Disclosure | Family 3, Security, Privacy & Trust Disclosures

Third-Party & Open Source Dependency Disclosure and Software Bill of Materials

DIS-GL-019v1.0.0NDADisclosureGL1234S3 Evaluation & Assurance

Applies to DM-1, DM-2, DM-3 and DM-4 identically. The same artefact is deployed in all four models, so the bill of materials for a given release is the same in all four. In DM-4 it is the hospital's principal tool for answering "are we affected?", because the hospital is the one who must decide whether to apply the…

Permalink trust.pensievelabs.org/documents/DIS-GL-019

Classification

NDAMutual NDA required

The five axes

Kind: Disclosure
Tier: Mutual NDA required
Direction: Pensieve → Hospital
Lifecycle: S3 Evaluation & Assurance
State: Published templateTokens resolve live. An issued instance freezes its render, its token values and its hash.

Record

Doc ID: DIS-GL-019
Version: v1.0.0
Last modified: 31 July 2026
Review due: 31 January 2027
Owner: Engineering
Family: 3. Security, Privacy & Trust Disclosures
Language: en-IN
Retention: 8 years after the record closes

Execution

Signature: No signature
Stamp duty: No stamping required
Letterhead: standard

Applicability

Jurisdiction: Global (GL)
Applies to: 1234Dedicated, Shared, Customer Cloud, On-Premise
Lane: Assurance
Exit gate: Security review closed; no open blockers
Critical path: Not on the critical path

Integrity

Length: 1,586 words
SHA-256: DB7DE440CE26db7de440ce26e77eca8299a2c405e1af11ffbdf9a880e382364c9d1392302d40

No-repetition rule

This document is the source of truth for: sbom-format-and-availability, dependency-policy, open-source-licence-position, rfp-sbom-answer

Those surfaces render this text from here. They do not keep their own copy, so they cannot drift from it.

Depends on

Artefacts this one references or cannot be issued without.

Referenced by

Artefacts that would be blocked if this one were missing or out of date.

Mutual NDA required

Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.

Accept the mutual NDATime to clear: Target 4 business hours | A person at Pensieve reviews this one.

Where you are

PublicCleared
EmailNot cleared
NDARequired for this document
ClientNot cleared

What this page did not send you

The body of DIS-GL-019 was not rendered and was not transmitted to your browser. Everything you can see here (the classification, the summary, the dependency graph, the integrity hash) is register metadata, and it is published deliberately. Knowing that a document exists is not the same as reading it, and hiding the title only makes you send an email.

Available to you right now, without clearing anything

From the same family: Security, Privacy & Trust Disclosures.