---
title: "Trust Center"
canonical: "https://hikariblue.com/trust"
language: en
publisher: "Hikari Blue, a trademark of UNITED4 LLC"
date: "2026-09-07"
date_source: "page: Last updated"
generator: "scripts/build/make-llms.mjs from trust.html, review date 2026-10-02; do not edit by hand"
---

# Engineered for audit. Honest about certification.

Trust Center · Updated 2026-Q3

Last updated 2026-09-07

We do not publish certifications we have not earned. This page is what an enterprise security team, a privacy officer, a regulator or a procurement lead needs to evaluate Hikari Blue. Nothing is behind a sales gate. Everything material is here.

Owner: Compliance practice · Next review: 2026-Q4 · [direct email](https://hikariblue.com/contact?intent=compliance)

[Request the trust pack under NDA](https://hikariblue.com/contact?intent=compliance)

Includes: security posture, data residency model, AI audit-trail approach, sub-processors list, DPA template, compliance roadmap.

Canonical web version: https://hikariblue.com/trust. This Markdown is generated from that page at build time; the page prevails.

## Standards posture

**Where we stand, in plain language.**

Status is current as of publication. We do not pre-announce, we do not market certifications we have not earned, and we do not retrofit evidence the week before an audit.

| Standard | Status | Evidence |
|---|---|---|
| SOC 2 Type II | In preparation | Control mapping documented across availability, confidentiality and processing integrity. The audit program has not started; the start date is published here when the auditor is engaged. We do not publish certifications we have not earned. |
| ISO 27001 | Target 2027 | Information security management system documented. Statement of Applicability draft maintained. Certification audit targeted for 2027. |
| GDPR & CCPA | Available | Privacy notice published. DPA available on request. Sub-processors list maintained (see below). Data subject request procedure documented. |
| EU AI Act | Architecture property | Hikari Blue Ops engineered to produce audit-trail evidence required by the regulation. Not a certification: an architecture property. Article 12 (record-keeping) and Article 14 (human oversight) addressed by design, ahead of the high-risk deadline moved to 2 December 2027 by the July 2026 Digital Omnibus. Article 50 transparency duties and general-purpose model supervision apply since 2 August 2026. **Article 4 (AI literacy)** is operationalized through dated, role-resolved training paths, in force since 2 February 2025. [See the literacy delivery path](https://hikariblue.com/training) |
| DORA / NIS2 | Engagement-scoped | Engagements in financial services and critical infrastructure include scoped DORA / NIS2 readiness work: ICT risk register, third-party concentration, incident reporting timelines, resilience testing alignment. |
| HIPAA / MDR | Engagement-scoped | Healthcare engagements include scoped HIPAA (US) and MDR (EU) readiness: PHI handling, BAA template, software-as-medical-device classification framework, post-market surveillance design. |
| Audience measurement | Sovereign, live | First-party, anonymized, cookieless. No Google Analytics, no tag manager, no third-party trackers. Designed to meet the CNIL audience-measurement exemption; Do Not Track, Global Privacy Control and on-site opt-out honored. Data lives on our infrastructure, purged on a 25-month schedule. [See the privacy notice](https://hikariblue.com/privacy) |

[Request the full compliance roadmap under NDA](https://hikariblue.com/contact?intent=compliance)

## Sub-processors

**Who else can touch your data, and why.**

Sub-processors are explicitly scoped to the workload. Engagements requiring strict residency or zero-cleartext processing run on a reduced subset documented in the engagement-specific DPA addendum.

| Sub-processor | Purpose | Region |
|---|---|---|
| Anthropic | LLM inference for Hikari Blue Ops, when Claude model selected. | US · EU |
| OpenAI | LLM inference, when GPT model selected. Enterprise tier, zero retention. | US |
| Mistral AI | LLM inference, when Mistral model selected. Sovereign EU option. | EU |
| Google Cloud | Optional compute and Gemini model inference, engagement-scoped. | US · EU · Asia |
| Netlify | Edge hosting for hikariblue.com and engagement static surfaces. Inbound form capture. | Global edge |
| Cloudflare | DDoS mitigation, WAF, edge cache. No origin traffic decryption. | Global edge |
| MailerLite | CRM and lead routing for inbound forms. Transactional delivery emails; editorial communications with separate opt-in only. Sub-processor DPA in place. | EU |

Sub-processors list maintained quarterly. Material changes notified to engagement clients with thirty-day notice. [Request the engagement-specific list](https://hikariblue.com/contact?intent=compliance)

## Data residency

**Residency by design, not by sales motion.**

Data residency is selectable per workload at engagement time, not retrofitted after audit. The architecture supports the strictest applicable framework, not the average.

| Region | Default posture | Available stricter postures |
|---|---|---|
| European Union | EU-residence compute, EU-residence storage, EU-residence model inference (Mistral or Anthropic EU). | France HDS, Germany BSI C5 |
| United States | US-residence compute and storage. Standard SOC 2 control set. | FedRAMP-aligned, HIPAA scope |
| Mainland China | In-country compute and storage via partner. Cross-border transfer controls per PIPL. | PIPL strict |
| Switzerland | Swiss-residence compute and storage, or on-prem deployment. Aligned to the revised FADP (nLPD) and FINMA outsourcing expectations for supervised institutions. | nLPD, FINMA outsourcing |
| United Kingdom | UK-residence compute and storage. UK GDPR baseline. | NHS DSP toolkit |

## Security architecture

**Six properties of the operating layer.**

### Encryption

TLS 1.3 in transit. AES-256 at rest. Key rotation on a 90-day cycle. Customer-managed keys available for sensitive workloads.

### Access control

Least-privilege by default. Quarterly access review. SSO/SAML and MFA enforced on all operator accounts. Just-in-time elevation for sensitive operations.

### Audit trail

Every action, every tool call, every model output, every operator override. Immutable, queryable, exportable. Retained per engagement contract, minimum twelve months.

### Kill switch

Per workload, per model, per user. Halt, throttle or roll back in seconds. Tested quarterly. Not a feature retrofitted before audit: a property of the architecture.

### Vulnerability management

Dependency scanning on every build. Third-party penetration testing on the cycle defined per engagement, annual minimum, quarterly for high-risk workloads. Patch SLAs aligned to CVSS severity.

### Operator training

Annual security and privacy training. Confidentiality and data handling rehearsed on every engagement kick-off. Background checks for senior operators on sensitive engagements.

## Incident response

**If something breaks, here is what happens.**

We treat incident response as part of the operating model, not as a PR exercise. The procedure is documented, rehearsed, and traceable in the audit trail.

### 01 · Detect

Observability on every production workload. Anomaly alerts on token cost, latency, error rate, and unusual prompt patterns. Operator on-call across three time zones.

### 02 · Contain

Kill switch engaged at workload, model or user level. Affected scope identified within thirty minutes. Customer informed via the engagement channel within one hour for material incidents.

### 03 · Investigate

Audit trail walked end-to-end. Root cause documented. Forensic export available to customer security team on request. Coordinated disclosure if regulator notification required.

### 04 · Resolve and retire

Permanent fix shipped with regression test. Lessons-learned memo signed by the named partner. Procedure updated. Customer post-mortem within two business days for material incidents.

Regulator notification timelines (GDPR 72h, DORA 4h major incident, NIS2 24h early warning) are pre-mapped per engagement. The framework is part of the engagement DPA, not a discovery during the incident.

## Responsible disclosure

**Found a vulnerability? Tell us first.**

We welcome coordinated vulnerability disclosure from researchers, customers, and operators. We commit to acknowledge within two business days, triage within five, and publish a coordinated disclosure when fix is shipped.

### Report a vulnerability

[direct email](https://hikariblue.com/contact?intent=security)

PGP key available on request. We do not pursue legal action against good-faith security research conducted under the Hikari Blue safe-harbor terms.

### Scope

hikariblue.com, hikariblue.com sub-domains, Hikari Blue Ops platform (production), engagement-specific surfaces under explicit authorisation.

Out of scope: third-party sub-processor surfaces (report to vendor directly), DOS attacks, social engineering, physical surfaces.

## Privacy & DPA

**Privacy is a contract property, not a marketing posture.**

### Privacy notice

Published. Covers what we collect on hikariblue.com (theme/language preferences in localStorage, plus sovereign first-party audience measurement: anonymized, cookieless, no third-party trackers), how we handle inbound forms (Netlify Forms, routed to our MailerLite CRM with an email notification to a named partner), and retention.

[Read the privacy notice](https://hikariblue.com/privacy)

### Data Processing Agreement (DPA)

Standard DPA template available on request. Includes engagement-scoped sub-processors annex, Standard Contractual Clauses (EU), and incident notification timelines aligned to GDPR / DORA / NIS2.

[Request the DPA template](https://hikariblue.com/contact?intent=compliance)

### Sub-processors notification

Material sub-processor changes notified with thirty-day notice to engagement clients via the contracted communication channel.

### Data subject requests

Procedure documented for access, rectification, deletion, portability and objection. Response within thirty days, ten days when statutory.

[direct email](https://hikariblue.com/contact?intent=privacy)

## Legal & contractual framework

**The four contractual questions a Procurement team asks before signing.**

Published here so the RFP starts at question five. Our MSA template incorporates each of these as a baseline. Sector-specific addenda for Financial Services, Healthcare and Luxury available on request.

### Liability framework

Standard cap at the value of the engagement, computed on the executed Statement of Work. Carve-outs for confidentiality breach, gross negligence and IP infringement follow Texas commercial code defaults. Sector-specific uplift available where regulation requires (DORA-scoped engagements, HIPAA-covered work, EU AI Act high-risk classification).

### IP ownership at exit

All custom code, custom models, fine-tunes, prompt libraries, runbooks and operating documentation produced under the engagement belong to the client at exit. Hikari Blue retains a non-exclusive licence to internal frameworks and reusable components, listed exhaustively in MSA Appendix A. No black box. No surprise licence fee at handover.

### Audit rights

The client is entitled to one scheduled annual audit of Hikari Blue operations relevant to the engagement, plus any regulator-mandated audit (DORA, NIS2, HIPAA, MDR, sector authority). Scope, notice period and confidentiality terms defined in DPA. Cooperation extends to sub-processors via flow-down clauses.

### MSA template

Master Services Agreement template available under NDA, in English and French. Includes: services and SOW process, fees and invoicing, IP, confidentiality, data processing (links to DPA), liability cap and carve-outs, term and termination, dispute resolution. Negotiation governance: a named partner reviews any deviation request inside seventy-two hours.

[Request the MSA template under NDA](https://hikariblue.com/contact?intent=compliance)

## Insurance & financial posture

**Coverage that matches the work we sign.**

Certificates and carrier names available under NDA. The summary is published here so RFP review does not stall on insurance attachments.

### Professional liability (Errors & Omissions)

Coverage scaled to the typical engagement value bracket. Sector-specific limits available where required by client framework or regulation. Carrier is a Tier-1 international underwriter, named in MSA Appendix B.

### Cyber liability

Coverage includes first-party incident response, notification costs, regulatory defence costs, business interruption and third-party claims. Scoped to the technical perimeter of each engagement. Aligned with DORA and NIS2 incident response timelines published in section 5 of this page.

### General commercial liability

Standard commercial general liability coverage held against UNITED4 LLC. Certificates of Insurance available to client procurement and risk teams within forty-eight hours of NDA execution.

### Financial standing

UNITED4 LLC registered in Texas, USA. Hikari Blue brand founded in Europe in 2016, US trademark registered in 2025. Bank references and current financial standing letter available under NDA. Annual financial report from fiscal year 2026 onward.

[Request insurance and financial pack under NDA](https://hikariblue.com/contact?intent=compliance)

## Supply chain security

**Build provenance, signed. Keys, customer-held.**

The supply chain controls a CISO needs in front of a board, beyond perimeter security and incident response.

### SBOM per engagement

Software Bill of Materials generated and signed for every production build of every engagement we sign. Format: SPDX or CycloneDX, client preference. Includes direct and transitive dependencies, license inventory, known CVE status at build time. Delivered with each release and on demand for incident response.

### SLSA Level 3 by default

Build pipelines aligned with SLSA Level 3 supply chain integrity: hermetic builds, signed provenance, isolated build environments, two-party review on protected branches. SLSA Level 4 available where the client risk profile and regulator (DORA Article 28, NIS2 Article 21) require it.

### Customer-managed keys (CMK)

Supported for production engagements on AWS KMS, Azure Key Vault, GCP KMS and HashiCorp Vault (self-hosted or HCP). Key material remains in client custody at all times. Hikari Blue holds operational role bindings, never key material. Documented in DPA technical annex.

### Third-party security assessments

External penetration test summary available under NDA, refreshed on the cycle defined per engagement (annual minimum, quarterly for high-risk workloads). SIG Lite and CAIQ Lite questionnaires available for vendor risk programs. Custom risk questionnaires accepted with forty-eight hour turnaround.

[Request pentest summary and SBOM sample under NDA](https://hikariblue.com/contact?intent=compliance)