> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mithunai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise Compliance, SOC 2, HIPAA & Data Privacy

> MITHUNAI security controls, audit certifications, HIPAA BAA support, GDPR compliance, tenant data residency, and zero-training guarantees.

MITHUNAI maintains an enterprise-grade compliance posture designed to meet the regulatory requirements of financial institutions, healthcare providers, defense contractors, and global software enterprises. The platform operates under continuous security auditing, enforces strict cryptographic tenant separation, and provides verifiable legal guarantees that customer data is never used for LLM pre-training or fine-tuning.

```mermaid theme={"theme":{"light":"github-light","dark":"github-dark"}}
flowchart TD
    subgraph Certs["Enterprise Compliance Certifications"]
        SOC["SOC 2 Type II Certified\n(Security, Confidentiality & Availability)"]
        HIPAA["HIPAA Compliant\n(BAA Executable, PHI Safeguards)"]
        GDPR["GDPR & CCPA Compliant\n(Data Subject Rights & DPA)"]
        ISO["ISO/IEC 27001 Certified\n(Information Security Management)"]
    end

    subgraph Guards["Core Technical Controls"]
        ENC["AES-256 at Rest\nTLS 1.3 in Transit"]
        TEN["Row-Level Tenant Scoping\nCryptographic Fencing"]
        TRN["Zero-Training Guarantee\nNo Data Retention with Providers"]
    end

    Certs --> Guards
```

***

## Zero-Training & Data Custody Guarantee

Enterprise customers retain 100% intellectual property ownership over all ingested documents, code repositories, and generated conversation logs:

* **No Model Pre-Training**: Your proprietary documentation, code ASTs, and user inquiries are never used by MITHUNAI or upstream LLM providers to train or improve foundation models.
* **Provider Zero Data Retention (ZDR)**: Commercial LLM routing uses enterprise agreements that legally enforce Zero Data Retention (ZDR)—upstream providers do not cache or store query tokens after completing streaming inference.
* **Private Embeddings Storage**: All vector embeddings are stored inside your organization's isolated PostgreSQL partition and deleted permanently upon collection removal.

***

## Regulatory Frameworks

### SOC 2 Type II

MITHUNAI is audited annually by independent AICPA-accredited auditors. Our SOC 2 Type II report verifies the operational effectiveness of controls across:

* **Security**: Network firewalls, vulnerability scanning, employee background checks, and automated CI/CD security linters.
* **Availability**: 99.9% uptime SLAs with multi-AZ failover and automated disaster recovery runbooks.
* **Confidentiality**: Hard PostgreSQL multitenancy isolation where cross-tenant queries fail closed.

### HIPAA (Health Insurance Portability and Accountability Act)

For healthcare and life sciences organizations handling Protected Health Information (PHI):

* **Business Associate Agreements (BAAs)**: MITHUNAI signs BAAs with enterprise customers deploying in dedicated or sovereign cloud tiers.
* **Automated PII/PHI Redaction**: Ingestion filters redact medical record numbers, social security numbers, and patient names prior to vector embedding.
* **Dedicated Key Management**: Customer-Managed Encryption Keys (CMEK) via AWS KMS, GCP KMS, or HashiCorp Vault.

### GDPR & Global Data Privacy

* **Right to Erasure (Article 17)**: Deleting a document or collection permanently purges all raw text, chunks, and vector embeddings across all storage tiers within seconds.
* **Data Residency**: Choose between US, EU (Frankfurt / Dublin), and APAC data regions to satisfy national data sovereignty mandates.
* **Data Processing Addendum (DPA)**: Standard contractual clauses (SCCs) are incorporated into all enterprise service agreements.