Hawcx security and trust, what we hold, and what we don’t.
Hawcx keeps credentials out of your AI agents and passwords out of sign-in. Here is how, and where every security document stands.
-
0passwords storedPeople sign in with a key on their own device. There’s nothing to type.
-
0private keys heldEach key stays on the device it was made on.
-
0credentials in agentsIssued per call, never stored in an agent.
Compliance and standards.Audited today, built for what’s next.
Hawcx is SOC 2 Type II compliant. Compliance documentation and audit support are shared on request.
SOC 2 Type II
Enterprise-grade security controls, with compliance documentation and audit support.
CompliantCrypto-agile
Designed to adopt NIST-approved post-quantum algorithms without re-architecture.
By designZero-knowledge
Proof happens on the device. No central credential store for attackers to target.
By design
Three failures, planned for.And what happens in each.
Security that doesn’t depend on everything going right.
-
Every agent tool call is checked outside the model, so an injected prompt can’t grant itself access.
-
There’s no password database to take. People sign in with a key that never leaves their device.
-
Every agent action, allowed or not, leaves a signed record you can check later.
Every document, with its status.Ask for what your review needs.
Reports and agreements are shared on request. Policies are public.
Reports
Agreements
Security questions, answered
Is Hawcx SOC 2 Type II compliant?
Yes. Hawcx is SOC 2 Type II compliant, with compliance documentation and audit support for your review. Request them from the documents list on this page.
Is Hawcx ready for post-quantum cryptography?
Yes. Hawcx is crypto-agile: it’s designed to adopt NIST-approved post-quantum algorithms without re-architecture or service disruption.
How do I request Hawcx security documents?
Choose Request beside a document, or send one security review request through our contact page that lists everything your review needs.
Does Hawcx store your users’ passwords or private keys?
No. People who sign in with Hawcx have no password, and the private key on each of their devices is never exported or shared. Biometrics stay on the device.
What happens if a Hawcx server is breached?
There are no passwords to take, because people sign in with a key on their own device. AI agents get credentials issued per call, so none are stored in any agent.
How does Hawcx stop a tricked AI agent?
Every tool call is checked outside the model before it reaches the tool, against the person the agent acts for. A prompt can change what an agent asks for, not what it is allowed to do.