Compliance

Compliance Readiness

Framework	Status	Key Controls
SOC 2 Type II	Architecture ready	Encryption at rest, audit logging, access controls
GDPR	Architecture ready	Data isolation per tenant, encryption, right to deletion
HIPAA	Architecture ready	PHI isolation, audit trails, encryption
FedRAMP	Roadmap — air-gap not yet available	Intended: air-gapped deployment, FIPS-compatible cryptography

Key Controls

Encryption

Data State	Method
In transit	mTLS (SPIFFE SVIDs) — all service-to-service communication
At rest (secrets)	AES-256-GCM (Hexr Vault)
At rest (database)	PostgreSQL with storage-level encryption
At rest (cache)	Valkey in-cluster only (no external access)

Access Control

Control	Implementation
Identity	SPIFFE per-process identity (no shared credentials)
Authentication	mTLS + API key authentication
Authorization	OPA policies at every service boundary
Tenant isolation	Kubernetes namespace isolation
Data isolation	SPIFFE-scoped secret access

Audit

Audit Capability	Implementation
Request logging	Every request traced via OpenTelemetry
Credential access	Every STS exchange logged with SPIFFE ID
Secret access	Every Vault read/write logged
LLM interactions	Every prompt/response logged (configurable)
Configuration changes	Kubernetes audit logging

Air-Gapped Deployment

Roadmap, not available today. The current focus is the hybrid model: the data plane in your cluster, a thin control plane for licensing. The chart already accepts cloud.enabled=false with an offline licence, so a data plane can run without reaching api.hexr.cloud. What is missing is in-cluster delivery of framework signature packs, which are fetched over HTTPS. An air-gapped cluster would be frozen on whichever packs shipped in its SDK wheel. Do not plan a FedRAMP or classified deployment around this yet. See Air-Gapped Deployment for the intended design, and talk to us first.

Getting Started

Self-Hosted Deployment

Architecture

Security & Compliance

Compliance Readiness

Key Controls

Encryption

Access Control

Audit

Air-Gapped Deployment

​Compliance Readiness

​Key Controls

​Encryption

​Access Control

​Audit

​Air-Gapped Deployment

Compliance Readiness

Key Controls

Encryption

Access Control

Audit

Air-Gapped Deployment