Compliance & Audit

HASP AI Studio is designed for regulated industries. Every action — authoring a contract change, running a workflow, releasing a project, approving a release, making an AI inference call — is recorded in a tamper-resistant audit chain and surfaced through the trace view and audit log.

​

What is audited

​

Audit chain integrity

The audit chain is tamper-resistant. Each event is cryptographically linked to the prior event in the chain. Attempting to alter or delete a past audit record breaks the chain and is detectable. This architecture satisfies:

• HIPAA — Audit controls (§164.312(b)) and access controls (§164.312(a)(1))
• HITRUST — Audit logging and monitoring controls
• SOC 2 Type II — Change management, logical access, and monitoring criteria

​

The project activity log

The project overview shows recent activity by default — a user-facing projection of contract-change audit events, with author attribution and links to the affected resource or run trace. This is the day-to-day view for the team building and operating the project. For deeper forensic review: open the Activity Log from the project overview to see the full history of every contract change and release for this project.

​

Workflow run traces as audit artifacts

Every workflow run trace is a durable audit artifact. It shows:

• The trigger payload (PHI-processed version)
• Every step, input, output, and side effect
• AI inference calls with model, token counts, and response metadata
• Data mutations with field-level before/after values

Traces are retained per your org’s compliance retention policy. They are exportable in structured JSON format for regulatory review or integration with your SIEM.

​

Release changelog

Every release generates an immutable changelog entry:

• The plain-language summary of what the release does (auto-generated by the system, editable by the author before confirmation)
• The per-resource diff
• The approval record (who approved, when)
• The changeset snapshot

The changelog is the human-readable narrative of what the project did and when — suitable for compliance review, incident response, and change management audits.

​

PHI in audit records

AI Studio applies PHI policy at the point of ingestion. Raw PHI is never written to audit records. The sequence:

1. Trigger payload received (or form submission, or integration event)
2. PHI detection scans the payload
3. PHI is anonymized before the workflow executes and before the trace record is written
4. The workflow operates on the anonymized payload
5. Re-identification (if needed for output) happens under controlled conditions with its own audit event
6. The trace records the anonymized payload and the re-identification event (if any), never the raw PHI

This means audit records are safe to export and review without PHI-access controls, except for records that include re-identification events (which require explicit PHI-view access).

​

BAA requirement

AI Studio is available to all paid tiers. Running workflows that process PHI requires:

1. A signed Business Associate Agreement (BAA) with HASP. Sign in Settings → Compliance.
2. PHI policy configured for the project (default for healthcare orgs with a BAA: strict).

Attempting to run a workflow that would process PHI without a signed BAA results in a policy block. The workflow is not executed; the block event is audited.

​

Exporting audit data

From Settings → Compliance → Audit Export:

• Export the full project audit log for a date range in structured JSON
• Export individual run traces
• Export the release changelog

Exports are signed and include a verification manifest so the recipient can confirm the export has not been tampered with. For org-level export across all projects, contact HASP support.

​

FHIR R4 AuditEvent export

A health system’s SIEM often expects audit data as FHIR. Ask for the org-level signed export with the FHIR bundle in either of two ways:

• Audit Log page: choose Signed Export + FHIR R4. As with the plain signed export, you get an email with an expiring download link.
• Control-plane API: POST /v1/audit/exports with "format": "fhir_r4". Same authorization, same request-and-poll flow, and same short-lived download URL as the default format.

The ZIP then carries fhir-r4/audit-bundle.json next to the signed audit-export.json: a FHIR R4 Bundle with one AuditEvent per audit entry and a Provenance for every entry that changed a record.

​

Compliance posture

For the platform-level compliance posture — HIPAA + HITRUST + SOC 2 + GDPR + CCPA + PIPEDA control set, BAA structure, sub-processor list, and trust center — see the Platform documentation.