# EHEPS Technology Service Register - Link: https://eheps.com/eheps-technology-service-register-2/ - Published: 2026-10-30T22:18:30+00:00 - Author: Founder EHEPS Technology Register Technology governance, security and service dependencies Document version 1.0 Status: Published [Overview](https://eheps.com/eheps-technology-service-register-2/#overview) [Service Inventory](https://eheps.com/eheps-technology-service-register-2/#inventory) [Dependencies](https://eheps.com/eheps-technology-service-register-2/#dependencies) [Security Controls](https://eheps.com/eheps-technology-service-register-2/#security) [IAM & OAuth](https://eheps.com/eheps-technology-service-register-2/#identity) [Risk Register](https://eheps.com/eheps-technology-service-register-2/#risk) [Policies](https://eheps.com/eheps-technology-service-register-2/#policies) [Governance](https://eheps.com/eheps-technology-service-register-2/#governance) # Technology Service Register Centralized service inventory covering cloud infrastructure, software platforms, APIs, identity systems, integrations, security controls, service dependencies and applicable policies. **Verification notice:** This register is an administrative record and planning framework. Historical configurations must be independently verified before being classified as active. Listing a provider does not establish an account, partnership, certification or product approval. **0** Registered services **0** Reported active / configured **0** Planned / under evaluation **0** Verification / review required ## 1. Service-by-Service Inventory Search by provider, service, API, lifecycle status, risk or policy. Records below are initial classifications, not live account checks. | Provider | Service / Component | Lifecycle status | Dependencies | Risk | Security / Data Requirements | Applicable Policies | ## 2. Service Dependency Register | Service | Depends on | Information exchanged | Required control | Dependency status | | WordPress | Hosting, DNS, database, TLS | Website content and configuration | Admin access control, backups, TLS | Verify | | WordPress MCP | WordPress REST API, OAuth | Approved website content and metadata | Least privilege, read-only default | Verify | | Google Cloud | IAM, billing, APIs, networking | Cloud resources and service data | IAM review, audit logs, encryption | Verify | | BigQuery | Google Cloud IAM, datasets, billing | Analytical datasets | Dataset permissions and retention | Planned / verify | | Firebase | Google Cloud project, authentication, database rules | Application identity and records | Authentication rules and database security | Verify | | OAuth / OpenID Connect | Identity provider, registered clients, redirect URIs | Authentication tokens and identity claims | Token security, exact redirect URI validation | Verify | | External APIs | Provider account, credentials, network access | API request and response data | Secret Manager or approved secret storage | Per integration | ## 3. Security Control Register | Control ID | Security control | Requirement | Evidence | Review status | | SEC-001 | Identity and access management | Least privilege and individual accounts | IAM policy review | Required | | SEC-002 | Multi-factor authentication | Enable for privileged accounts where supported | Account security settings | Verify | | SEC-003 | Encryption in transit | HTTPS and TLS for supported connections | TLS configuration and certificate records | Verify | | SEC-004 | Encryption at rest | Review provider encryption and key-management settings | Storage and database configuration | Verify | | SEC-005 | Credential management | No API keys, passwords or tokens in public source code | Secret inventory and access review | Required | | SEC-006 | Audit logging | Record security-relevant administrative changes | Provider audit logs | Verify | | SEC-007 | Backups and recovery | Document backup scope and recovery testing | Backup and recovery evidence | Verify | | SEC-008 | API security | Authenticate, authorize, validate and monitor API access | API configuration and test records | Required | | SEC-009 | Change management | Require review and approval before production changes | Change request and approval log | Required | ## 4. IAM, OAuth, API and Integration Records | Record | Technology | Security requirement | Evidence to retain | Status | | ID-001 | Google Cloud IAM | Least-privilege roles; avoid unnecessary owner permissions | Role bindings and review date | Verify | | ID-002 | OAuth 2.0 | Validate scopes, redirect URIs, tokens and client access | Client configuration and scope list | Configured — verify | | ID-003 | OpenID Connect | Validate issuer, audience, signature and nonce | Discovery metadata and test results | Under evaluation | | API-001 | WordPress REST API | Restrict write operations and authenticate requests | Endpoint and permission inventory | Verify | | API-002 | WordPress MCP | Read-only operation by default | Available tools and access scopes | Configured — verify | | API-003 | Google Cloud APIs | Enable only approved APIs and review service identities | API inventory and IAM records | Per project | | API-004 | Third-party integrations | Review data sharing, authorization and vendor terms | Integration agreement and test record | Per integration | ## 5. Risk Classification and Data Protection | Risk | Example | Data protection requirement | Review requirement | | High | Privileged IAM, production credentials, sensitive records | Restricted access, strong authentication, encryption, audit logs | Before access or configuration changes | | Medium | Application integrations, operational datasets | Purpose limitation, access restrictions, retention controls | Before integration and periodically | | Low | Public policy pages and non-sensitive documentation | Accuracy, integrity, accessibility and publication review | Before publication and when updated | ### Data categories * **Public:** Approved public information and published policies. * **Internal:** Operational documentation not intended for public distribution. * **Confidential:** Non-public business, personnel or administrative information. * **Restricted:** Credentials, authentication secrets and highly sensitive records. Classification must reflect actual data and applicable law. Do not place passwords, API keys, access tokens or private keys in this register. ## 6. Applicable Policies and Standards The following links connect service records to governance documents. Policy links are references to documents, not proof of legal compliance. ### EHEPS policy documents [ **Data Retention Policy** Retention and disposal of information [ **Data Security Policy** Protection of stored and transmitted data [ **Children’s Privacy Policy** Privacy considerations for children [ **Terms of Service** Website and service terms [** Acceptable Use Policy** Permitted use of technology resources [ **Information Security Policy** Information security governance [ **Responsible AI Policy** Responsible AI development and use [ **Third-Party Services Policy** External providers and integrations [** Accessibility Statement** Accessibility commitments [ **Conflict of Interest Policy** Disclosure and management of conflicts [ **Whistleblower Policy** Reporting and escalation procedures [ **Document Retention Policy** Records and document lifecycle[** Gift Acceptance Policy** Acceptance and recording of gifts [ **Financial Transparency Policy** Financial reporting and disclosure [ **Donations and Refunds Policy** Donation processing and refunds [ **Volunteer Policy** Volunteer administration and safeguards[** Cryptographic Security Policy** Cryptographic standards and protection ### Official technology-provider policies and standards [ **Google Privacy Policy** Google privacy practices [ **Google Cloud Terms** Google Cloud contractual terms [ **Google Cloud Service Terms** Product-specific service terms [ **IBM Privacy** IBM privacy information [ **IBM Terms** IBM terms and conditions[** AWS Privacy** Amazon Web Services privacy information [ **AWS Service Terms** AWS service-specific terms [ **AWS Acceptable Use Policy** AWS acceptable use requirements [ **OpenID Foundation Policies** Foundation policies and governance [ **OpenID Connect Core** Identity protocol specification [ **RFC 8692** Cryptographic algorithm identifiers ## 7. Change Management and Governance 1. Register each new service before production integration. 2. Identify the service owner and business purpose. 3. Record dependencies, data categories and provider terms. 4. Assess risk and applicable security controls. 5. Review IAM roles, OAuth scopes and API permissions. 6. Obtain required authorization before implementation. 7. Retain configuration evidence and approval records. 8. Review service status periodically and when material changes occur. **Production protection rule:** This register does not authorize deployment, publishing, API activation, billing commitments, permission changes, credential creation or transfer of production data. Each such action requires separate approval. ### Record ownership fields * Service owner and responsible administrator * Provider and product name * Service purpose and environment * Lifecycle status and last verification date * Data classification and risk rating * Dependencies and applicable policies * Evidence reference and reviewer approval * Next review date and change history **EHEPS Technology Service Register** Version 1.0 · Published · Document owner: EHEPS administration This register is an administrative governance document. Provider references do not imply endorsement, partnership, membership, certification or approval.