Skip to content

COMPLIANCE · POSTURE

Compliance, stated honestly.

If your security or procurement team is evaluating HYVE Ether OS, this is where every framework stands — written plainly, with no certification claimed that we don't hold. For the full cryptographic posture, our security principles, and our responsible- disclosure policy, see the Security page.

Note: "HIPAA certified" and "SOC 2 certified" badges from vendors who haven't completed the work are a red flag. We'd rather show you exactly where we are.

SHARED RESPONSIBILITY

Yours vs. ours.

Because HYVE Ether OS runs on your hardware with zero vendor access, the line is unusually clean: you remain the data controller; we are responsible for the software, not your data.

You

DATA CONTROLLER · COVERED ENTITY

  • All data created, stored, and processed inside the OS — it lives on your hardware; conversations, memory and keys are stored as files only your user account can read, not encrypted at rest (we recommend full-disk encryption)
  • Operator access control, provisioning, and authentication policy
  • Your regulatory duties — HIPAA Covered Entity, GDPR controller, and breach determination for your data
  • Physical security of the devices running HYVE
  • What you choose to connect to, download, or share off-device

HYVE

SOFTWARE VENDOR · VIBE SOFTWARE SOLUTIONS

  • Secure development (SDLC), code review, and supply-chain integrity
  • Signed packages — Ed25519-verified by the Depot when you import them (installed systems do not update automatically yet)
  • Vulnerability management and responsible disclosure — fixes ship in new releases
  • The cryptographic architecture — local-first and zero-access by design (HYVE's design uses ML-KEM-768 post-quantum key exchange; it is not yet in the shipped build)
  • Processing of commercial data only — purchase, license registration, support
  • Control mappings and SOC 2 (audit planned)

By default there is no shared data plane: your AI runs on your machine, and the OS registers your license once and sends no telemetry, so the data you'd normally split responsibility for in a cloud/SaaS model never reaches us.

COMPLIANCE · FRAMEWORKS

Compliance & frameworks.

Honest status, stated plainly — we list where each framework actually stands, never a badge we haven't earned. The throughline: because your AI runs on your own hardware and the OS sends no telemetry (it contacts us once, to register your license), most regulated data never reaches us, which shrinks the scope of every framework below. One exception: questions typed into this website's support assistant are sent to Anthropic, so do not type health or other regulated data there.

SOC 2 Type II

Controls mapped · audit planned

Our controls are mapped to the AICPA Trust Services Criteria (Security, Availability, Confidentiality), and a formal independent CPA audit is planned. We are not yet certified — the report and bridge letters will be published here the moment they are issued. Under NDA, prospects can request our current control mapping and security package today.

HIPAA

Aligned · BAA case by case

HIPAA has no 'certification' — what's real is the architecture and, where one is needed, a signed Business Associate Agreement. Health data you process with the OS stays on your machine. Do not type health data into this website's support assistant, which sends questions to Anthropic. The OS is built to support the HIPAA Security Rule safeguards — access control, audit controls, integrity, and transmission security. BAA requests are reviewed case by case; no standard agreement is published yet.

GDPR & CCPA

Aligned · DPA case by case

Data minimization and residency are the default: your data stays on your device, so for most deployments the only personal data HYVE processes is your purchase, license-registration and support data. DPA requests are reviewed case by case; no standard agreement is published yet. Our sub-processor list is provided on request.

ISO/IEC 27001

Controls mapped · on roadmap

Our information-security controls map to the ISO/IEC 27001 Annex A control families. Formal certification through an accredited body is on our roadmap, pursued in parallel with SOC 2 based on customer demand.

FedRAMP · CMMC · NIST 800-53

Control mappings available

For public-sector and defense procurement, HYVE provides read-only control mappings (NIST 800-53 / CMMC families). A phased federal-hardening installer for the OS is planned. We do not claim an authorization we don't hold — engage us for a controls package and the path that fits your ATO.

FOR PROCUREMENT & SECURITY TEAMS

Request our security package

We provide our control mapping and our sub-processor list. BAA/DPA requests are reviewed case by case; no standard agreement is published yet. HYVE Ether OS also ships an in-product Compliance module that maps live OS controls to framework requirements on your own deployment.

Email Dev@vibesoftwaresolutions.com with your framework and timeline.

FULL SECURITY POSTURERequest Beta Access