Compliance
Regulatory alignment documentation for Hoziron deployments.
Status
Hoziron does not hold a third-party compliance certification or completed audit (SOC 2, ISO 27001, or otherwise) today. This section documents the technical controls the platform provides that support a carrier's own compliance program — it is not a substitute for your compliance or legal team's own assessment, and it makes no certification claims.
Core controls already implemented:
- Audit trail — Tamper-evident, Merkle-hash-chained log of every authenticated API operation, independently re-verifiable via
GET /security/verify(guide) - Compliance evidence engine (ADR-018) — Pluggable policy packs (built-in POPIA, plus any carrier-supplied pack) continuously evaluated against the live audit log, generating on-demand JSON/PDF evidence reports per control — see API reference
- PII policy engine — Deny-by-default tokenization at agent boundaries; hydration to real values requires an explicit, operator-authored rule in a single carrier-owned policy file, not an agent-level setting (internals)
- Data sovereignty — All state stored locally (SQLite), configurable provider routing, and air-gapped deployment using local models only
- RBAC — Role-based access control (five roles), API keys with expiration and per-IP brute-force backoff (guide)
- Credential vault — Provider API keys and other secrets encrypted at rest (AES-256-GCM, per-entry salt/nonce)
- Network controls — Optional native TLS termination, IP/CIDR allowlisting, and CORS configuration on the server surface
Planned coverage
| Framework | Status | Document |
|---|---|---|
| GDPR | Technical controls documented; no certification | gdpr.md |
| POPIA | Technical controls documented; no certification | popia.md |
| SOC 2 | Technical controls documented; no audit completed | soc2.md |
| HIPAA | Not yet assessed | — |
What's available today
Even without formal compliance certification, the platform provides technical controls relevant to regulated environments:
- Enable the audit trail for tamper-evident activity logging
- Configure authentication and RBAC for access control
- Use air-gapped deployment for data residency requirements
- Review the hardening checklist for a security baseline
Each framework page below describes what a control does mechanically, not what it proves — mapping these controls to a specific regulatory obligation is the carrier's own assessment to make.
Related: