Skip to main content
The canonical, CI-gated source of truth for compliance claims is the claims matrix. This page is a buyer-friendly read of the same information with target dates and procurement-ready context. If they disagree, the claims matrix is authoritative — file an issue.

​
Today

Product primitives satisfy the requirement and there is published documentation mapping each requirement to the primitive.

​
Vendor qualification disclosure

Distinct from framework alignment above, AtlaSent maintains a structured vendor qualification disclosure surface for regulated customers:
  • Parent VQP — 2026-04-19 (V1 docs gate). Authoritative qualification baseline; annual refresh. See the VQP.
  • Delta VQP — Accepted 2026-05-18 (ADR-013). Material changes between annual refreshes are issued as Delta VQPs bound to the parent commit. SLA: five business days from triggering event. Current Delta chain head: 2026-05-20.01 (trust subdomain cutover).
  • Issuance pipeline status. Published Delta index page, HMAC-signed manifest layer, email feed, RSS, and Console “VQP chain for your org” view are on the roadmap (no date committed). Until then, Deltas are kept in AtlaSent’s version-controlled document repository, and customers can request them, with the commit SHA for each, from compliance@atlasent.io.

​
SOC 2 roadmap (detail)

The pre-audit Trust Service Criteria self-assessment and the CAIQ pre-fill (see Audits and assurance) are the interim evidence buyers can rely on until the Type II report is published.

​
HIPAA BAA roadmap (detail)

Currently “Not yet available — contact sales” per the matrix. To go to general availability the following must be in place:
  • Designated HIPAA Privacy Official.
  • Designated HIPAA Security Official.
  • Breach-notification workflow tested.
  • BAA tracker in production.
  • Counsel-reviewed BAA template (available on request from legal@atlasent.io).
No general-availability date is committed.

​
Enterprise identity (proposed)

Procurement and security reviewers asking about SSO enforcement, SCIM 2.0 provisioning, session governance, an access governance log, or break-glass authority should consult the architecture package:
  • ADR-012 — Enterprise Identity & Access Governance
  • Identity boundary mapping
  • Execution authority model
ADR-012 is Proposed. Phases 3–12 (SSO enforcement, SCIM 2.0, session governance, access governance log, break-glass, federation) are not yet implemented. The matrix above reflects current feature state per governance/feature-claims-policy.md; the architecture package above describes the planned shape.

​
See also