40 Operating Policies, One Library
The full H33 compliance documentation set — every policy, procedure, and record the platform operates against. Spans HIPAA, ISO 27001, PCI DSS, and operational security. Each document is a live record, not a marketing page.
HIPAA — Privacy Rule, Security Rule, Breach Notification
PHI handling, breach response, business-associate controls, and the supporting role designations.
ISO 27001 — ISMS Plan, Statement of Applicability, Management Reviews
The complete ISMS evidence chain: scope, plan, SoA, internal audits, management reviews, and nonconformity management.
PCI DSS — Cardholder Data Scope
Scope and data-flow documentation for PCI DSS environments.
Audit Trails, Monitoring, Security Events
Retention, access, monitoring activities, and remediation tracking — the audit posture H33 operates against.
Credential Management, Key Storage, Duties
Identity, secrets, and the separation of privilege.
Secure Coding, SDLC, Software Inventory
Engineering controls and the documented software supply chain.
Threat Intelligence, External Coordination, Email Hygiene
External-facing security posture: who we coordinate with, how we filter, how we respond.
BIA, Cloud Security, Time, Records of Processing
The foundational operational posture: continuity, time integrity, cloud posture, processing records.
Media Handling, Inventory
Asset lifecycle and physical/logical media controls.
How this maps to the receipt
Every operating policy here is enforced at the substrate level — the H33-Root authority bindings (instruction, authority, execution) reject any agent action not bound to an active policy and a valid receipt. The documents are the evidence layer; the substrate is the enforcement. See the architecture, H33-Root, and the cryptographic audit trail.