# Hawcx security and trust, what we hold, and what we don’t.

> How Hawcx keeps credentials out of AI agents and passwords out of sign-in, plus the status of every security document and how to request it.

Markdown version of <https://www.hawcx.com/security>. Last updated 2026-10-07.

Hawcx keeps credentials out of your AI agents and passwords out of sign-in. Here is how, and where every security document stands.

- 0 passwords stored: People sign in with a key on their own device. There’s nothing to type.
- 0 private keys held: Each key stays on the device it was made on.
- 0 credentials in agents: Issued per call, never stored in an agent.

## Compliance and standards. Audited today, built for what’s next.

Hawcx is SOC 2 Type II compliant. Compliance documentation and audit support are shared on request.

- **SOC 2 Type II**: Enterprise-grade security controls, with compliance documentation and audit support. Compliant
- **Crypto-agile**: Designed to adopt NIST-approved post-quantum algorithms without re-architecture. By design
- **Zero-knowledge**: Proof happens on the device. No central credential store for attackers to target. By design

## Three failures, planned for. And what happens in each.

Security that doesn’t depend on everything going right.

- Every agent tool call is checked outside the model, so an injected prompt can’t grant itself access.
- There’s no password database to take. People sign in with a key that never leaves their device.
- Every agent action, allowed or not, leaves a signed record you can check later.

## Every document, with its status. Ask for what your review needs.

Reports and agreements are shared on request. Policies are public.

### Reports

- SOC 2 Type II documentation: On request: [Request](https://www.hawcx.com/contact)
- Penetration test summary: On request: [Request](https://www.hawcx.com/contact)
- Architecture and data-flow notes: On request: [Request](https://www.hawcx.com/contact)

### Agreements

- DPA, MSA and security questionnaires: On request: [Request](https://www.hawcx.com/contact)
- Sub-processor list: On request: [Request](https://www.hawcx.com/contact)
- Support and SLA terms: On request: [Request](https://www.hawcx.com/contact)

### Policies

- Privacy policy: Public: [Read](https://www.hawcx.com/privacy-policy)
- Terms of service: Public: [Read](https://www.hawcx.com/terms-of-service)

## Security questions, answered

- [AI agent authorization](https://www.hawcx.com/ai-agents/authorization)
- [Passwordless authentication](https://www.hawcx.com/passwordless)
- [Hawcx for Enterprise](https://www.hawcx.com/enterprise)

### Is Hawcx SOC 2 Type II compliant?

Yes. Hawcx is SOC 2 Type II compliant, with compliance documentation and audit support for your review. Request them from the documents list on this page.

### Is Hawcx ready for post-quantum cryptography?

Yes. Hawcx is crypto-agile: it’s designed to adopt NIST-approved post-quantum algorithms without re-architecture or service disruption.

### How do I request Hawcx security documents?

Choose Request beside a document, or send one security review request through our contact page that lists everything your review needs.

### Does Hawcx store your users’ passwords or private keys?

No. People who sign in with Hawcx have no password, and the private key on each of their devices is never exported or shared. Biometrics stay on the device.

### What happens if a Hawcx server is breached?

There are no passwords to take, because people sign in with a key on their own device. AI agents get credentials issued per call, so none are stored in any agent.

### How does Hawcx stop a tricked AI agent?

Every tool call is checked outside the model before it reaches the tool, against the person the agent acts for. A prompt can change what an agent asks for, not what it is allowed to do.