Does this make us SOC 2 or HIPAA compliant?
- Date
- By
- CipherStash Team
No. Nothing you install makes a workload compliant, and the docs say so. What you get is implementations and evidence for specific controls an assessor will ask about: field encryption, restricted key access, tenant isolation, access attributed to a user, regional key material, and a record of every decryption. CipherStash itself is SOC 2 Type II certified.
An auditor does not have a checkbox for searchable encryption. They have control areas, and for each one they want to see how the control is implemented and evidence that it operates. That is the useful way to read what we provide.
The capability map
The compliance page lays it out as a table, and the right-hand column is the honest part.
- Protect sensitive stored data. Field-level encryption in the application. You classify the fields and make sure every write path encrypts them.
- Restrict key access. Client keys, access-key roles and keyset grants. You apply least privilege, rotate credentials and secure the deployment secret store.
- Isolate tenants or environments. Separate keysets or workspaces. You enforce the boundary consistently in application and database access.
- Attribute access to a user. Identity provider federation and lock contexts. You configure the provider and choose stable claims.
- Produce data-access evidence. ZeroKMS derivation records and Proxy audit events. You configure retention, review, alerting and SIEM ingestion.
- Keep key material regional. Region-bound workspaces. You deploy the application and database in the intended region.
- Remove access to encrypted data. Revoke client grants or destroy the key boundary. You confirm scope, backups and legal holds first.
These can contribute evidence or control implementation for SOC 2, HIPAA, GDPR, PCI DSS, ISO 27001 and regional privacy laws. The exact mapping depends on your scope and your assessor.
What CipherStash holds
CipherStash is SOC 2 Type II certified and runs regular third-party penetration tests. Reports are available through the trust centre under NDA. You or your assessor can read the source for every cryptographic scheme we use. EQL is open source, and the encryption core and ORE implementations are source-available.
Where this helps most
The evidence controls. A per-decryption record written by a service your application cannot edit answers "who accessed what and when" with data rather than policy. Region-bound key material answers "where are the keys" with a workspace identifier. Those are the questions that stall enterprise deals, and they are the ones this stack was built to answer with something an assessor can check.