Swirl.SWIRL CLOUD
Security you can prove. Evidence from the running platform.
Swirl Cloud maps its controls to NIS2, ISO/IEC 27001, DORA, GDPR and the CIS benchmarks, evaluates the technical ones continuously from the platform itself and gathers the evidence for your auditors. The evidence supports an audit; it does not certify compliance.
How the evidence is produced
Catalog
Each control states its objective, the requirements it supports, its automated checks and the documents an auditor will ask for.
Evaluate
Prometheus evaluates the checks every 15 seconds: a control passes when its evidence exists and no check fails.
Watch
A dashboard follows each framework, and an alert fires when a control degrades for 30 minutes.
Prove
A report per framework and an evidence pack, hashed and signed with your key, that your auditors verify offline.
The controls, by theme
27 controls: 18 are checked continuously from the running platform, 9 are proven by your documents. Each card states what the control checks and the requirements it supports.
Identity and access
- Automated
Central identity and single sign-on
People sign in to platform services through one identity provider that enforces password and brute-force policy; local accounts exist only for break-glass access.
NIS2 21(2)(i)ISO 27001 A.5.15, A.5.16, A.5.17, A.8.5DORA Art. 9GDPR Art. 32(1)(b)
- Documents
Multi-factor authentication for administrators
Administrator access to the platform requires a second factor.
NIS2 21(2)(j)ISO 27001 A.8.2, A.8.5DORA Art. 9GDPR Art. 32(1)(b)
- Documents
Periodic access review
Owners periodically confirm or revoke every person’s roles, including local accounts outside single sign-on.
NIS2 21(2)(i)ISO 27001 A.5.18, A.8.2DORA Art. 9
- Automated
Secrets management
Credentials live in Vault, are delivered to workloads by External Secrets, are never stored in Git, and are rotated before they age past the limit.
NIS2 21(2)(h)ISO 27001 A.5.17, A.8.24DORA Art. 9GDPR Art. 32(1)(a)CIS Kubernetes 5.4.2
Detection and response
- Automated
Security audit logging
Kubernetes API, secret-store and identity events are recorded centrally with defined retention.
NIS2 21(2)(b)ISO 27001 A.8.15, A.5.28DORA Art. 10GDPR Art. 32(1)(b)CIS Kubernetes 3.2.1, Kubernetes 3.2.2
- Automated
Security monitoring and alerting
Metrics collection and alert routing run continuously so detected problems reach an operator.
NIS2 21(2)(b)ISO 27001 A.8.16DORA Art. 10GDPR Art. 32(1)(b)
- Automated
Host intrusion prevention
Fail2ban and CrowdSec block brute-force and known-bad sources on every host.
NIS2 21(2)(e)ISO 27001 A.8.16, A.8.20DORA Art. 10GDPR Art. 32(1)(b)
- Automated
File integrity and malware checks
AIDE and rkhunter check host files for unexpected changes and rootkits at least weekly.
NIS2 21(2)(e)ISO 27001 A.8.7, A.8.16DORA Art. 10CIS Ubuntu: filesystem integrity checking
- Documents
Incident handling and notification
Security incidents are detected, handled, recorded and notified within regulatory deadlines.
NIS2 21(2)(b), 23ISO 27001 A.5.24, A.5.25, A.5.26, A.5.27DORA Art. 17, Art. 19GDPR Art. 33
Hardening and vulnerabilities
- Automated
Default-deny host firewall
Each host drops unsolicited inbound traffic except documented management, ingress and cluster ports.
NIS2 21(2)(e)ISO 27001 A.8.20, A.8.22DORA Art. 9GDPR Art. 32(1)(b)CIS Ubuntu: host-based firewall
- Automated
Network segmentation between workloads
Every workload namespace restricts traffic with NetworkPolicies.
NIS2 21(2)(e)ISO 27001 A.8.22DORA Art. 9CIS Kubernetes 5.3.2
- Automated
Workload isolation (Pod Security Standards)
Workloads meet the Kubernetes Pod Security Standards Baseline profile.
NIS2 21(2)(e)ISO 27001 A.8.9DORA Art. 9CIS Kubernetes 5.2
- Automated
Kubernetes configuration benchmark
The cluster configuration is assessed continuously against the CIS Kubernetes Benchmark.
NIS2 21(2)(f)ISO 27001 A.8.9DORA Art. 9CIS Kubernetes benchmark
- Automated
Host hardening audit
Hosts are audited monthly with Lynis and stay at or above the accepted hardening level.
NIS2 21(2)(f)ISO 27001 A.8.9GDPR Art. 32(1)(d)CIS Ubuntu: benchmark audit
- Automated
Security updates
Hosts install security updates automatically and restart within a week when an update requires it.
NIS2 21(2)(e)ISO 27001 A.8.8, A.8.19DORA Art. 9CIS Ubuntu: software updates
- Automated
Vulnerability management
Running images are scanned continuously and new critical vulnerabilities are triaged.
NIS2 21(2)(e)ISO 27001 A.8.8DORA Art. 9GDPR Art. 32(1)(d)
- Automated
Encryption in transit
Public endpoints use valid TLS certificates that are renewed before expiry.
NIS2 21(2)(h)ISO 27001 A.8.24DORA Art. 9GDPR Art. 32(1)(a)
Continuity and operations
- Automated
Backups
Platform recovery archives and persistent volumes are backed up daily outside the failure domain.
NIS2 21(2)(c)ISO 27001 A.8.13DORA Art. 12GDPR Art. 32(1)(c)
- Documents
Recovery and business continuity
The organization can restore the platform and its data within agreed recovery objectives.
NIS2 21(2)(c)ISO 27001 A.5.29, A.5.30DORA Art. 11, Art. 12GDPR Art. 32(1)(c)
- Automated
Service availability objectives
Every public endpoint is probed continuously against a 99.5% availability objective, and fast or sustained budget burn alerts an operator.
NIS2 21(2)(c)ISO 27001 A.8.14, A.8.16DORA Art. 9, Art. 11GDPR Art. 32(1)(b)
- Automated
Change and configuration management
Platform and application changes are applied from reviewed Git revisions and live state does not drift.
NIS2 21(2)(e)ISO 27001 A.8.9, A.8.32DORA Art. 9
- Automated
Capacity management
Storage and compute headroom is monitored so services are not lost to exhaustion.
ISO 27001 A.8.6DORA Art. 9GDPR Art. 32(1)(b)
Governance
- Documents
Risk management and security policy
Information security risks are assessed and treated under an approved policy.
NIS2 21(2)(a)ISO 27001 A.5.1DORA Art. 6GDPR Art. 32(2)
- Documents
Records of processing activities
Every processing of personal data is recorded with its purposes, data, recipients, storage and retention.
NIS2 21(2)(i)ISO 27001 A.5.34GDPR Art. 30
- Documents
Supplier and supply-chain security
External services and software suppliers are inventoried, assessed and covered by agreements.
NIS2 21(2)(d)ISO 27001 A.5.19, A.5.20, A.5.21, A.5.22DORA Art. 28GDPR Art. 28
- Documents
Security awareness and personnel security
Staff are trained, and joiners, movers and leavers receive and lose access on time.
NIS2 21(2)(g), 21(2)(i)ISO 27001 A.6.1, A.6.3, A.6.5
- Documents
Effectiveness assessment
Security measures are tested and reviewed regularly, and findings are tracked to closure.
NIS2 21(2)(f)ISO 27001 A.5.35, A.5.36DORA Art. 24, Art. 25GDPR Art. 32(1)(d)
Reports for audits and questionnaires
Access review
Keycloak and GitLab users with their roles and last sign-in, Kubernetes and Argo CD administrators, break-glass accounts, and a keep-or-revoke sheet to sign.
GDPR records of processing
A draft Article 30 record built from the applications, their data, their processors and their backups.
Incidents and NIS2 deadlines
A timeline of alerts, changes and sign-ins, with the NIS2 (24 hours, 72 hours, one month) and GDPR (72 hours) deadlines and draft reports.
Remediation deadlines
Every vulnerability in a running image is tracked from first sighting: 15 days for a critical one, 30 for a high one.
Credential age
Every Vault secret with its version, last write and age against the limit, without ever revealing its value.
Monthly report
The share of time each control passed, plus the month’s availability and costs, kept for 13 months.
Testing and vulnerability disclosure
Penetration testing
No external penetration test has been performed yet. One is planned on a reference installation before the first customer installation, then for each major release.
Report a vulnerability
Think you have found a vulnerability in Swirl Cloud or this website? Write to contact@swirlit.dev with the affected address or component, the steps to reproduce it and the impact you observed. Do not access or change data beyond what demonstrates the issue, avoid disrupting the service, and give us time to fix it before publishing.
contact@swirlit.devFrequently asked questions
Is Swirl Cloud certified?
No. An ISO/IEC 27001 certification covers an organization and its scope, not a piece of software. Swirl Cloud provides the technical evidence for your own audits.
Does Swirl Cloud make us NIS2 or DORA compliant?
It covers and proves the platform’s technical measures. Governance, risk assessment, training and supplier agreements remain your responsibility; the platform lists the documents an auditor will ask you for.
Does the evidence leave our servers?
No. Checks, reports and the evidence pack are produced on your installation; you choose what to hand to your auditors.