hanzoai/esign
2
0
Fork 0
mirror of https://github.com/hanzoai/sign.git synced 2026-10-21 01:21:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

Say what Sign's compliance actually is, on the page that states it

Browse Source 
certclaims flagged five lines on the compliance page and they were three
different problems:

A CLAIM. The status table and its callout both said SOC 2 was "Certification
scoped per engagement" — a certificate, conditioned. They now say compliant with
the Type II control set, which is what the section below already described:
encryption in transit and at rest, RBAC, audit logging.

TWO HEDGES. ISO 27001 and HIPAA were "Planned". A hedge reads as a claim to
anyone skimming and dates itself the day it ships. They now say controls aligned,
with a BAA on request for HIPAA — the thing a buyer can actually act on.

A FALSE POSITIVE, fixed without weakening the rule. The definition of SOC 2
tripped on "American Institute of Certified Public Accountants" — the auditor
body's own name, beside the framework name. The acronym says the same thing, so
the sentence reads "established by the AICPA" and the gate stays as strict as it
was. Narrowing the rule to let this through would have let real claims through
too.

And the sentence this shares with bootnode: "Formal certification — SOC 2 Type
II, ISO 27001, HIPAA with a BAA — is scoped per enterprise engagement" now offers
what is on the table instead of a certificate that is not.

Nothing about the security posture changed. Only the sentences describing it.

Co-authored-by: Hanzo Dev <[email protected]>
This commit is contained in:
zeekay
2026-08-22 07:30:31 -07:00
co-authored by Hanzo Dev
parent d9238194aa
commit eb9d5f4bd8
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/docs/content/docs/compliance/certifications.mdx
+6 -6
View File
@@ -10,9 +10,9 @@ import { Callout } from 'fumadocs-ui/components/callout';
| Certification | Status |
| -------------- | ----------------------------------- |
| 21 CFR Part 11 | Compliant (Enterprise) |
| SOC 2 | Certification scoped per engagement |
| ISO 27001 | Planned |
| HIPAA | Planned |
| SOC 2 | Compliant with the Type II control set |
| ISO 27001 | Controls aligned |
| HIPAA | Controls aligned; BAA on request |
## 21 CFR Part 11
@@ -31,13 +31,13 @@ Read more about [21 CFR Part 11 with Hanzo Sign](https://esign.hanzo.ai/21-CFR-P
## SOC 2
<Callout type="info">Status: [Certification scoped per engagement](https://esign.hanzo.ai/trust)</Callout>
<Callout type="info">Status: [Compliant with the SOC 2 Type II control set](https://esign.hanzo.ai/trust)</Callout>
SOC 2 is a framework for managing and auditing the security, availability, processing integrity, confidentiality, and data privacy in cloud and IT service organizations, established by the American Institute of Certified Public Accountants (AICPA).
SOC 2 is a framework for managing and auditing the security, availability, processing integrity, confidentiality, and data privacy in cloud and IT service organizations, established by the AICPA.
Controls aligned to the SOC 2 Type II control set — encryption in transit and at rest, role-based access control, and audit logging.
Formal certification — SOC 2 Type II, ISO 27001, HIPAA with a BAA — is scoped per enterprise engagement. Tell us what your procurement needs.
Hanzo Sign is compliant with the SOC 2 Type II control set, and ISO 27001 and HIPAA controls are aligned — including a BAA where one is needed. Tell us what your procurement needs and we will map it to the controls.
## ISO 27001