EHEPS Technology Register
Technology governance, security and service dependencies
Document version 1.0
Status: Published
Status: Published
Technology Service Register
Centralized service inventory covering cloud infrastructure, software platforms, APIs, identity systems, integrations, security controls, service dependencies and applicable policies.
Verification notice:
This register is an administrative record and planning framework.
Historical configurations must be independently verified before
being classified as active. Listing a provider does not establish
an account, partnership, certification or product approval.
0
Registered services
0
Reported active / configured
0
Planned / under evaluation
0
Verification / review required
1. Service-by-Service Inventory
Search by provider, service, API, lifecycle status, risk or policy. Records below are initial classifications, not live account checks.
| Provider | Service / Component | Lifecycle status | Dependencies | Risk | Security / Data Requirements | Applicable Policies |
|---|
No matching service records found.
2. Service Dependency Register
| Service | Depends on | Information exchanged | Required control | Dependency status |
|---|---|---|---|---|
| WordPress | Hosting, DNS, database, TLS | Website content and configuration | Admin access control, backups, TLS | Verify |
| WordPress MCP | WordPress REST API, OAuth | Approved website content and metadata | Least privilege, read-only default | Verify |
| Google Cloud | IAM, billing, APIs, networking | Cloud resources and service data | IAM review, audit logs, encryption | Verify |
| BigQuery | Google Cloud IAM, datasets, billing | Analytical datasets | Dataset permissions and retention | Planned / verify |
| Firebase | Google Cloud project, authentication, database rules | Application identity and records | Authentication rules and database security | Verify |
| OAuth / OpenID Connect | Identity provider, registered clients, redirect URIs | Authentication tokens and identity claims | Token security, exact redirect URI validation | Verify |
| External APIs | Provider account, credentials, network access | API request and response data | Secret Manager or approved secret storage | Per integration |
3. Security Control Register
| Control ID | Security control | Requirement | Evidence | Review status |
|---|---|---|---|---|
| SEC-001 | Identity and access management | Least privilege and individual accounts | IAM policy review | Required |
| SEC-002 | Multi-factor authentication | Enable for privileged accounts where supported | Account security settings | Verify |
| SEC-003 | Encryption in transit | HTTPS and TLS for supported connections | TLS configuration and certificate records | Verify |
| SEC-004 | Encryption at rest | Review provider encryption and key-management settings | Storage and database configuration | Verify |
| SEC-005 | Credential management | No API keys, passwords or tokens in public source code | Secret inventory and access review | Required |
| SEC-006 | Audit logging | Record security-relevant administrative changes | Provider audit logs | Verify |
| SEC-007 | Backups and recovery | Document backup scope and recovery testing | Backup and recovery evidence | Verify |
| SEC-008 | API security | Authenticate, authorize, validate and monitor API access | API configuration and test records | Required |
| SEC-009 | Change management | Require review and approval before production changes | Change request and approval log | Required |
4. IAM, OAuth, API and Integration Records
| Record | Technology | Security requirement | Evidence to retain | Status |
|---|---|---|---|---|
| ID-001 | Google Cloud IAM | Least-privilege roles; avoid unnecessary owner permissions | Role bindings and review date | Verify |
| ID-002 | OAuth 2.0 | Validate scopes, redirect URIs, tokens and client access | Client configuration and scope list | Configured — verify |
| ID-003 | OpenID Connect | Validate issuer, audience, signature and nonce | Discovery metadata and test results | Under evaluation |
| API-001 | WordPress REST API | Restrict write operations and authenticate requests | Endpoint and permission inventory | Verify |
| API-002 | WordPress MCP | Read-only operation by default | Available tools and access scopes | Configured — verify |
| API-003 | Google Cloud APIs | Enable only approved APIs and review service identities | API inventory and IAM records | Per project |
| API-004 | Third-party integrations | Review data sharing, authorization and vendor terms | Integration agreement and test record | Per integration |
5. Risk Classification and Data Protection
| Risk | Example | Data protection requirement | Review requirement |
|---|---|---|---|
| High | Privileged IAM, production credentials, sensitive records | Restricted access, strong authentication, encryption, audit logs | Before access or configuration changes |
| Medium | Application integrations, operational datasets | Purpose limitation, access restrictions, retention controls | Before integration and periodically |
| Low | Public policy pages and non-sensitive documentation | Accuracy, integrity, accessibility and publication review | Before publication and when updated |
Data categories
- Public: Approved public information and published policies.
- Internal: Operational documentation not intended for public distribution.
- Confidential: Non-public business, personnel or administrative information.
- Restricted: Credentials, authentication secrets and highly sensitive records.
Classification must reflect actual data and applicable law. Do not place passwords, API keys, access tokens or private keys in this register.
6. Applicable Policies and Standards
The following links connect service records to governance documents. Policy links are references to documents, not proof of legal compliance.
EHEPS policy documents
Data Retention Policy
Retention and disposal of information
Data Security Policy
Protection of stored and transmitted data
Children's Privacy Policy
Privacy considerations for children
Terms of Service
Website and service terms
Acceptable Use Policy
Permitted use of technology resources
Information Security Policy
Information security governance
Responsible AI Policy
Responsible AI development and use
Third-Party Services Policy
External providers and integrations
Accessibility Statement
Accessibility commitments
Conflict of Interest Policy
Disclosure and management of conflicts
Whistleblower Policy
Reporting and escalation procedures
Document Retention Policy
Records and document lifecycle
Gift Acceptance Policy
Acceptance and recording of gifts
Financial Transparency Policy
Financial reporting and disclosure
Donations and Refunds Policy
Donation processing and refunds
Volunteer Policy
Volunteer administration and safeguards
Cryptographic Security Policy
Cryptographic standards and protection
Official technology-provider policies and standards
Google Privacy Policy
Google privacy practices
Google Cloud Terms
Google Cloud contractual terms
Google Cloud Service Terms
Product-specific service terms
IBM Privacy
IBM privacy information
IBM Terms
IBM terms and conditions
AWS Privacy
Amazon Web Services privacy information
AWS Service Terms
AWS service-specific terms
AWS Acceptable Use Policy
AWS acceptable use requirements
OpenID Foundation Policies
Foundation policies and governance
OpenID Connect Core
Identity protocol specification
RFC 8692
Cryptographic algorithm identifiers
7. Change Management and Governance
- Register each new service before production integration.
- Identify the service owner and business purpose.
- Record dependencies, data categories and provider terms.
- Assess risk and applicable security controls.
- Review IAM roles, OAuth scopes and API permissions.
- Obtain required authorization before implementation.
- Retain configuration evidence and approval records.
- Review service status periodically and when material changes occur.
Production protection rule:
This register does not authorize deployment, publishing,
API activation, billing commitments, permission changes,
credential creation or transfer of production data.
Each such action requires separate approval.
Record ownership fields
- Service owner and responsible administrator
- Provider and product name
- Service purpose and environment
- Lifecycle status and last verification date
- Data classification and risk rating
- Dependencies and applicable policies
- Evidence reference and reviewer approval
- Next review date and change history