> ## Documentation Index > Fetch the complete documentation index at: https://docs.hana.health/llms.txt > Use this file to discover all available pages before exploring further. # Cyber-Intelligence Overview > Enterprise-grade security standards with comprehensive compliance certifications, defense-in-depth architecture, and AI-specific safety controls. ## Overview HANA maintains enterprise-grade security standards with comprehensive compliance certifications, including SOC 2 Type II, HIPAA, and GDPR. Our platform leverages cloud infrastructure to provide robust encryption, secure communications, and continuous monitoring, ensuring optimal data protection for healthcare customers. ### Compliance Certifications | Certification | Status | Coverage | Scope | | ------------- | ------------------------------------------------------------------ | --------------------------------------- | ---------------------------------------------------------------------------------- | | SOC 2 Type II | ✅ Audited controls for security, availability, and confidentiality | Complete annual cycle audit | Comprehensive evaluation of trust service principles | | HIPAA | ✅ Continuously monitored | US healthcare data privacy regulations | Essential for healthcare providers, insurers, and medical technology | | GDPR | ✅ Continuously monitored | EU personal data protection and privacy | Global compliance for handling EU citizen data with privacy-by-design architecture | ## Security Architecture ### Multi-layered Defense Strategy Our cyber-intelligence framework implements multiple layers of defense to ensure comprehensive protection: 1. **Perimeter Security**: Advanced threat detection at network boundaries using intrusion detection/prevention systems 2. **Infrastructure Security**: Hardened cloud infrastructure with restricted access controls 3. **Application Security**: Secure development practices with regular code audits and vulnerability assessments 4. **Data Security**: End-to-end encryption with sophisticated key management 5. **Operational Security**: Continuous monitoring with real-time alerts and automated remediation ### Data Encryption All data within the HANA platform is protected using industry-leading encryption standards: * **Storage Encryption**: AES-256 with cloud-managed encryption keys * **Communication Encryption**: TLS 1.3 enforced for all traffic * **Key Management**: Cloud KMS integration with strict access controls * **PHI Protection**: Special handling for protected health information with additional encryption layers ### Network Security * **Protocol Security**: HTTPS enforced across all endpoints * **SSL Configuration**: Comprehensive SSL certificate deployment * **Traffic Protection**: End-to-end encrypted communications * **API Security**: Rate limiting, token-based authentication, and request validation ### Service Architecture Integration HANA's cyber-intelligence capabilities are deeply integrated with our service architecture: 1. **Service Mesh Security**: Secure service-to-service communication with mutual TLS 2. **Zero Trust Implementation**: Verification of every request regardless of source 3. **Centralized Policy Enforcement**: Consistent security policies across all services 4. **Observability**: Comprehensive logging and monitoring for security events ## AI-Specific Security Controls ### Model Safety Mechanisms HANA implements specialized security controls for AI components: 1. **Input Sanitization**: Advanced filtering to prevent prompt injection and other attacks on conversation engine 2. **Output Monitoring**: Automated content scanning for sensitive information leakage in voice responses 3. **Runtime Isolation**: Containerized execution environments for model inference 4. **Model Versioning**: Strict version control with cryptographic verification for all model artifacts 5. **AI Vulnerability Management**: Dedicated monitoring for AI-specific threats ### LLM Safety Framework * **Jailbreak Prevention**: Constrained generation architecture prevents conversation engine from operating outside protocol boundaries * **Continuous Validation**: Automated testing against known attack vectors for voice AI systems * **Red Team Exercises**: Regular adversarial testing focused on clinical AI vulnerabilities * **Content Filtering**: Multi-stage filtering for harmful or clinically inappropriate outputs ## Security Controls Framework HANA maintains a comprehensive security controls framework across multiple domains: **Access Control & Authorization (30+ Controls)** * Comprehensive access control procedures * Infrastructure modification restrictions * Regular access reviews and audits * Role-based access control with least privilege principles **Data Privacy & Security (60+ Controls)** * Comprehensive data protection procedures * Anonymization and pseudonymization processes * Data retention and disposal policies * Secure data transfer mechanisms **Risk & Incident Management (30+ Controls)** * Incident response procedures * Risk assessment frameworks * Vendor risk management * Business continuity planning **IT & Operational Security (25+ Controls)** * Application monitoring and alerting * Asset management procedures * Disaster recovery planning * Change management processes ## EU AI Act Compliance The European Union's AI Act classifies AI systems that affect access to healthcare as **high-risk applications**. This includes AI systems involved in patient triage, clinical decision support, prior authorization, and any scenario where an AI output could influence a patient's access to care. ### Current Status HANA is actively working toward full EU AI Act compliance for healthcare deployments in Europe: * **Risk classification assessment**: Mapping HANA's capabilities against the AI Act's high-risk categories to determine registration requirements per use case * **Conformity assessment preparation**: Documenting technical architecture, safety measures, and quality management systems required for high-risk AI registration * **EU database registration**: Preparing for registration in the EU database of high-risk AI systems as required before production deployment with EU patients ### Use Case-Specific Classification Not all HANA deployments carry the same regulatory classification under the AI Act: | Use Case | AI Act Classification | Registration Required | | ------------------------------------------------- | --------------------- | --------------------- | | Appointment reminders, scheduling | Lower risk | No | | Pre-operative preparation follow-up | Lower risk | No | | Clinical screening (PHQ-9, GAD-7) | Potentially high risk | Under assessment | | Prior authorization / insurance verification | High risk | Yes | | Clinical decision support influencing care access | High risk | Yes | ### What This Means for EU Customers * **Non-high-risk use cases** (appointment management, preparation reminders, general outreach) can proceed under standard GDPR compliance * **High-risk use cases** (anything involving clinical decisions that affect care access) require HANA to be registered in the EU AI Act database before production deployment — including POC/pilot phases with live patients * HANA works with EU customers during scoping to classify the intended use case and determine the regulatory pathway For EU healthcare organizations evaluating HANA: we recommend discussing your intended use case during the scoping phase so we can provide a clear regulatory timeline. Some use cases can proceed immediately; others require registration that we are actively pursuing. *** ## Contact Information For security inquiries or compliance requests: * Security Team Email: [security@hana.health](mailto:security@hana.health) * Response Time: Standard business hours * Documentation Access: Available upon request through our trust center