If we can't operationalise it, we don't claim it.
Frameworks we align with get a badge. Frameworks we are audited against get a different badge. The badges don't overlap.
Compliance
Compliant, not certified. And honest about the difference.
We operate to the controls each framework requires, and we say so without implying a third-party attestation we don't yet hold. Every claim below is mapped to an internal evidence file; every 🟢 is customer-visible.
The stance in plain English
Three rules for every public compliance claim.
Every claim lists its scope.
HIPAA safeguards on enterprise contracts, BAA available on request once the template is countersigned. No blanket certifications implied by the landing page.
Evidence, on request.
Security reviewers can request the underlying control documentation, penetration-test summaries, and sub-processor annex. We turn these around in under two business days.
Frameworks we align with
What each badge actually means.
Click any badge on the landing, enterprise, or security pages and you'll land in one of the sections below. Every entry is worded to describe operational alignment, not third-party attestation.
SOC 2
On roadmapControls implemented against the Trust Services Criteria; Type II audit on the 12-month roadmap.
- Access controls, change management, incident response, and vendor-risk processes mapped to the AICPA TSC.
- Auditor engagement letter is the gate for flipping this badge to "audit in progress".
- No Type I or Type II report exists today; we won't claim otherwise.
Control matrix + penetration test
SOC 2 Type II · on roadmapSOC 2 Trust Services Criteria · controls implemented
GDPR
In placeArticle 28 processor with a signed DPA, Art. 30 records, and a documented sub-processor roster.
- Hakim processes personal data as an Article 28 processor under the DPA available at /legal/dpa.
- Subject rights (access, deletion, portability) route to privacy@tryhakim.ai with a 30-day SLA.
- International transfers use Standard Contractual Clauses where applicable; GCC residency available on contract.
DPA + processing records
GDPR · Art. 28 processorGDPR · DPA available
EU AI Act
Obligations metArticle 50 transparency obligations for generative audio; GP-AI technical documentation published with each release.
- Synthetic audio is marked machine-readable per Art. 50(2) with provenance metadata.
- End-users are informed they are interacting with an AI system where our output is presented as a voice.
- Technical documentation required by Art. 53 is published in the model card for each Hakim release.
Model card + watermark policy
EU AI Act · Art. 50EU AI Act · GP-AI transparency
UAE PDPL
AlignedCompliant practices against the UAE Personal Data Protection Law: lawful basis, data minimisation, subject rights.
- Data minimisation, purpose limitation, and security measures implemented per Federal Decree Law No. 45 of 2021.
- Cross-border transfer notices are drafted for customers operating in the UAE.
- MENA-qualified counsel has reviewed the public claim wording.
Counsel gap analysis on file
UAE PDPL · compliant practices
KSA PDPL
AlignedCompliant practices against the Kingdom of Saudi Arabia Personal Data Protection Law.
- Operations align with SDAIA's PDPL implementing regulations on purpose, retention, and subject rights.
- Saudi residency is available on enterprise contract via the KSA region.
- We do not claim SDAIA registration at this time.
Counsel gap analysis on file
KSA PDPL · compliant practices
HIPAA safeguards
Safeguards in placeHIPAA-aligned administrative, physical, and technical safeguards. BAA available on enterprise contract once the template is countersigned.
- Access controls, audit controls, integrity, and transmission security implemented per 45 CFR §§164.308–.312.
- We are not a HIPAA-attested covered entity and do not operate under the Privacy Rule.
- A BAA is available to enterprise customers once legal sign-off lands on the template.
Safeguards matrix on /security
HIPAA-aligned safeguards
Data residency
Four regions. You pick one. Your data stays there.
No cross-border round-trips, no surprise backups, no marketing fine print. Residency is a contractual commitment, not a best-effort.
Germany
Frankfurt
EU · GDPR
Default for EU-based customers. Processing, storage, and model inference all happen in eu-central-1.
Qatar
Doha
GCC · Qatar PDPL
Residency option for Qatar-regulated workloads and customers with Doha-local data-handling requirements.
United Arab Emirates
UAE
GCC · UAE PDPL
Residency option for UAE-regulated workloads. Processing and storage stay inside the Emirates.
Saudi Arabia
Riyadh
GCC · KSA PDPL
Residency option for KSA-regulated workloads. Processing and storage stay inside the Kingdom.
Sub-processors
Who else touches your data.
The short list we disclose publicly. The DPA sub-processor annex is the full picture, available on request.
| Sub-processor | Purpose | Region |
|---|---|---|
| Amazon Web Services | Infrastructure hosting (compute, storage, network). | Customer's chosen residency region |
| Stripe | Payments, billing, invoicing. | United States · EU |
| Postmark | Transactional email (sign-in, invoices, alerts). | United States |
| Cloudflare | Edge routing, DDoS protection, WAF. | Global edge · logs retained 30 days |
| PostHog | Product analytics on marketing + dashboard surfaces. | EU (self-hosted for enterprise customers on request) |
Documents for procurement
Everything your legal + security team needs.
If you need something you don't see here, email compliance@tryhakim.ai, we keep the redlines short.
Something missing?
Email compliance@tryhakim.ai.
A real human on our compliance team will reply within one business day. Urgent review? Mention "urgent" in the subject line and we'll escalate.
compliance@tryhakim.ai