status that is checked every day
Most certifications describe a system on the day it was audited. A Ghostables mark is rechecked for as long as it is shown.
| Aspect | Point-in-time certification | The Ghostables Standard |
|---|---|---|
| When it is checked | At the audit, then again at renewal | Every day, through check-ins from the deployment |
| What a customer sees | A certificate or a logo | A live verification page anyone can open |
| If protection lapses | Often unnoticed until the next audit | The mark stops showing as verified |
Three names, one source of truth
The Ghostables StandardThe specification
The requirements themselves. Available to certification candidates and partners.
Ghostables CertifiedFor organisations
The certification for deployments assessed against the Standard.
Protected by GhostablesFor their customers
The trust mark for active Ghostables products and certified deployments, linked to a live verification page.
Request the specification
The Standard is shared with certification candidates and partners. Tell us about your organisation and we will be in touch.