This page tells you exactly what is true today, what is on the roadmap, and what is your responsibility. We hold no compliance certifications at this time. We will tell you when that changes.
ASE holds no HIPAA, SOC 2, PCI-DSS, or HITRUST certifications. No third-party audit is currently engaged. ASE provides architectural controls that support compliance work — traceability, tamper-evident records, and policy enforcement. Whether those controls satisfy your regulatory obligations depends on your deployment, configuration, and legal context. If you have compliance questions specific to your environment, contact us directly.
These controls exist in the codebase and are verifiable. No claims beyond what is implemented.
Agent actions are signed with HMAC receipts at execution time. The signature binds the action payload to the approval record, providing non-repudiation evidence. Implemented in agentic_platform/ops_store.py and verifiable in the codebase.
Verified in code — committed
Every action executed through the agent platform is logged to a persistent SQLite store with retry tracking and dead-letter capture for failed actions. Provides a sequential, queryable record of what the system did and when.
Verified in code — committed
A manifest-driven policy enforcer classifies every action as green (auto-execute), yellow (requires approval), or red (blocked). No action executes without passing the policy gate. Implemented in agentic_platform/policy_enforcer.py.
Verified in code — committed
Yellow-class actions require explicit human approval before execution. Pending approvals are persisted and cannot be bypassed by the worker. Approvals are recorded with timestamps and signed receipts.
Verified in code — committed
These are things a prior version of this page stated. They were not true. They have been removed.
PHI auto-redaction with 844 patterns tested, 0% leakage — no test artifact exists
AES-256 encryption at rest — not implemented in this codebase
TLS 1.3 in transit as an ASE feature — this is Netlify infrastructure, not ASE
SOC 2 Type II audit in progress — no auditor is engaged
HIPAA Self-Verified status — no such recognized status exists
PCI-DSS Self-Verified status — not a recognized PCI-DSS standing
HITRUST certification process beginning Q4 2026 — not planned or engaged
ASE provides governance infrastructure. Compliance with any regulatory framework — HIPAA, SOC 2, PCI-DSS — requires your deployment decisions, configuration choices, legal review, and operational controls. ASE does not make you compliant. It gives you infrastructure that compliance work can build on.
These are aspirations, not commitments. Dates will be updated when engagements are signed.
If you are evaluating ASE for a regulated environment, tell us your requirements directly. We will tell you plainly what fits and what does not.
Contact Us