Provenance

What is Provenance?

Provenance records every device the company holds, who holds it and its state, and every component each release ships, deduplicated by package URL across the estate. Security findings are joined to both, so checking whether an advisory affects us is a lookup. Exports are control-tagged: organised by control reference, with each section stating what the register does and does not evidence. Every export is recorded in a hash-chained audit log.