HASP and SOC 2

HASP runs on a managed compliance substrate that holds a current SOC 2 Type II report covering the underlying infrastructure, network, and operational controls HASP inherits. HASP does not yet hold its own direct SOC 2 attestation — that engagement is planned and is described in detail on this page. Customers requiring formal evidence today receive the substrate's SOC 2 Type II report (substrate layer) plus HASP's signed control matrix (application layer) under mutual NDA.

The substrate report HASP inherits from is a SOC 2 Type II report. When HASP's own engagement begins, the plan is to skip Type I entirely and pursue a Type II observation window directly — there is no business reason to publish a Type I given that the substrate is already Type II and HASP's application-layer controls have been operating continuously since launch.

HASP does not yet have a direct SOC 2 report to share. We can share the compliance substrate's SOC 2 Type II report under a mutual NDA. Email [email protected] and reference your evaluation. We can also share HASP's signed control matrix mapping each Trust Services Criterion to the responsible owner (HASP, the substrate, or shared).

The substrate's SOC 2 Type II covers Security, Availability, and Confidentiality at the substrate layer. When HASP pursues a direct attestation, the planned scope is the same three criteria for the V1 audit, with Privacy added in a subsequent cycle once the multi-tenant Privacy controls mapped to GDPR / CCPA enforcement are old enough to observe over a Type II window. Processing Integrity is not currently planned — HASP does not perform transactional processing.

The substrate's SOC 2 Type II is performed by a registered CPA firm; the auditor of record is named on the cover of the report itself, which we share under NDA. HASP has not yet selected an audit firm for its direct engagement — auditor selection is part of the engagement kickoff, which is timed to the trigger described below.

The substrate's SOC 2 Type II covers a rolling twelve-month observation window and is re-issued annually. The most recent report and bridge letter (if any) are both available under NDA. Once HASP's direct engagement begins, our intent is to maintain the same annual cadence with a continuous controls baseline — meaning we operate the controls every day, not only during the observation window.

HASP's direct SOC 2 engagement is triggered by whichever comes first: reaching $100K ARR, or signing the first enterprise contract that requires a HASP-direct attestation. A Type II observation window typically runs six to twelve months, so a first report is realistically nine to fifteen months after engagement start. We will not publish a placeholder Type I to shortcut that timeline.

The compliance substrate is the managed hosting platform HASP is built on. The substrate is responsible for the physical and logical security of the cloud environment HASP runs in: data-center security, network segmentation, host hardening, vulnerability scanning, intrusion detection, backup integrity, and incident response at the infrastructure layer. Those controls are evidenced in the substrate's SOC 2 Type II. HASP inherits them and does not duplicate them. The control matrix we share calls out, line by line, which controls are inherited, which are HASP-owned, and which are shared.

When HASP's direct SOC 2 audit begins, the major sub-processors — the compliance substrate, BAA-covered inference providers, and edge/CDN providers — will be in scope with the controls each one carries described in the eventual report. The current sub-processor register is published at /sub-processors and is governed by the 30-day advance-notice commitment.

Encryption in transit (TLS) and at rest (AES-256) are described in the SOC 2 control matrix. FIPS 140-3 module references — including the validated modules used by the compliance substrate and edge provider in HASP's chain — are documented separately at /trust/fips-modules so they can be cited in CAIQ and HECVAT questionnaires without depending on the SOC 2 report itself.