> ## Documentation Index > Fetch the complete documentation index at: https://docs.usehasp.com/llms.txt > Use this file to discover all available pages before exploring further. # Platform Overview > What HASP is, who it's for, and how the compliance substrate works. HASP is the **regulated-AI substrate** — the identity, policy, audit, compliance, and PHI-handling layer for AI in regulated industries. The substrate is what you buy; the surfaces below are how you consume it. ## What the substrate is The substrate is a single, coherent layer that sits between compliance infrastructure and your end-user product. It comprises five HASP-owned components: | Component | What it does | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Identity** | Names *who* is making each AI call — a user, an API key, or an agent acting under delegated authority — with what scope and what revocation-eligibility. | | **Policy** | Enforces compliance constraints *before* an action is taken: BAA verification, feature allowlisting, credit pre-flight, PHI mode resolution, and pre-action tool authorization. Failure is fail-closed. | | **Audit** | Produces tamper-resistant, cryptographically verifiable evidence of what every caller did, on whose authority, and with what result. See [Audit Chain](/platform/audit-chain). | | **Compliance posture** | Satisfies regulated-buyer procurement requirements with one control set spanning multiple frameworks. See [Compliance Posture](/platform/compliance-posture). | | **PHI handling** | De-identifies content before inference and re-identifies on response — HASP-owned, built on Microsoft Presidio with healthcare-specific recognizers. See [BAA Structure](/platform/baa-structure). | All five components are built and operated by HASP. The substrate itself is never a pricing lever — it is the floor at every paid tier and in the Free Evaluation. ## Who it's for HASP serves the regulated-AI market, healthcare-led, with adjacent regulated verticals — legal and financial services — following on the same substrate. Customers who don't process PHI use the full platform identically; PHI handling is a universal capability, not a vertical-specific add-on. ## Four consumption surfaces The substrate is reachable through four surfaces. Each is a way to *consume* the substrate, not a separate product with its own roadmap: Compliant chat for individuals and teams. Internal-app builder for bespoke tools that handle PHI without dev work. Programmatic inference, identity, policy, and audit. Issued, scoped, revocable, audited agent credentials — a client of the Public API. Every surface rides the same substrate. The same compliance posture, the same audit chain, and the same PHI handling apply regardless of which surface a call enters through. Tier differences are operational — rate limits, allotments, SLA, governance depth — never access to the substrate or its controls. ## Where to go next How one control set satisfies multiple frameworks at once. Tamper-resistant, independently verifiable audit evidence. The customer BAA and the provider chain that backs PHI handling. Make your first compliant inference call.