A public instrument of the OYA movement
Governance & independence
A standard is only as credible as the separation between the organization that writes it, the organization that assesses conformance to it, and the companies seeking the label. OYA is being structured, in the tradition of frameworks like NIST's Privacy Framework, to keep those roles independent of one another — and independent of any single company, including its founding implementer.
Founding status. None of the entities described below have been legally formed yet. OYA does not yet operate as a certifying body — no board has been seated, and no company has been certified. Full detail: Status & disclosures.
The planned structure
Four roles, deliberately separated.
None of the entities below have been legally formed yet. This is the structure OYA is being designed around, not an org chart of what exists today.
Standards foundation
A nonprofit or public-benefit foundation responsible for the standard, its governance, and the public registry.
Certification services
A certification function responsible for assessor management and certificate issuance, structurally separated from any software or consulting sales.
Optional software entity
A white-label software/portal entity a member may use to help meet the standard — never a mandatory purchase for certification.
Independent accredited assessors
Assessors that cannot be controlled by the company being assessed.
Board composition
Seats reserved for independence.
The planned board reserves seats for independent experts across seven domains, plus one non-controlling seat for AlignHeart as founding implementer. No single company, including AlignHeart, holds unilateral control.
- Privacy
- Cybersecurity / cryptography
- Consumer rights
- AI governance / safety
- Accessibility
- Civil society
- Small companies
- AlignHeart — founding implementer, one non-controlling seat
AlignHeart's boundary
What AlignHeart can — and can't — do here.
AlignHeart is OYA's founding implementer — the company that proposed the standard and intends to build toward it first. That role is bounded.
AlignHeart may publish its own profile, data map, and assessment status.
AlignHeart may not assess its own certification.
AlignHeart may not change OYA requirements privately to pass itself.
AlignHeart may not claim independent verification before it actually has it.
Financial independence
Certification outcomes are not for sale.
OYA is being designed so certification outcomes cannot be purchased. Membership, assessment, and software fees are meant to fund the program's operation — not a passing result. Assessment fees are meant to go to the independent assessor, not a salesperson. No member, regardless of size, will be able to control governance decisions alone.
Read status & disclosures