Skip to main content
Akhara sits in the execution path of your agents. Every consequential step passes through the gateway before it runs, which means the gateway itself has to clear a higher bar than a dashboard or a log pipeline: it must be locked down, provable after the fact, and deployable inside your own network boundary when the data cannot leave. This section documents that posture across the whole suite (Environments, Control plane, Evaluation, Expert Review).

​
What is covered where

Runtime enforcement itself, the part of the product that acts as a security control (fail-closed verification, latches on consequential actions, signed evidence, trajectory capture), is documented in the Control plane docs: see interception and audit and evidence.

​
Compliance

Certification programs are underway; none are complete yet, and we state them that way:
  • SOC 2 Type II: in progress
  • HIPAA: BAA program in progress for customers handling PHI; see the PHI/PII handling model in the Evaluation docs for how the product treats PHI today
  • HITRUST CSF: in progress
For current status, a completed security questionnaire (CAIQ, SIG), or a DPA, contact [email protected].

​
Reliability

The managed cloud runs on AWS across multiple regions: a primary US region, a hot standby for disaster recovery, and a dedicated EU region for data residency. DNS-level health checks route around a failed region, databases run multi-AZ, and backups are encrypted and replicated cross-region. Live status and incident notifications are published at status.akhara.ai. Because the control plane is fail-closed, availability is also a safety property: if your runtime cannot reach the PDP, consequential actions are blocked rather than waved through.