H33.ai has received its SOC 2 Type II independent service auditor’s report from Prescient Assurance, covering the Security Trust Services Category for April 1 – July 1, 2026. The report is Restricted Use & Distribution and is available to customers and prospects under NDA — request a copy.
Part of HATS — H33’s continuous control-verification & attestation standard →
SOC 2 requires controls. H33 provides cryptographic proof of controls. Audit trails designed to be Dilithium-signed, ZK-STARK verified processing, FHE-encrypted data protection. Compliance you can verify mathematically.
H33's SOC 2 Type II report has been issued (independent auditor: Prescient Assurance; Security Trust Services category; examination period April 1 – July 1, 2026), with controls monitored continuously through Drata rather than assessed at a single point in time. Type II means the controls have been tested over a sustained observation period and demonstrated to operate effectively over time.
The issued SOC 2 Type II report covers the Security Trust Services Category. H33’s control program additionally addresses Availability, Processing Integrity, Confidentiality, and Privacy — each mapped to specific cryptographic controls that exceed the standard requirements. Where SOC 2 asks for a policy, H33 provides a mathematical guarantee.
The report is available to customers and prospects under NDA (Restricted Use & Distribution). Contact us to request a copy of the most recent report from our independent auditor.
SOC 2 requires controls. H33 provides cryptographic PROOF of controls. Every operation generates evidence.
Every data access, computation, and administrative action is signed with CRYSTALS-Dilithium (ML-DSA, FIPS 204) post-quantum digital signatures. Audit records are tamper-evident by construction. Any alteration, deletion, or back-dating is cryptographically detectable.
ML-DSA / FIPS 204Every processing operation generates a ZK-STARK proof that the computation was performed correctly without accessing plaintext data. The proof is publicly verifiable by any third party -- auditors, regulators, or customers -- without requiring access to the underlying data.
ZK-STARKCustomer data is protected by fully homomorphic encryption. Data is processed while it remains encrypted. The server never holds a decryption key. A breach of H33 infrastructure exposes ciphertext indistinguishable from random noise. This exceeds every SOC 2 data protection requirement.
BFV Lattice FHEAudit evidence is stored in immutable append-only logs with SHA3-256 chain hashing. Every entry is designed to be Dilithium-signed, so that evidence integrity holds after the arrival of quantum computers: traditional RSA-signed audit logs will become forgeable, while Dilithium-signed logs are designed not to.
SHA3-256 + DilithiumHow H33's cryptographic controls map to specific SOC 2 Trust Services Criteria requirements.
| TSC | Requirement | H33 Implementation |
|---|---|---|
| CC6.1 | Logical access security | Session tokens designed to be Dilithium-signed, multi-factor authentication, role-based access control. Session tokens are designed to be quantum-resistant. |
| CC6.6 | Encryption of data in transit | ML-KEM (Kyber, FIPS 203) key exchange for all connections. Post-quantum TLS that resists harvest-now-decrypt-later attacks. All data encrypted before it leaves the client. |
| CC6.7 | Encryption of data at rest | AES-256-GCM for storage encryption plus FHE for data in use. Data remains encrypted during processing -- not just at rest and in transit. The encryption gap that exists in every other SOC 2 certified service does not exist here. |
| CC7.2 | Monitoring system components | Continuous AI compliance monitoring with 100% operation coverage. Every API call, every data access, every administrative action is monitored in real-time. Anomalies trigger alerts within seconds. |
| CC8.1 | Change management | ZK-STARK proof of authorized changes. Every configuration change, deployment, and infrastructure modification generates a verifiable proof that the change was authorized and executed correctly. |
| P6.1 | Privacy notice | Zero PII processed in plaintext -- privacy by architecture. H33 cannot access customer data because FHE prevents decryption on the server. Privacy is not a policy commitment; it is a mathematical constraint. |
The underlying policy and procedure documents behind the controls above — not samples, H33's own operating documentation. Browse the full compliance documentation library (40 policies and procedures).
Not point-in-time. H33's monitoring runs continuously. Compliance score tracked in real-time. Deviations trigger alerts within seconds.
Traditional SOC 2 evidence collection is manual. Screenshots, log exports, policy documents, and interview notes are gathered before each audit. This creates gaps between what the controls do and what the evidence shows.
H33 generates compliance evidence automatically for every operation. Every API call is designed to produce a Dilithium-signed audit record and a ZK-STARK proof. Evidence is continuous, complete, and cryptographically tamper-evident. When auditors arrive, the evidence already exists for every second of the observation period.
This approach does not just satisfy SOC 2. It makes SOC 2 audits faster, less expensive, and more thorough. Auditors verify cryptographic proofs instead of reviewing screenshots. The evidence is mathematically verifiable rather than testimonial.
SOC 2 Type II report issued. Cryptographic proof of every control. 30-year tamper-evident evidence. Request our latest SOC 2 report or explore the full compliance program.