> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hexr.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance Frameworks

> How Hexr maps to FFIEC, SOC 2, HIPAA §164.312, NIST 800-53, FedRAMP IL5, CMMC L3, and EU AI Act — with signed evidence rows your auditor can verify.

## Evidence-First Compliance

Hexr doesn't just claim compliance — it produces signed evidence rows in your own Postgres that map every agent action to a named control. When your auditor asks what your AI agents did last Tuesday, `hexr audit` generates a signed PDF with the answer.

Evidence stays in your cluster. Nothing is sent to Hexr's infrastructure.

***

## Buyer Ring → Framework Mapping

| Buyer Ring                        | Frameworks                          | Hexr Answer                                                                                           |
| --------------------------------- | ----------------------------------- | ----------------------------------------------------------------------------------------------------- |
| **Ring 1** — Multi-cloud finserv  | FFIEC, SEC, FINRA, SOC 2 Type II    | Per-process SPIFFE + OPA deny logged with policy version + signed evidence rows in customer Postgres  |
| **Ring 2** — Regulated healthcare | HIPAA §164.312 Technical Safeguards | BYO Vault PKI (Mode B) — zero cloud CA involvement, PHI never crosses VPC boundary, BAA-compatible    |
| **Ring 3** — Defense / govtech    | FedRAMP IL5, ITAR, CMMC L3          | Air-gapped Mode C — no internet egress, customer-owned root CA, FIPS-compatible crypto                |
| **Ring 4** — AmLaw 100 + Big-4    | Client data jurisdiction            | Cross-cluster A2A mTLS with federated SPIFFE — full delegation chain in evidence, no data co-mingling |

***

## Framework Mapping

### SOC 2 Type II

| Control                        | Hexr Implementation                               | Evidence Row Field                             |
| ------------------------------ | ------------------------------------------------- | ---------------------------------------------- |
| **CC6.1** Logical Access       | SPIFFE per-process identity + OPA policies + mTLS | `spiffe_id`, `policy_result`, `policy_version` |
| **CC6.2** User Authentication  | X.509 SVIDs (5-min TTL, auto-rotate)              | `spiffe_id`, `svid_serial`                     |
| **CC6.3** Access Authorization | OPA Rego per-process, fail-closed                 | `policy_result=DENY/ALLOW`, `rego_rule`        |
| **CC7.1** Monitoring           | OTel traces + Prometheus metrics                  | `trace_id`, `span_id`                          |
| **CC7.2** Incident Response    | Audit log, credential revocation                  | Full evidence row, immutable                   |
| **CC8.1** Change Management    | `hexr build` reproducible artifacts               | `build_hash`, `manifest_version`               |

### HIPAA §164.312 Technical Safeguards

| Safeguard             | Standard       | Hexr Implementation                                                          |
| --------------------- | -------------- | ---------------------------------------------------------------------------- |
| Access control        | §164.312(a)(1) | SPIFFE identity + OPA — every PHI-touching call requires a valid SVID        |
| Audit controls        | §164.312(b)    | Signed evidence row per agent action, stored in customer Postgres            |
| Integrity             | §164.312(c)(1) | AES-256-GCM at rest (Vault), mTLS in transit, evidence rows signed           |
| Transmission security | §164.312(e)(1) | TLS 1.3 + mTLS everywhere, no plaintext paths                                |
| PHI boundary          | BAA scope      | Mode B: your Vault PKI signs the intermediate CA — zero cloud CA involvement |

### NIST 800-53 (FedRAMP)

| Control Family                           | Hexr Implementation                                       |
| ---------------------------------------- | --------------------------------------------------------- |
| **AU-2** Auditable Events                | Every agent action → evidence row with `control=AU-2` tag |
| **AU-9** Protection of Audit Information | Evidence rows immutable, signed with agent SVID           |
| **IA-2** Identification & Authentication | SPIFFE X.509-SVID per process                             |
| **SC-8** Transmission Confidentiality    | mTLS (TLS 1.3) on all service-to-service paths            |
| **SC-28** Protection at Rest             | AES-256-GCM (Vault), customer-managed key                 |
| **SI-3** Malicious Code Protection       | OPA deny on unattested processes — no SVID, no tool call  |

### FFIEC (Multi-Cloud Finserv)

| Requirement                                    | Hexr Implementation                                                   |
| ---------------------------------------------- | --------------------------------------------------------------------- |
| Vendor concentration risk (§500.11 equivalent) | Cloud-agnostic — same evidence row format on AWS, GCP, Azure, on-prem |
| Per-process attestation                        | `hostPID` DaemonSet attests every subprocess at node level            |
| Audit trail                                    | Signed evidence rows in customer Postgres — not a vendor SaaS log     |
| Cryptographic key custody                      | Mode B: customer Vault PKI holds the intermediate CA private key      |

### EU AI Act

| Obligation                    | Hexr Implementation                                         |
| ----------------------------- | ----------------------------------------------------------- |
| Logging & traceability        | OTel spans + evidence rows per agent action                 |
| Human oversight               | OPA policies with human-reviewable Rego, GitOps audit trail |
| Risk management documentation | `hexr audit` PDF maps actions to control framework          |
| Data governance               | Evidence stays in customer VPC, no cross-border transfers   |

***

## Generating the Auditor PDF

```bash theme={null}
hexr audit \
  --framework soc2,hipaa,nist \
  --start 2026-01-01 \
  --end 2026-03-31 \
  --output q1-audit-report.pdf
```

The PDF includes:

* Every agent action in the date range
* SPIFFE identity of the process that triggered it
* OPA policy result (ALLOW/DENY) and policy version
* Compliance control it maps to
* Cryptographic signature for tamper evidence

***

## Encryption Summary

| Data               | Method                                                |
| ------------------ | ----------------------------------------------------- |
| In transit         | mTLS (SPIFFE SVIDs, TLS 1.3) — all service-to-service |
| At rest (secrets)  | AES-256-GCM (Hexr Vault, customer Postgres)           |
| At rest (evidence) | Customer Postgres with storage-level encryption       |
| In cache           | Valkey in-cluster only — no external access           |

***

## Key Controls

### Encryption

| Data State         | Method                                                     |
| ------------------ | ---------------------------------------------------------- |
| In transit         | mTLS (SPIFFE SVIDs) — all service-to-service communication |
| At rest (secrets)  | AES-256-GCM (Hexr Vault)                                   |
| At rest (database) | PostgreSQL with storage-level encryption                   |
| At rest (cache)    | Valkey in-cluster only (no external access)                |

### Access Control

| Control          | Implementation                                      |
| ---------------- | --------------------------------------------------- |
| Identity         | SPIFFE per-process identity (no shared credentials) |
| Authentication   | mTLS + API key authentication                       |
| Authorization    | OPA policies at every service boundary              |
| Tenant isolation | Kubernetes namespace isolation                      |
| Data isolation   | SPIFFE-scoped secret access                         |

### Audit

| Audit Capability      | Implementation                              |
| --------------------- | ------------------------------------------- |
| Request logging       | Every request traced via OpenTelemetry      |
| Credential access     | Every STS exchange logged with SPIFFE ID    |
| Secret access         | Every Vault read/write logged               |
| LLM interactions      | Every prompt/response logged (configurable) |
| Configuration changes | Kubernetes audit logging                    |

***

## Framework Mapping

### SOC 2 Type II

| Control Area                   | Hexr Implementation                                               |
| ------------------------------ | ----------------------------------------------------------------- |
| **CC6.1** Logical Access       | SPIFFE identity, OPA policies, mTLS                               |
| **CC6.2** User Authentication  | SPIFFE SVIDs (X.509), API key authentication                      |
| **CC6.3** Access Authorization | OPA per-process policies, role-based scoping                      |
| **CC6.6** System Boundaries    | Kubernetes namespaces, Firecracker microVMs                       |
| **CC7.1** Monitoring           | OpenTelemetry traces, Prometheus metrics                          |
| **CC7.2** Incident Response    | Audit logs, credential revocation                                 |
| **CC8.1** Change Management    | `hexr build` reproducible artifacts, `hexr audit` drift detection |

### NIST AI Risk Management Framework

| Function    | Hexr Implementation                                           |
| ----------- | ------------------------------------------------------------- |
| **GOVERN**  | Tenant isolation, role-based access, API key management       |
| **MAP**     | `hexr build` AST analysis maps all agent capabilities         |
| **MEASURE** | OpenTelemetry metrics, cost attribution, LLM Guard statistics |
| **MANAGE**  | Dashboard, OPA policies, credential rotation, audit trail     |

### GDPR

| Requirement       | Hexr Implementation                     |
| ----------------- | --------------------------------------- |
| Data minimization | Per-process credential scoping          |
| Encryption        | AES-256-GCM (vault), mTLS (transit)     |
| Access controls   | SPIFFE identity + OPA policies          |
| Audit trail       | OpenTelemetry traces on every operation |
| PII protection    | LLM Guard PII scanner                   |

### HIPAA

| Safeguard             | Hexr Implementation                     |
| --------------------- | --------------------------------------- |
| Access controls       | SPIFFE + OPA + namespace isolation      |
| Audit controls        | OpenTelemetry, Loki logs                |
| Transmission security | mTLS everywhere                         |
| Encryption            | AES-256-GCM at rest, TLS 1.3 in transit |