SECURITY & COMPLIANCE
SOC 2 (In Progress) — 100% (58/58 requirements · 183 controls) via Drata. Every policy, control artifact, and compliance document — searchable and downloadable. Built on NIST FIPS 203/204/205 standards.
MOST REQUESTED
CERTIFICATION ROADMAP
Active certifications and planned milestones for H33 security compliance.
HIPAA COMPLIANCE
H33 protects PHI with post-quantum cryptography. Every health data field is encrypted with Kyber-1024, computed on with FHE, and audited with Dilithium-signed immutable logs.
Risk assessment, treatment plan, and continuous monitoring via Drata. SOC 2 (In Progress) certified with 116 controls.
Unique user identification, session timeout, AES-256/Kyber-1024 encryption at rest. FHE enables computation without decryption.
Immutable append-only audit logs with SHA3-256 chain hashing. PHI field-level access tracking. 7-year retention.
TLS 1.2/1.3 on all connections. Kyber-1024 + AES-256-GCM hybrid encryption for harvest-now-decrypt-later resistance.
All RDS instances and S3 buckets KMS-encrypted. EBS default encryption. Field-level Kyber-1024 for PHI via H33-Health.
Automated daily backups with KMS encryption. Multi-AZ RDS deployment. Point-in-time recovery on all production databases.
ISO 27001 COMPLIANCE
H33 is building its ISMS on SOC 2 (In Progress) certification, post-quantum cryptography, and continuous compliance monitoring via Drata and AWS Security Hub.
Documented information security policy, roles, responsibilities, and segregation of duties via Drata policy framework.
IAM policies, MFA enforcement, 14-char password minimums, 90-day rotation, and role-based FHE permissions.
Kyber-1024 key encapsulation, Dilithium signatures, AES-256-GCM symmetric encryption. All KMS keys with annual rotation.
CloudTrail (multi-region, KMS-encrypted), VPC flow logs, GuardDuty, AWS Config continuous recording, immutable audit logs.
VPC network segmentation, locked default security groups, TLS 1.2/1.3, nginx rate limiting, IAM Access Analyzer.
Incident response plan with severity classification, escalation procedures, SNS alerting, and 14 CIS benchmark alarms.