Skip to main content
HASP’s compliance scope is six frameworks served by a single set of controls: HIPAA, GDPR, CCPA/CPRA, and PIPEDA are laws the platform complies with; SOC 2 Type II and HITRUST CSF e1 are attestations, and HASP does not hold its own today — the hosting infrastructure beneath the platform holds its own SOC 2 Type II and HITRUST certifications. Current status is always on the Trust Center. None of the controls is gated to a higher tier — every paid Solo, Professional, Business, and Enterprise customer gets the same application-layer controls.

​
One control set, many frameworks

The frameworks differ in what they require be possible; the implementation surface for those requirements is largely the same. The same operation satisfies an obligation in several frameworks at once:
  • An Article 17 erasure (GDPR) is the same DELETE operation as a HIPAA-driven data-removal request, the same SOC 2 Confidentiality control, and the same HITRUST data-disposal expectation.
  • An Article 30 sub-processor record (GDPR) satisfies a HITRUST vendor-management control and a SOC 2 vendor-management control simultaneously.
  • The audit chain serves all six frameworks with one set of events.
This single-control-set principle is what makes six frameworks affordable: the controls are paid for once and documented against multiple frameworks.

​
What each framework gates

​
Who owns which controls

HASP runs directly on HIPAA-eligible AWS services in US regions, under the AWS BAA. AWS is responsible for the physical security of its data centers. Everything HASP builds and operates on top — encryption at rest and in transit, access controls, network configuration, the end-to-end verifiable audit chain, BAA enforcement at the org boundary, PHI handling, and GDPR/CCPA data-rights endpoints — is HASP’s own responsibility.

​
Attestation status

SOC 2 Type II and HITRUST e1 are the two formal audit engagements HASP owns directly — one control framework mapped to two report outputs. Current status of each is on the Trust Center. HITRUST r2 is not in committed scope; it becomes a successor decision only if a specific contract genuinely requires it.

​
Compliance is orthogonal to residency

Residency is which physical region the data lives in. Compliance is which legal framework’s controls govern how it is handled. These are decoupled: the default residency posture is US-only, and EU/UK customers are served from the US under the EU-US Data Privacy Framework, which is sufficient for baseline GDPR. A regional deployment is a deployment decision, not a compliance redesign.

​
What HASP does not claim

DEA recordkeeping (21 CFR Part 1304) and EPCS (Part 1311) are explicitly not in the V1 framework set. HASP does not represent itself as a DEA EPCS-compliant service. Any framework not listed above is out of scope until a successor decision adds it.