Method/AI · Stage 4
Prove it.
To your auditor, your CISO and your CFO. Every control mapped, every change on the record, and every agent run costed.
The control library
Mapped to the frameworks your auditors use.
| Control | Requirement | Severity | NIST 800-53 mapping |
|---|---|---|---|
| HL-SC-03 | Images must have no critical CVEs and at most 5 high | Critical | RA-5 |
| HL-DL-03 | Production promotion must require a recorded approval | Critical | CM-3 |
| HL-NW-01 | Cell namespaces must apply default-deny networking | Critical | SC-7 |
| HL-DP-01 | Database volumes must be encrypted at rest | High | SC-28 |
| HL-DP-02 | Stateful services backed up with RPO of 24 hours or less | High | CP-9 |
| HL-AU-03 | Log storage must be immutable and tamper-evident | High | AU-9 |
| HL-IR-05 | Customer-impacting breaches notified within 72 hours | Critical | IR-6 |
Severity across the library: 20 critical, 66 high, 87 medium, 46 low. Checked at the pipeline, at admission, at promotion, at runtime, by configuration scan and by periodic review.
In detail
Fourteen control families, from supply chain to keys.
Who is responsible for what
| Area | HyperLocal | You |
|---|---|---|
| Platform & cells | Clusters, cell isolation, patching, shared services, backups | Choosing cell size, resilience and compliance class |
| Application code | Agents generate, review and test it against the control library | Approving designs and merging releases |
| Identity | The tenant realm, MFA options and federation | Your users, groups and your identity provider |
| Data | Encryption, backups and restore tooling | What data you store and who may see it |
| Audit | Control mapping and evidence collection | Your auditor relationship and attestation |
For your auditor
Evidence collected while you work, ready before the audit.
HyperLocal's baseline, plus regime packs for SOC 2, PCI DSS and HIPAA, plus your own rules that can only tighten. Every value shows who set it.
Waivers last 90 days at most, need an approver from another team, and land in the evidence as exceptions.
Open an engagement for SOC 2 Type 2, PCI DSS or HIPAA. Approvals, commits, backups and control results become evidence automatically.
One package with a SHA-256 manifest of every item, plus time-boxed read-only seats for your auditors.
For your CISO
Isolation and identity, built in.
A namespace, Git repo, registry and deployment project per cell. Service mesh policy admits traffic only from the same cell.
A dedicated identity realm per tenant, Microsoft Entra ID federation, and MFA with TOTP, one-time codes or passkeys.
Designs pass an Architecture Review Board, and releases go through merge requests that a person merges.
Encrypted storage and encrypted database backups on Silver cells and above.
Separate keys per cell, your own keys, and HSM-backed key options.
Continuous control evaluation per production cell, with findings ranked by severity.
For your CFO
Prove the savings, too.
Every Build run is costed per agent and per model, and work is billed in credits you can forecast. Compare your current platform and licence spend with the TCO calculator.
Request our SOC 2 report, penetration test summary and security questionnaire through the contact form.