Request early access

Compliance

We cite the rule. We never certify.

HIPAA Hawk ties each technical gap to the HIPAA Security Rule section it relates to, and Secure Raven keeps evidence a reviewer can trace. It certifies no one, and it does not stand in for an auditor or counsel.

See what HIPAA Hawk mapsOur SOC 2 status
Frameworksstatus today
  • HIPAA Security Rule45 CFR Part 164Mapped

    HIPAA Hawk: 28 checks, each citing one of 7 sections. Not a certification. How it maps

  • SOC 2AICPA Trust Services CriteriaNot audited

    Our Type I target scope is Security and Confidentiality. No auditor is engaged yet. Our status

  • ISO 27001Information security managementNot offered

    No controls, mappings or reports.

  • GDPREU data protectionNot offered

    No controls, mappings or reports.

  • Custom frameworksYour own control setsNot offered

    No framework builder.

Older links to our ISO 27001, GDPR and custom-framework pages lead here.

HIPAA · for health-tech teams

Mapped to the rule, check by check.

HIPAA Hawk maps technical-safeguard gaps on the systems you connect to the section of the HIPAA Security Rule each one relates to, so a reviewer can trace a finding back to the regulation.

28

checks, each citing one section of the Security Rule.

  • 20Technical safeguards45 CFR 164.312
  • 5Administrative safeguards45 CFR 164.308
  • 3Organizational requirements45 CFR 164.314
  • Fixed rules over names, flags and counts. Never your rows.
  • Runs first in a full inspection, and fails closed if the probe does not answer.
  • Tracks gaps in your own vendor BAA inventory. It does not create a BAA.

A scanning aid. Not a certification. HIPAA Hawk is in private early access and does not run for customers in production yet.

All 28 checks and their citations

SOC 2 · our own

We are not SOC 2 audited yet.

Our Type I target scope is Security and Confidentiality, and no auditor is engaged yet. Until a CPA firm issues a report, we will not call Secure Raven audited, ready or certified for SOC 2.

Read our SOC 2 status
Trust Services Categoriesour Type I target
  1. SecurityCC1–CC9In target scope
  2. ConfidentialityC1In target scope
  3. AvailabilityA1Later
  4. Processing IntegrityNot selected
  5. PrivacyNot selected
CPA firm
Not engaged
Type I report
None
Type II report
None

Evidence

What a reviewer can sample.

The records Secure Raven keeps about the systems you connect. Evidence, not a verdict.

  • Findings

    Each with a severity, the object it names and, for HIPAA Hawk, the section it cites.

  • Scan history

    Every inspection and how it ended, including the ones that could not finish.

  • Evidence pack

    A sanitized export you can hand to a reviewer.

  • Audit log

    Every privileged action, append-only and hash-chained, with an export of its head hash and counts.

  • BAA inventory

    Your own record of vendors and their BAA status.

Evidence, not vibes.

Every certification field in our public trust manifest is false, and a test makes sure it stays that way until a real report exists.

Request early accessClaims we do not make