> ## Documentation Index
> Fetch the complete documentation index at: https://docs.atlasent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance status

> Current certifications, frameworks, roadmap. Calendar view of when SOC 2, HIPAA BAA, and other gates land.

<Note>
  The canonical, CI-gated source of truth for compliance claims is the
  claims matrix. This page is a buyer-friendly
  read of the same information with target dates and procurement-ready
  context. If they disagree, the claims matrix is authoritative — file
  an issue.
</Note>

## Today

<Tabs>
  <Tab title="Aligned">
    Product primitives satisfy the requirement and there is published
    documentation mapping each requirement to the primitive.

    * **21 CFR Part 11.** Aligned. [Mapping](/compliance/21-cfr-part-11).
    * **EU Annex 11 (GMP).** Aligned. [Mapping](/compliance/eu-annex-11).
    * **ALCOA+.** Aligned. [Mapping](/compliance/alcoa-plus).
    * **GxP change control.** Aligned. [Mapping](/compliance/gxp-change-control).
  </Tab>

  <Tab title="Supported">
    The framework is recognized; AtlaSent provides direct primitives
    for the parts in-scope for "authorization of agent actions."

    * **ICH E6 (GCP).** Supported. [Mapping](/compliance/ich-e6-gcp).
    * **GDPR.** Supported. DPA available; EU-only data
      residency on roadmap (no date committed).
    * **ISO 27001.** Supported (controls mapped). [Cross-walk](/compliance/gxp-change-control#iso-27001-cross-walk).
  </Tab>

  <Tab title="On roadmap">
    Planned, with no committed date unless one is shown. The earlier
    Q3 2026 targets were not met; this page will show a new date only
    once it is committed.

    * **SOC 2.** Pre-engagement: no audit firm engaged and no audit period
      started (VQP Delta 2026-06-12.01). No report date is committed.
    * **EU AI Act.** Pre-review mapping available on request. Review
      completion: no date committed.
    * **EU-only data residency.** No date committed.
    * **HIPAA BAA general availability.** No date committed (case-by-case
      for pilot customers today — contact sales).
  </Tab>

  <Tab title="Not yet">
    Gaps. If you need this before its roadmap date, contact sales.

    * **HIPAA BAA general availability.** Today: case-by-case only. See above.
    * **NIST 800-53 (Rev 5) mapping.** On request for federal pilots.
    * **FedRAMP.** Not in scope today.
  </Tab>

  <Tab title="N/A">
    AtlaSent is not the kind of system this framework targets.

    * **FDA 510(k) / medical device.** AtlaSent is not a medical device.
      Use with medical-device software requires separate IEC 62304
      assessment.
  </Tab>
</Tabs>

## Vendor qualification disclosure

Distinct from framework alignment above, AtlaSent maintains a structured
vendor qualification disclosure surface for regulated customers:

* **Parent VQP — `2026-04-19` (V1 docs gate).** Authoritative qualification
  baseline; annual refresh. See the VQP.
* **Delta VQP — Accepted 2026-05-18 (ADR-013).**
  Material changes between annual refreshes are issued as Delta VQPs
  bound to the parent commit. SLA: five business days from triggering
  event. Current Delta chain head: `2026-05-20.01` (trust subdomain cutover).
* **Issuance pipeline status.** Published Delta index page, HMAC-signed
  manifest layer, email feed, RSS, and Console "VQP chain for your org"
  view are on the roadmap (no date committed). Until then, Deltas are
  kept in AtlaSent's version-controlled document repository, and customers
  can request them, with the commit SHA for each, from
  `compliance@atlasent.io`.

## SOC 2 roadmap (detail)

| Milestone | Status | Target |
| - | - | - |
| Audit firm engaged | *Not started* | No date committed |
| Type I report period start | *Not started* | No date committed |
| Type I report available | *Not started* | No date committed |
| Type II observation window | *Not started* | No date committed |
| Type II report available (NDA) | *Not started* | No date committed |
| Type II report cited in matrix as "Aligned" | *Not started* | No date committed |

The pre-audit Trust Service Criteria self-assessment and the CAIQ
pre-fill (see Audits and assurance) are the interim
evidence buyers can rely on until the Type II report is published.

## HIPAA BAA roadmap (detail)

Currently "Not yet available — contact sales" per the matrix. To go to
general availability the following must be in place:

* Designated HIPAA Privacy Official.
* Designated HIPAA Security Official.
* Breach-notification workflow tested.
* BAA tracker in production.
* Counsel-reviewed BAA template (available on request from
  `legal@atlasent.io`).

No general-availability date is committed.

## Enterprise identity (proposed)

Procurement and security reviewers asking about SSO enforcement, SCIM 2.0
provisioning, session governance, an access governance log, or break-glass
authority should consult the architecture package:

* ADR-012 — Enterprise Identity & Access Governance
* Identity boundary mapping
* Execution authority model

<Warning>
  ADR-012 is **Proposed**. Phases 3–12 (SSO enforcement, SCIM 2.0,
  session governance, access governance log, break-glass, federation)
  are not yet implemented. The matrix above reflects current feature
  state per `governance/feature-claims-policy.md`; the architecture
  package above describes the planned shape.
</Warning>

## See also

* Claims matrix (canonical, CI-gated)
* [Security overview](/trust/security-overview)
* Audits and assurance


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.