Compliance

What ASE Provides.
What It Does Not.

This page tells you exactly what is true today, what is on the roadmap, and what is your responsibility. We hold no compliance certifications at this time. We will tell you when that changes.

Current certification status

ASE holds no HIPAA, SOC 2, PCI-DSS, or HITRUST certifications. No third-party audit is currently engaged. ASE provides architectural controls that support compliance work — traceability, tamper-evident records, and policy enforcement. Whether those controls satisfy your regulatory obligations depends on your deployment, configuration, and legal context. If you have compliance questions specific to your environment, contact us directly.

What ASE Provides Today

These controls exist in the codebase and are verifiable. No claims beyond what is implemented.

Tamper-evident action receipts

Agent actions are signed with HMAC receipts at execution time. The signature binds the action payload to the approval record, providing non-repudiation evidence. Implemented in agentic_platform/ops_store.py and verifiable in the codebase.

Verified in code — committed

Action audit log with dead-letter queue

Every action executed through the agent platform is logged to a persistent SQLite store with retry tracking and dead-letter capture for failed actions. Provides a sequential, queryable record of what the system did and when.

Verified in code — committed

Policy-gated action execution

A manifest-driven policy enforcer classifies every action as green (auto-execute), yellow (requires approval), or red (blocked). No action executes without passing the policy gate. Implemented in agentic_platform/policy_enforcer.py.

Verified in code — committed

Human-in-the-loop approval gates

Yellow-class actions require explicit human approval before execution. Pending approvals are persisted and cannot be bypassed by the worker. Approvals are recorded with timestamps and signed receipts.

Verified in code — committed

What ASE Does Not Claim

These are things a prior version of this page stated. They were not true. They have been removed.

PHI auto-redaction with 844 patterns tested, 0% leakage — no test artifact exists

AES-256 encryption at rest — not implemented in this codebase

TLS 1.3 in transit as an ASE feature — this is Netlify infrastructure, not ASE

SOC 2 Type II audit in progress — no auditor is engaged

HIPAA Self-Verified status — no such recognized status exists

PCI-DSS Self-Verified status — not a recognized PCI-DSS standing

HITRUST certification process beginning Q4 2026 — not planned or engaged

Shared Responsibility

ASE provides governance infrastructure. Compliance with any regulatory framework — HIPAA, SOC 2, PCI-DSS — requires your deployment decisions, configuration choices, legal review, and operational controls. ASE does not make you compliant. It gives you infrastructure that compliance work can build on.

ASE Provides
Your Responsibility
Tamper-evident action receipts (HMAC-signed)
Define which actions require audit trails
Policy-gated execution with approval gates
Configure policy manifest for your risk model
Dead-letter queue for failed action traceability
Monitor and respond to DLQ events
Sequential, queryable action log
Determine retention requirements for your jurisdiction
Governed execution layer
Legal review of compliance posture for your use case

Compliance Roadmap

These are aspirations, not commitments. Dates will be updated when engagements are signed.

SOC 2 Type II— Not yet engaged. Target: when first enterprise customer requires it.
Third-party PHI redaction testing— Not yet conducted. Will be published publicly when complete.
Encryption at rest— On the technical roadmap. Not yet implemented.

Have compliance requirements to discuss?

If you are evaluating ASE for a regulated environment, tell us your requirements directly. We will tell you plainly what fits and what does not.

Contact Us