Asset inventory
Information and associated assets, classified, located and owned.
ISO 27001 A.5.9 requires an inventory of information and associated assets, each with a named owner.
An asset without an owner has nobody responsible for classifying, protecting or disposing of it.
| Ref | Asset | Kind | Classification | Location | PII | Owner |
|---|---|---|---|---|---|---|
| AST-001 | Swiss VPS (n8n + Postgres) Rented Swiss VPS. Runs n8n, Postgres 16 and cloudflared. Holds the ISMS database. |
service | confidential | CH | yes | R. Brunner |
| AST-002 | GitHub repository siglos-ag/ISMS Private. System of record for ISMS documents and evidence. Branch protection enforced. |
repository | confidential | US | no | R. Brunner |
| AST-003 | ISMS console (Cloudflare Worker) Server-rendered console. Compute at the edge; data stays on AST-001 via Hyperdrive with caching disabled. |
application | confidential | Global edge | yes | R. Brunner |
| AST-004 | ISMS Postgres database Employee directory, sessions, append-only audit log. No client data. |
data store | restricted | CH | yes | R. Brunner |
| AST-005 | Cloudflare DNS + Access Controls every Siglos hostname and the login gate. Highest-blast-radius account held. |
network | confidential | Global edge | yes | R. Brunner |
| AST-006 | n8n workflow automation Self-hosted. Orchestrates the review agents. Credentials domain-restricted. |
application | confidential | CH | no | T. Oduya |