COMPLIANCE
Sarah’s legal team has questions about three regulations at once.
Not “is the platform compliant?” but “show me how each one maps to your architecture.” Generic answers don’t survive that conversation.
Henoyo doesn't make compliance disappear. It sits inside the controls your privacy team already runs (your cloud, your IAM, your audit trail) so each framework can be discussed in the language they already use.
How this works in practice.
Customer-cloud deployment.
The Henoyo container runs in your AWS or Azure account, in the region you already chose. Data residency starts there.
Henoyo as processor, not controller.
Controller obligations stay with you. Henoyo is the governed application layer between your data and the model provider. Not a foundation-model provider, not a CRM.
DPA and BAA on request.
Typically signed in two business days. BAA available for HIPAA-eligible regions.
Sub-processor transparency.
Minimal, scoped, and named. Most live inside your own cloud account.
Want a specific compliance questionnaire?
DPA, BAA, technical architecture review. We typically respond within one business day.