Thulpar’s control catalogue is generated from the product’s own code. It is the same table the evidence packs are written from. Every control carries the rails and built-in features that implement it, its OWASP and MITRE ATLAS counterparts and seven regulation columns. An evidence pack reads the period’s ledger and marks each control implemented, partial or not configured.
An evidence pack is produced per tenant, period and profile. The control catalogue carries each control’s status, the summary carries the period’s counts, and decisions.jsonl carries every decision with its hash. The auditor verifies the pack with the installation’s public key; no internet connection is needed.
See what a pack contains →An evidence pack reads the period’s ledger and marks each control implemented, partial or not configured. A skipped rail is recorded with the posture that was applied. The chain’s verification result travels inside the pack.
See the control catalogue →Actions above the threshold are referred to a person. The period’s approvals travel in approvals.jsonl: who, when, four-eyes, SLA, expiry. Human oversight is a verifiable record written to the ledger.
See the approval flow →An evidence pack is produced per tenant, period and profile. The table below lists what it contains. The control catalogue carries each control’s status, the summary carries the period’s counts, and decisions.jsonl carries every decision with its hash. A skipped rail is recorded with the posture that was applied. The auditor verifies the pack with the installation’s public key. No internet connection is needed.
6698 Art. 4, 6, 9, 12; the Generative AI, AI at Work and Agentic AI guides
Information Systems Regulation Art. 13, 25, 27; Banking Law Art. 73; audit-trail section
Insurance and Private Pension Internal Systems Regulation
Circular 2019/12; Information and Communication Security Guide; classification; 5-year retention
Art. 9, 12, 14, 15, 50, 72–73; Annex IV technical documentation section
Annex A control evidence; the 42005 impact-assessment context
Art. 9 ICT risk; Art. 17–20 incident classification section; TLPT-aligned red-team report
| file | contents |
|---|---|
| manifest.json / .sig | the pack’s identity: format, tenant, profile, period, policy versions, detector versions; Ed25519 signature |
| controls.md / .json | the catalogue’s profile column: every control’s status, its rails (mode, locked, served, findings, skips) and features |
| summary.md / .json | counts by kind, stage, decision, category and rail; rails skipped and not run; shadow decisions; approvals |
| decisions.jsonl | every event of the period in the contract’s shape, with its hash and the redacted sample while retained |
| chain-verify.txt | the verification result: event count, head hash, the period’s first and last hashes, anchors |
| approvals.jsonl | the period’s approvals: who, when, four-eyes, SLA, expiry |
| policy-versions/ | the pack documents in force: content hash, signer, signature |
$ thulpar-evidence verify acme-bddk-2026-Q3.zip --public-key acme-signer.pub
manifest.sig ✓ (ed25519, keyId ins_7f2a:2026-10) files 9/9 ✓ chain 184,221 events ✓ anchors 92 ✓
controls: 26 · implemented 21 · partial 3 · not_configured 2 (GR-A2A-01, GR-EXEC-01)The catalogue is copied from the code that generates the product’s evidence packs. CI refuses a divergence between the two. The regulatory mapping is Thulpar’s engineering reading. It is not legal advice and does not replace the institution’s own compliance judgement.
Nine suites (the Turkish pack, promptfoo, PyRIT, garak) run against attack-success-rate and utility thresholds. Results are written to the ledger as benchmark events bound to a policy version. The console shows drift between versions. A policy pack with a failing benchmark cannot be activated. The nightly run executes every suite and publishes the results.
Redacted samples are deleted at the end of the retention period. The chain is untouched. A tenant leaving is one command, and it produces a signed certificate of deletion. KVKK Art. 7 and the sector retention floors are set per pack. The floor is 5 years for BDDK and the public sector and 10 years for defence.
A one-hour technical demo: your scenario, your policy pack, on a closed-circuit install. Then the install kit and a trial licence for a pilot.