Defined responsibilities
Each role knows its decision scope and what requires review.
Governance
Governance supporting trust and responsible decisions
This page outlines Cup Code principles for accountability, information protection, risk management, and conflicts of interest.
PoliciesPrinciples
Clear responsibility in decisions and access
Material decisions follow documentation, review, and clear ownership.
Limited access
Access follows need and is removed when the role or need changes.
Documented decisions
We record the decision, reason, impact, and follow-up owner.
Regular review
Policies and controls are reviewed when services or risks change.
Risk management
We review impact before choosing controls
We assess risk by impact and likelihood, then assign an owner, response, and review time.
Product risk
Reliability, performance, accessibility, and service continuity.
Security and privacy
Access, data, integrations, and report response.
Suppliers and partners
Scope, responsibilities, information handling, and continuity.
Conflicts of interest
Disclosure, review, and separation of decisions when needed.
Domains
A connected public framework
Each page explains accountability, lifecycle, and evidence without exposing internal data or security secrets.
Framework and accountability
Decision layers, delegation, and separation of duties.
Policy management
Versions, review, approval, and acknowledgement.
Risk and controls
Assessment, treatment, acceptance, and control testing.
Data and privacy
Processing register, rights, retention, and incidents.
Cybersecurity
Access, secure development, vulnerabilities, and response.
Continuity and recovery
Critical services, backups, exercises, and communications.
Third parties
Selection, contract, monitoring, and exit.
Conflicts of interest
Disclosure, recusal, and mitigation plan.
Speak-up and complaints
Confidentiality, non-retaliation, and independent review.
Technology and AI
Change, integrations, keys, and human oversight.
Transparency
What we publish, redact, and correct.
Policies and channels