Compliance - Hexr

Compliance Readiness

Framework	Status	Key Controls
SOC 2 Type II	Architecture ready	Encryption at rest, audit logging, access controls
GDPR	Architecture ready	Data isolation per tenant, encryption, right to deletion
HIPAA	Architecture ready	PHI isolation, audit trails, encryption
FedRAMP	Self-hosted air-gapped	Air-gapped deployment, FIPS-compatible cryptography

Key Controls

Encryption

Data State	Method
In transit	mTLS (SPIFFE SVIDs) — all service-to-service communication
At rest (secrets)	AES-256-GCM (Hexr Vault)
At rest (database)	PostgreSQL with storage-level encryption
At rest (cache)	Valkey in-cluster only (no external access)

Access Control

Control	Implementation
Identity	SPIFFE per-process identity (no shared credentials)
Authentication	mTLS + API key authentication
Authorization	OPA policies at every service boundary
Tenant isolation	Kubernetes namespace isolation
Data isolation	SPIFFE-scoped secret access

Audit

Audit Capability	Implementation
Request logging	Every request traced via OpenTelemetry
Credential access	Every STS exchange logged with SPIFFE ID
Secret access	Every Vault read/write logged
LLM interactions	Every prompt/response logged (configurable)
Configuration changes	Kubernetes audit logging

Air-Gapped Deployment

For FedRAMP and classified environments, Hexr supports fully air-gapped deployment:

All container images pre-loaded into a private registry
No external network dependencies at runtime
SPIRE operates with private trust domain
See Air-Gapped Deployment for setup