Build HIPAA-compliant AI
on a regulated substrate.
Use HASP as the HIPAA-compliant foundation for your AI products, agents, and workflows. Identity, policy, audit, compliance, and PHI handling — handled at the gateway, so you can focus on your product.
Two entry points. One governed substrate.
Whether you're integrating AI into an existing product or building autonomous agents, every call inherits identity, policy, audit, and PHI handling.
Public API
Embed HIPAA-compliant AI into your existing products and systems. PHI redaction and a full audit trail enforced at the gateway.
API docs →Agent SDK
Build agents that can act under scoped, revocable authority. Every tool invocation authorized, identity-scoped, and recorded.
SDK reference →Agent Identity & Delegated Authorization
Agents as first-class identities. OAuth 2.1 + Rich Authorization Requests for scoped, auditable, revocable agent permissions. Includes the standards-aligned A2A protocol.
A2A protocol →PHI Handling
PHI detection, redaction, and de-identification at the gateway. Configurable per-org. No PHI leaves your governed perimeter without policy approval.
Trust center →Rules before action. Not after the fact.
Every API call and agent tool invocation passes through the policy engine before execution. Define rules per-org, per-surface, per-agent. Denials are logged with full context.
- Authenticate caller (User / ApiKey / Agent)
- Resolve org context and permissions
- Evaluate policy rules
- Scan for PHI — redact or block
- Route to inference provider
- Sign response to audit chain
Every action recorded. Every record verifiable.
Hash-chained, Ed25519 signed, RFC 3161 anchored. Customers download the chain as plain JSON and verify it independently — no HASP software required.
Audit architecture →Five components. Inherited by every surface.
The substrate is not a product you configure — it's the governed layer that every surface inherits. Build on any surface; the substrate ensures compliance, policy, and audit automatically.
Start building
Governed AI,
ready on day one.
Request API access, explore the SDK, or book a technical walkthrough. Every surface inherits identity, policy, audit, and PHI handling at the gateway.
No commitment required.