This page sets out the evidence to request during a SuperBluOrange project evaluation. It does not assert that every component carries a particular certification or that a universal service level applies to every engagement.
Map access and data responsibility
List the data handled by each component, who can access it and how access is approved and removed. Distinguish ordinary customer support access from permissions to alter balances, approve withdrawals, export records or deploy a release.
For a sensitive action, ask for the proposed approval process and the record available afterward. The record should identify the account, action and context needed to investigate it. A shared administrator login would make that investigation materially harder.
Check what each assurance covers
| Evidence | Questions that establish its relevance |
|---|---|
| Certification or assessment | Which entity, component, version, scope and validity period does it cover? |
| Security test | What was tested, when, with what exclusions and remediation status? |
| Hosting and backup plan | Which records are protected, where, and who can restore them? |
| Recovery exercise | What was restored, how long did it take, and were balances reconciled? |
| Availability report | Which service, measurement period and exclusions produced the figure? |
An upstream supplier's assurance can support the review of that supplier. It should not silently become a certification claim for the entire operator or every integration.
Agree the incident and recovery process
The operating plan should identify severity levels, contacts, decision authority and update expectations. A response target describes when work or communication starts; it is different from a target to restore service.
For recovery, define the acceptable loss of recent data and the target time to restore the required service. Test the transaction and reconciliation consequences of those choices. Restoring a database alone does not establish that external payment and game records match it.
Discuss security requirements with your market, hosting constraints and procurement questionnaire. Read technical documentation for integration evidence or hosting services for infrastructure scope.