# Does this make us SOC 2 or HIPAA compliant?

*Published on 2026-10-13T00:00:00.000Z*

*By CipherStash Team*

No. Nothing you install makes a workload compliant, and the docs say so. What you get is implementations and evidence for specific controls an assessor will ask about: field encryption, restricted key access, tenant isolation, access attributed to a user, regional key material, and a record of every decryption. CipherStash itself is SOC 2 Type II certified.

## Content

An auditor does not have a checkbox for searchable encryption. They have control areas, and for each one they want to see how the control is implemented and evidence that it operates. That is the useful way to read what we provide.

## The capability map

The compliance page lays it out as a table, and the right-hand column is the honest part.

- **Protect sensitive stored data.** Field-level encryption in the application. You classify the fields and make sure every write path encrypts them.
- **Restrict key access.** Client keys, access-key roles and keyset grants. You apply least privilege, rotate credentials and secure the deployment secret store.
- **Isolate tenants or environments.** Separate keysets or workspaces. You enforce the boundary consistently in application and database access.
- **Attribute access to a user.** Identity provider federation and lock contexts. You configure the provider and choose stable claims.
- **Produce data-access evidence.** ZeroKMS derivation records and Proxy audit events. You configure retention, review, alerting and SIEM ingestion.
- **Keep key material regional.** Region-bound workspaces. You deploy the application and database in the intended region.
- **Remove access to encrypted data.** Revoke client grants or destroy the key boundary. You confirm scope, backups and legal holds first.

These can contribute evidence or control implementation for SOC 2, HIPAA, GDPR, PCI DSS, ISO 27001 and regional privacy laws. The exact mapping depends on your scope and your assessor.

## What CipherStash holds

CipherStash is SOC 2 Type II certified and runs regular third-party penetration tests. Reports are available through the trust centre under NDA. You or your assessor can read the source for every cryptographic scheme we use. EQL is open source, and the encryption core and ORE implementations are source-available.

## Where this helps most

The evidence controls. A per-decryption record written by a service your application cannot edit answers "who accessed what and when" with data rather than policy. Region-bound key material answers "where are the keys" with a workspace identifier. Those are the questions that stall enterprise deals, and they are the ones this stack was built to answer with something an assessor can check.

## Technical evidence

- [Compliance: capability map and customer responsibilities](/docs/security/compliance)
- [Cryptography: primitives, key hierarchy and trust boundaries](/docs/security/cryptography)
- [Provable access control](/docs/solutions/provable-access)
- [Data residency](/docs/solutions/data-residency)
- [Trust centre](https://trust.cipherstash.com)

## Related notes

- [Can you prove who read what?](https://cipherstash.com/notes/can-you-prove-who-read-what.md) — Every decryption goes through ZeroKMS, and ZeroKMS records the operation before it returns the key material. The record names the identity, the keyset, the application and the time.
- [Can we keep EU data in the EU?](https://cipherstash.com/notes/can-we-keep-eu-data-in-the-eu.md) — Yes, if your application runs in the EU as well. A workspace is bound to one ZeroKMS region, Frankfurt or Ireland for the EU. Encryption runs in your infrastructure, ciphertext lives in your database, and the authority key does not leave the region.