Verification Record
AOS-CSO-2026-001 · v1.0

What the Certification Is Over

An assessment of the published instruments of the Hosting Certification Framework. The register divides its Certified Strategic entries into three certification objects, and the published instruments define two of them: Service in the Deed of Certification, Enclave in the eligibility criteria on the framework’s For Service Providers page. Facility is defined in neither and in nothing else published. The framework’s own description of a hosting provider, unchanged since its earliest archived capture, and the register’s description of the Certified Strategic tier are each quoted with the date it entered the record. This assessment is not about any certified provider and makes no claim about what any provider does at any site.

Reference
AOS-CSO-2026-001
Assessed
27 August 2026
Version
v1.0
The chain

Verification chain

Four things are pinned, and each can be checked independently of the others.

The assessment PDF. SHA-256: bd300182f031b6e4f7ec34de0f2623b3ef3dcd9dbed0c46a4dd15e70a60889c3

Download the file and run shasum -a 256 over it. If the value differs, the file is not the one struck here.

The timestamp. The receipt AOS-CSO-2026-001-v1.0.pdf.ots is an OpenTimestamps proof over exactly those bytes, submitted to four calendars on 27 August 2026 and pending confirmation in the Bitcoin blockchain at the time of publication. It establishes that the file existed no later than the moment it was stamped. It establishes nothing about whether the file is correct.

Receipt SHA-256: 9e657086921ed91790a427596845c809c308458ab8670ca64469ea251c10b1f0

The assessed source. The assessment rests on 27 pinned artefacts: 9 retrieved and pinned by this case, and 18 inherited under convention 7 from other cases in this corpus, each re-verified against its recorded hash before this record was written. All 27 are pinned by hash and 18 of the 27 are themselves Internet Archive captures. Quotations were checked against page images, not against a text layer alone; vocabulary counts state the artefact they were taken from and the control word run on the same extraction.

RefArtefactSHA-256Third-party copy
S-HCF-1Hosting Certification Framework, March 2021 v2, 30 pages - the only framework document linked from hostingcertification.gov.au; publisher's own PDF7b654f6e435bb90560701bf5e4905538f2da0cae73157ab4d58e710045855070-
S-HCF-2hostingcertification.gov.au Certified Service Providers page as served, 17 August 20264db055fdb011b3a223b3a6509bf9c29a1e705d7d664e25fcab60d30a3db44ca3-
S-AWS-1AWS ARNs and namespaces reference as served; carries the supported-partition list [PINNED AND NOT RELIED ON - no claim in AOS-CSO-2026-001 cites this; held for Records one and two of the case scope]82913024d2ddbf01429c14eaf42fec26274379a4f9d083ec4b3a800818ba30c2-
S-AWS-2AWS IAM User Guide, Manage AWS STS in an AWS Region, as served; states where the global STS endpoint is hosted [PINNED AND NOT RELIED ON - no claim in AOS-CSO-2026-001 cites this; held for Records one and two of the case scope]bfcbe75fe6caed7fbd99497576c1647ff7faf040349ed19cfd3135388842de0a-
S-GOO-1Google Cloud, Geography and regions, as served; carries the Global services section, the global cloud management plane statement, and the named region list for Global Internal Services [PINNED AND NOT RELIED ON - no claim in AOS-CSO-2026-001 cites this; held for Records one and two of the case scope]e7053835bbfccb3328b90c0bca0f8e34b91509a35510361004b48950cde5b9ac-
S-GOO-2Google Cloud locations page as served [PINNED AND NOT RELIED ON - no claim in AOS-CSO-2026-001 cites this; held for Records one and two of the case scope]7bf2514913d93a12564825553115e2a58128305ffff81e6f9da01199848599df-
S-CDX-GOO-1Internet Archive CDX index for S-GOO-1's address, queried 27 August 2026. 151 captures, 149 distinct digests, 24 April 2016 to 3 July 2026. NO capture carries S-GOO-1's bytes (base32 SHA-1 SU6WJA6IQAEX3LSEVOBFNS6YCHUXNZ2A). The index ENDS BEFORE the 17 August 2026 pin date [PINNED AND NOT RELIED ON - no claim in AOS-CSO-2026-001 cites this; held for Records one and two of the case scope]9274fd482a57355511643faf063417a5b880e3ae069f1aa5ba6fb94cbc495401Internet Archive replay
S-CDX-AWS-1Internet Archive CDX index for S-AWS-1's address, queried 27 August 2026. 1,362 captures, 138 distinct digests, 18 February 2013 to 26 August 2026. NO capture carries S-AWS-1's bytes (FPNOOJMV2DPE22EHHTGWAKIRFWYOYBX5). This index SPANS the 17 August 2026 pin date [PINNED AND NOT RELIED ON - no claim in AOS-CSO-2026-001 cites this; held for Records one and two of the case scope]a3e2ae113a98d78e9fd00b14ec64a5ad28105ac15d2802cb4365eda90b3b2690Internet Archive replay
S-CDX-AWS-2Internet Archive CDX index for S-AWS-2's address, queried 27 August 2026. 161 captures, 83 distinct digests, 1 September 2015 to 5 August 2026. NO capture carries S-AWS-2's bytes (Y7ABOR5GCEC4L2ETPXROQBZOUONBVS4D). The index ENDS BEFORE the 17 August 2026 pin date [PINNED AND NOT RELIED ON - no claim in AOS-CSO-2026-001 cites this; held for Records one and two of the case scope]f9ac0965715689104c5d4458c9f0c89ba1a82e46fa64bf4dc5f7688bc7bdde1bInternet Archive replay
A-DEED-1HCF Deed of Certification, published standard form, 20 pages. Cited for the definitions of Service and Service Provider Type at clause 1.1, the grant of certification at clauses 4.2 to 4.5, and the clauses bearing on Agency Data3b7f03819a27aae5550b8ce5a434bea2e29b36806d44729d4cd25e79dd101a2f-
AT-HCF-3HCF For Service Providers page as served. Cited for the eligibility criteria that define an enclave, and for the two provider types the framework states it applies tobecb270af231925cea25fdb1dde404a7c8b7a79100356a6fbd99f196b3a6940b-
F-IA-20211126005423Framework document, earliest Internet Archive capture, raw replay. Cited for the document's byte identity with the pinned copy and for the date from which the landlord passage is established7b654f6e435bb90560701bf5e4905538f2da0cae73157ab4d58e710045855070Internet Archive replay
F-IA-CDXInternet Archive CDX index for the framework document's own address. Cited for the twenty-three capture rows and the two digestse280383aa4782e9fe28e4cf3b387cb82004ca8ebbcb43093c45299e661e811feInternet Archive replay
H-HCF-1HCF certified-provider register as served. Cited for the three Certified Strategic certification-object headings8ea432069b2f83781fc869e93c53c05e7e0a44c84209d943429e1e8e91709c4d-
O-IA-20220117005227HCF certified-provider register, Internet Archive capture, raw replay. Cited for the heading signature1f5f679b73b5ba9b6a330b64ee734ee6e813b3b31f402701ba7a8c64e8784571Internet Archive replay
O-IA-20241214160934HCF certified-provider register, Internet Archive capture, raw replay. Cited for the heading signature9c0f279e4c81ad54b1ab980316dad2878c3c48f31900bb542f937c3caf5fee4eInternet Archive replay
O-IA-20250216115257HCF certified-provider register, Internet Archive capture, raw replay. Cited for the heading signaturebe62cdbbc4dd011fad31f630d54516047dcfcb9400d15d79ebdcf6002c970596Internet Archive replay
O-IA-20250623183308HCF certified-provider register, Internet Archive capture, raw replay. Cited for the heading signature and as the lower bound on the storage sentence08ab7d9e70d9a4cd9b88d060db005707cd28b43c6f7e4ecd72c551134aba76beInternet Archive replay
O-IA-20250916163147HCF certified-provider register, Internet Archive capture, raw replay. Cited for the heading signature and as the upper bound on the storage sentence35f4dfe1228ac90a1f0b0223bf7116d0b9ff6daaced29554222f9c323e7bdde1Internet Archive replay
O-IA-20251114112212HCF certified-provider register, Internet Archive capture, raw replay. Cited for the heading signaturecb0378c32a4595ce72f6da4300e45752cb6e34ffe65e75b7300727c841370c31Internet Archive replay
SP-IA-20220523031342HCF For Service Providers page, Internet Archive capture, raw replay. Cited as the lower bound on the removal of the Software-as-a-Service category33d1d11cbd2b8c1941c2453d0b9782d97a36ebe20a447621343e681e509a43bdInternet Archive replay
SP-IA-20220704220619HCF For Service Providers page, Internet Archive capture, raw replay. Cited as the upper bound on the removal of the Software-as-a-Service category635a5640a9e577dd42617358e1a412082d82b1753f993c3ab1dafbbb530e0145Internet Archive replay
SP-IA-20221018055051HCF For Service Providers page, Internet Archive capture, raw replay. Cited as the lower bound on the change from an enumeration to a limit4c1758a89d34c27d9a59e86d26670758de68f58c213dec76daf11591bb2c9e23Internet Archive replay
SP-IA-20230304175649HCF For Service Providers page, Internet Archive capture, raw replay. Cited as the upper bound on that change and as the lower bound on the enclave definitiona9b27db71fd795144a77999555d15f31110734d08a191e729abebf235fe95d56Internet Archive replay
SP-IA-20231020042123HCF For Service Providers page, Internet Archive capture, raw replay. Cited as the upper bound on the enclave definition and as the first capture carrying the eligibility blockec7b819d9c01891697a46e9bc8ed9d277aaa3dac54eafefeef9c426d0914b479Internet Archive replay
SP-IA-20250916172222HCF For Service Providers page, Internet Archive capture, raw replay. Cited for the page's state on 16 September 202522e9ea726e4c81c868bdaa94e684f95a161dc6e594cf4ee3a212bc548e4d8635Internet Archive replay
SP-IA-CDXInternet Archive CDX index for the For Service Providers page. Cited for the capture population the eighteen pinned captures are drawn fromd36ab3e0b251def55958d35b4f2efd6fc336b6e4ebde64f8d9007ee71a68dc60Internet Archive replay

Of the 27 pinned artefacts, 18 are themselves third-party archive captures - S-CDX-GOO-1, S-CDX-AWS-1, S-CDX-AWS-2, F-IA-20211126005423, F-IA-CDX, O-IA-20220117005227, O-IA-20241214160934, O-IA-20250216115257, O-IA-20250623183308, O-IA-20250916163147, O-IA-20251114112212, SP-IA-20220523031342, SP-IA-20220704220619, SP-IA-20221018055051, SP-IA-20230304175649, SP-IA-20231020042123, SP-IA-20250916172222, SP-IA-CDX - retrieved from the Internet Archive rather than from a publisher, and a reader can re-fetch each of those from that archive at the address the register records. The other 9 were retrieved from the publisher, and no independent capture of them is pinned here; for those 9 a reader must rely on this site or on the publisher’s server.

The build. The PDF is produced deterministically from tracked source by build.sh, with SOURCE_DATE_EPOCH pinned to the assessment date. Repeat builds on one machine and one toolchain are byte-identical; independent third-party reproducibility is not established and is not claimed. Verify by SHA-256, not by rebuild.

Versions

Version history

One version. The assessment date and the publication date are both recorded, and here they are the same day.

VersionAssessedPublishedSHA-256Status
v1.027 August 202627 August 2026bd300182f031b6e4f7ec34de0f2623b3ef3dcd9dbed0c46a4dd15e70a60889c3current · download

The cover carries 27 August 2026, the date the assessment was made, and publication followed the same day. An assessment is a reading of a source at a moment, and the document’s retrieval times and viewed dates already fix that moment; the cover is not moved to the upload date, because that would put two dates on one act of reading.

Corrections

Corrections

None. This is the first edition and it has not been corrected since publication. Any correction to this assessment will be recorded here and in the practice’s corrections register, and the published bytes of this version will not move.

Corrections made before publication are not listed here. They are recorded in the case’s own pre-insertion audit and pre-publication audit, which are tracked with the source.

Download

Assessment PDF

AOS-CSO-2026-001-v1.0.pdf · 143,444 bytes · 16 pages

SHA-256: bd300182f031b6e4f7ec34de0f2623b3ef3dcd9dbed0c46a4dd15e70a60889c3

OpenTimestamps receipt