Compliance and security
Compliance and security posture
A plain-language summary of how DataShield maps to the regulations that gate agent deployments, what we can prove today, and what is still in progress. We do not put a certification on this page before it is true. For the full, control-by-control detail behind an NDA, request Trust Center access.
Alignment and mapping are live today. Formal certifications are on the roadmap and labeled honestly.
How to read this page
Two words do a lot of work in vendor questionnaires, so we are precise about them. Aligned and mapped mean a specific DataShield mechanism satisfies a specific control, and we can show you how. Certified means an accredited third party has attested to it. We are not SOC 2 or ISO 27001 certified yet, and you will not see those words presented as done anywhere on this site. What we can offer today is something most vendors cannot: an audit trail you verify yourself, rather than one you take on trust.
How the mechanisms map to the regulations
HIPAA Security Rule
§164.312(b) audit controls map to the SHA-256 hash chain with Ed25519-signed checkpoints. §164.312(a) access control maps to per-tool-call authorization with mid-session revocation. §164.514 de-identification maps to tokenization at ingest and k-anonymity generalization. A BAA conversation is welcome; healthcare deployments are why the data plane exists.
EU AI Act
Article 12 automatic, lifetime event logging maps to the tamper-evident audit chain, with Guardian keeping the evidence plane available so gaps stay bounded and visible. Article 26(6) six-month retention maps to retention you control. This is engineering and compliance mapping, not legal advice.
GDPR
Article 17 erasure maps to crypto-shred: destroy a subject's key and re-identification becomes impossible while the audit chain still verifies. EDPB Opinion 28/2024 names pseudonymization as a mitigation, which is the reversible-tokenization pattern DataShield implements, as opposed to one-way redaction that destroys data for every downstream use.
Certification status, stated honestly
SOC 2 Type II
On the roadmap, not yet started. Our interim position: the audit chain is independently verifiable by you, which is a stronger property for evidence integrity than an annual attestation of our org chart. We know procurement still needs the report, and it is on the roadmap.
Penetration testing
Internal adversarial reviews are part of every release, with findings tracked to closure. A published third-party assessment of the audit-chain claims is planned. We will not describe the product as externally pen-tested until it is.
What we will not claim early
Nothing appears on this site before it is true, which is the same discipline our messaging went through. If you see a certification badge here, it will link to the report.
Key custody and deployment
You hold the keys
In self-hosted and VPC deployments, tokenization (HMAC) and audit-signing (Ed25519) keys live in your KMS or HSM. Deterministic tokens are a linkability oracle if the key leaks, so key custody is a first-class deployment topic, not a footnote. Signing runs through a KMS/HSM choke point with kid-rotated keys and fail-closed verification.
Where it runs
Self-hosted or in your VPC, with your keys. The evidence stays in your control, and the audit chain is verifiable independently of us, which is the point: you should not have to trust the vendor being audited.
Source escrow
Regulated-industry design partnerships include a source-escrow option and direct engineering access, a real answer to the honest question of whether an early-stage vendor will exist in three years.
Questions a vendor-risk team will ask
The short, honest answers. The Trust Center has the long ones.
Are you SOC 2 certified?
Not yet. SOC 2 Type II is planned, not yet started. In the meantime, the audit chain is independently verifiable by you, and design partnerships include source escrow. We do not display a badge we have not earned.
Can you prove your logs were not altered?
Yes, and you can check it without us. The audit trail is a SHA-256 hash chain with chained Ed25519-signed checkpoints; verification distinguishes tampering, insertion, deletion, and truncation. Verify a sample chain yourself at /verify.
Who holds the encryption and signing keys?
You do, in your KMS or HSM, for self-hosted and VPC deployments. GDPR erasure works by destroying per-subject keys, and backups of key material follow the same custody rules or the erasure is theater, which we document during deployment.
How do we get the full detail?
Request Trust Center access. It sits behind a mutual NDA and covers the threat model, control-by-control mappings, key management, incident response, and the adversarial questions in full. It is invitation-only, not public.
The full detail lives in the Trust Center, behind an NDA. Control mappings, threat model, key management, and the hard questions answered in full.
Request Trust Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →