Compliance
A procurement team's first question is the same one every time: which audit reports cover the platform you'd run on, and which ones cover the layers above it? Below is the honest split.
The substrate certifications are inherited from Azure, the cloud provider underneath. The ComputeSphere-layer SOC 2 audit is in progress; everything else marked in progress on this page is genuinely in flight, not aspirational.
Inherited certifications
These cover the data centers, hypervisor, network fabric, and managed services ComputeSphere runs on top of. They do not certify ComputeSphere's application layer.
| Standard | Status | Notes |
|---|---|---|
| SOC 1 / SOC 2 / SOC 3 | ✓ Azure-level | Audit reports available from Microsoft. |
| ISO 27001 / 27017 / 27018 | ✓ Azure-level | Full ISMS coverage. |
| HIPAA / HITRUST | ✓ Azure-level | BAA available at the Azure level — see "Industry-specific" below for the ComputeSphere-layer caveats. |
| GDPR, CCPA | ✓ Azure-level | Data-processing terms inherited. |
| FedRAMP High | ✓ Azure-level (US regions) | Azure substrate only; ComputeSphere is not FedRAMP-authorized. |
ComputeSphere-layer controls
The application layer ComputeSphere operates is run with controls aligned to SOC 2 Type II expectations:
| Control area | What's in place |
|---|---|
| Encryption | At rest and in transit on every layer — see Security. |
| Tenant isolation | Strict account → project → environment → service boundaries — see Security. |
| Audit logging | Every state-changing API action is recorded. |
| Internal access | Employee access to customer data is least-privilege, logged, and reviewed. |
| Vulnerability scanning | Every container image built by the platform is scanned. |
| Incident response | Documented response procedures and public post-incident reports — see Status. |
A formal SOC 2 audit is in progress. The Type I / Type II report will be requestable from this page when available.
Industry-specific requirements
| Need | Today | How to proceed |
|---|---|---|
| HIPAA with end-to-end BAA | Azure BAA inherited; no BAA at the ComputeSphere layer yet. | Contact [email protected] for Enterprise scoping. |
| PCI DSS | The platform is not PCI-certified. Cardholder data should be handled by Stripe or an equivalent processor — never stored in service env vars or logs. | Architect around a PCI-certified processor. We don't store cardholder data on your behalf and don't recommend you do either. |
| FedRAMP | Azure substrate is FedRAMP High; ComputeSphere is not FedRAMP-authorized. | Talk to us about your control objectives. |
| GDPR / CCPA | Inherited from Azure; ComputeSphere acts as a data processor under your DPA. | The Data Processing Agreement is part of the Terms and applies without a signature. For a copy signed by both parties, email [email protected]. |
| SOC 2 (ComputeSphere layer) | Audit in progress. | We can share interim controls evidence under NDA. |
The principle on this page: we don't claim certifications we don't hold. When the SOC 2 lands or a BAA becomes self-serve, this page is the first thing that changes.
For your audit
If your team needs evidence of ComputeSphere's controls for your own SOC 2 / ISO / customer-facing review:
| Artifact | Delivery |
|---|---|
| Sub-processor list | Public: computesphere.com/sub-processors. Earlier versions on request. |
| Architecture diagrams | Signed under NDA. |
| Controls questionnaire (CAIQ-Lite or full) | Standard turnaround on request. |
| Penetration test summaries | High-level findings on request; full reports under NDA. |
| Custom security review | Team+ customers — scope with our security team. |
Request any of the above from [email protected]. Most can be turned around within a few business days; full pen-test reports and custom reviews require an NDA on file first.
Honest limits
- No ComputeSphere-layer SOC 2 yet. The audit is in progress. Until the report is available, the substrate-level Azure SOC 2 is what's inherited.
- No HIPAA BAA at the ComputeSphere layer. The Azure-level BAA covers the substrate; the ComputeSphere layer doesn't sign one today. Talk to us if you have a regulated workload.
- Not PCI DSS-certified at the platform layer. Don't store cardholder data in service env vars, logs, or persistent storage. Use Stripe or an equivalent processor for anything that touches card data.
- Not FedRAMP-authorized. The Azure substrate carries FedRAMP High; the ComputeSphere layer above it does not.
- Customer-managed keys are Enterprise-only. See the security honest limits for KMS specifics.
Vulnerability disclosure
Report security issues to [email protected]. See Security → Reporting a vulnerability for the disclosure model, acknowledgment window, and good-faith research terms.