HASP and SOC 2

Yes. HASP maintains its own SOC 2 Type II attestation covering the platform's application-layer controls, with controls continuously validated through third-party compliance monitoring. The report and current bridge letter are available under mutual NDA. In addition, the managed compliance substrate HASP runs on carries its own SOC 2 Type II covering the underlying infrastructure, network, and operational controls HASP inherits — customers receive both reports plus HASP's signed control matrix under mutual NDA.

Type II. HASP's attestation is a SOC 2 Type II — controls tested over an observation window, not a point-in-time snapshot. The substrate report HASP inherits at the infrastructure layer is also a Type II.

Yes — under mutual NDA. Email [email protected] and reference your evaluation. You receive HASP's SOC 2 Type II report and current bridge letter, the compliance substrate's SOC 2 Type II report for the infrastructure layer, and HASP's signed control matrix mapping each Trust Services Criterion to the responsible owner (HASP, the substrate, or shared).

HASP's SOC 2 Type II covers Security, Availability, and Confidentiality. Privacy is planned for a subsequent cycle once the multi-tenant Privacy controls mapped to GDPR / CCPA enforcement are old enough to observe over a Type II window. Processing Integrity is not planned — HASP does not perform transactional processing. The substrate's report covers the same three criteria at the substrate layer.

HASP's SOC 2 Type II is performed by a registered CPA firm; the auditor of record is named on the cover of the report itself, which we share under NDA. The substrate's report likewise names its own auditor of record on its cover.

Annually, over a rolling observation window, with a continuous controls baseline in between — controls are validated continuously through third-party compliance monitoring, not only during the observation window. The most recent report and bridge letter are both available under NDA. The substrate's SOC 2 Type II is re-issued annually on the same model.

Both exist, and you can request both. HASP holds its own SOC 2 Type II attestation covering the application layer — the gateway, identity model, audit chain, and PHI handling. The compliance substrate holds a separate SOC 2 Type II covering the infrastructure layer. The control matrix we share maps every criterion to its owner so your auditor can trace each control to the responsible party.

The compliance substrate is the managed hosting platform HASP is built on. The substrate is responsible for the physical and logical security of the cloud environment HASP runs in: data-center security, network segmentation, host hardening, vulnerability scanning, intrusion detection, backup integrity, and incident response at the infrastructure layer. Those controls are evidenced in the substrate's SOC 2 Type II. HASP inherits them and does not duplicate them. The control matrix we share calls out, line by line, which controls are inherited, which are HASP-owned, and which are shared.

The major sub-processors — the compliance substrate, BAA-covered inference providers, and edge/CDN providers — are addressed in the report, with the controls each one carries described. The current sub-processor register is published at /sub-processors and is governed by the 30-day advance-notice commitment.

Encryption in transit (TLS) and at rest (AES-256) are described in the SOC 2 control matrix. FIPS 140-3 module references — including the validated modules used by the compliance substrate and edge provider in HASP's chain — are documented separately at /trust/fips-modules so they can be cited in CAIQ and HECVAT questionnaires without depending on the SOC 2 report itself.