Security, Trust & Compliance Controls
SOC 2 Type II & HIPAA Security Architecture
Detailed security architecture, cryptographic integrity proofs, and compliance controls mapping for enterprise environments and healthcare organizations.
Encryption in Transit
Strict TLS 1.3 encryption with HSTS preloading on all API endpoints and status page CDN distributions.
Encryption at Rest
Customer Managed Keys (CMK) with automated annual rotation across all persistent stores and telemetry queues.
Immutable Audit Trail
Cryptographically signed HMAC-SHA256 audit logs satisfying SOC 2 CC6.8 and HIPAA §164.312(b).
Multi-Account Isolation
Strict environment isolation separating Dev, Stage, Prod, and CI/CD pipelines with zero-trust cross-account boundaries.
Compliance Framework Mapping
| Standard / Requirement | Technical Implementation | Status |
|---|---|---|
| SOC 2 CC6.1 (Access Control) | Enterprise Identity Directory with 12+ char password complexity, MFA enforcement, and scoped API key hashes. | PASSED / ENFORCED |
| SOC 2 CC6.6 (Network Security) | Strict Edge Response Security Headers (HSTS, CSP, X-Frame-Options DENY, X-Content-Type-Options nosniff). | PASSED / ENFORCED |
| SOC 2 CC6.8 (Integrity of Audit Logs) | Immutable HMAC-SHA256 signatures generated for every Human and AI Agent action. | PASSED / ENFORCED |
| HIPAA §164.312(a)(2)(iv) (Encryption) | AES-256 Customer Managed Keys (CMK) envelope encryption across all databases, object stores, and queues. | PASSED / ENFORCED |
| HIPAA §164.312(b) (Audit Controls) | Audit logs recording actor ID, client IP, timestamp, resource touched, and tamper-proof verification. | PASSED / ENFORCED |
| HIPAA §164.308(a)(7)(ii)(A) (Backup) | Continuous Point-In-Time Recovery (PITR) with automated snapshots enabled across all production stores. | PASSED / ENFORCED |