Evidence over assertion
A questionnaire answer is an opinion. A control is proven by the artefact showing it operating on a stated date.
In practice
Every verdict ships with its inputs, timestamp and rule version.
Operating beliefs
Compliance is a record, not a claim.
DeshCyber believes a control is only proven when an independent party can recompute the same verdict from the same inputs and the same published rule version.
These are not values on a wall. Each one maps to something the company publishes, separates, or refuses to do, so a client can hold us to it.
Six beliefs that shape the product
01Each belief is written as a constraint, so it can be checked rather than admired.
Rules published before verdicts
The logic that decides pass or fail is written and versioned before it is applied to a client environment.
In practice
The rule version is quoted on every report we issue.
Assurance separated from delivery
The function that reviews evidence does not report to the function that produces it, so no result is graded by its author.
In practice
Assurance keeps an independent reporting line to the board.
Deterministic before intelligent
Models help read documents and draft language. They never decide whether a control passed.
In practice
AI output is labelled and reviewable; verdicts stay rule-based.
Client data stays in the client boundary
Evidence is produced where the systems already run, rather than copied into a vendor data lake first.
In practice
Deployment keeps source records inside your environment.
Plain records beat dashboards
A finding an auditor cannot read is not a finding. Every screen resolves to an export a person can file.
In practice
Exports are machine-readable and legible in English and Bangla.
What we commit to in writing
02Four commitments a procurement or assurance reviewer can hold the company to.
- Rule publication
- Versioned and dated
- Reproducibility
- Recomputable by third parties
- Data residency
- Inside the client boundary
- Change disclosure
- Notified before enforcement
Control logic is published with an effective date before any verdict relies on it.
Anyone holding the same inputs and rule version reaches the same result.
Source systems and evidence stores stay under the client's own controls.
Rule changes are circulated with a review window before they affect a verdict.
Go deeper on who we are
06The principles, people and engagement model behind the structure above.
See how these beliefs turn into a working engagement.
The engagement model shows the four stages, the artefacts each one leaves behind, and the terms under which we run them.