Built for the age of agents.

AICPA TSC · CC6 access · CC7.2 monitoring · CC8 change

Controls are mapped to the Trust Services Criteria, and the evidence is produced by the product itself: every credential access is an actor-typed, encrypted, exportable event. Independent attestation follows — until then, the appliance runs inside your own SOC 2 scope.

Annex A · A.5 access · A.8.15 logging · A.8.24 cryptography

Our ISMS follows the standard. Every infrastructure subprocessor that hosts our fleet holds ISO 27001 or SOC 2, and least-privilege access is a data structure in our engine — not a spreadsheet.

45 CFR §164.312 (a) access · (b) audit controls · (c) integrity · (e) transmission

There is no such thing as a HIPAA certificate — for anyone. There are technical safeguards, and there is evidence. VaultDB and inomi were built for protected health information: encrypted per record, access-logged, erasable by crypto-shred. For business-associate terms, talk to us.

Art. 28 processor · Art. 32 security · Art. 17 erasure · SCCs

Our Data Processing Agreement applies automatically to every paid subscription. Every subprocessor is published, with its location and certifications — and for Clavitor, 30 days' notice before any addition. Erasure is cryptographic: destroy the key, and the content is gone for good.

AWS-LC FIPS 3.1.0 · CMVP #5314 static (active) · pinned exactly

VaultDB's default build compiles and links every cryptographic primitive against a FIPS 140-3 validated module, built from the certified source and run in FIPS mode on Linux x86_64 and aarch64. The certificate's tested environments are Amazon Linux 2023 on AWS Graviton4 and Intel Xeon Platinum 8375C; our servers are not among them. The boundary is data at rest: AES-256-GCM, AES-KW and HKDF-SHA256 in VaultDB 2.0.0's default build and in the Clavitor vault and gate, which link the same module.

3.3.1 record · 3.3.2 link to identity · 3.3.8 protect log integrity

Per-event identity, IP and timestamp — encrypted and hashed into a chain witnessed on separate infrastructure. Agent activity stands apart from human activity on every line.

Merchant of Record: Paddle · PCI DSS Level 1

We never see a card number in billing. Payments, taxes and invoicing run through Paddle as Merchant of Record. The cards you keep in your vault are encrypted with keys we do not have.

Securitor multi-model method · document policy v2.1

Our own code goes through our own auditor — a panel from all the leading labs, one verdict. VaultDB's July 2026 audit closed every Critical and High with a regression test; the rest are published as edges.