Framework by framework.

What each one means, what is in scope, the evidence we hand over, and what the product does for each. Reports and certificates live in the Trust Center.

attestation · Attested

SOC 2 Type II

An independent auditor's report on the design and operating effectiveness of our security, availability, and confidentiality controls over a review period.

Scope: The Waxell control plane, the SDKs and agents that report to it, and the people and processes that run them.
Evidence we provide: Type II report, available under NDA from the Trust Center
Continuous control monitoring, visible in the Trust Center
Availability evidence from independent health checks with 15 months of history
In the product: The audit trail and access records your own SOC 2 program will ask you for come from the same record.

certification · Certified

ISO/IEC 27001:2022

The international standard for an information security management system: risk assessment, controls, and continual improvement, certified by an accredited body.

Scope: The information security management system covering the Waxell platform and its operation.
Evidence we provide: Certificate and statement of applicability, available from the Trust Center
Annual surveillance audits
In the product: The audit trail and access records give your own certification evidence of how your agents are governed.

regulation · BAA available

HIPAA

The U.S. rules for protected health information. Waxell supports HIPAA workloads with a Business Associate Agreement.

Scope: The Waxell platform and its operation. Support access to a regulated tenant needs written approval under the Regulated Services Addendum.
Evidence we provide: HIPAA privacy, compliance, and incident-response policies, reviewed in the Trust Center
In the product: A HIPAA compliance profile checks that the sibling policies a PHI workload needs (audit retention, PII detection, data access) are on before an agent runs.

regulation · Aligned

EU AI Act

The European regulation for AI systems. For high-risk uses it requires human oversight, record-keeping, transparency, and risk management across the system's life.

Scope: Waxell's own use of AI, and the controls customers need to operate agents under the Act's obligations.
Evidence we provide: Scope determination and data protection impact assessment, available on request
Per-control mapping in the compliance pack
In the product: Article 14 human oversight is a hold-for-a-person policy. Article 12 record-keeping is the decision record. The compliance pack maps both.

framework · Aligned

NIST AI RMF

The U.S. framework for managing AI risk through four functions: Govern, Map, Measure, Manage.

Scope: How Waxell governs its own AI, and how the product gives customers the Govern and Manage functions for agents in production.
Evidence we provide: Function-by-function mapping in the compliance pack
Model risk classification and model card policies in the catalog
In the product: GOVERN 1.2 accountable roles is an owner on every agent. MANAGE is a policy that can say no.

Need a questionnaire answered?

Most SIG, CAIQ, and custom questionnaires are pre-answered in the Trust Center. Anything else, we turn around in days.

Trust Center Talk to us