HiveSec Engine is built for procurement.

Conditional invocation.

AI agents are engaged only where the underlying assessment data has materially changed. A stable environment that has not changed since the previous assessment run does not trigger AI inference.

Per-tenant configuration.

The operator can disable AI involvement at the tenant level. Assessments run end-to-end through deterministic execution paths without any data leaving HiveSec Engine's AWS environment.

AI-free engagements.

Customers and partners that require AI-free assessment for regulatory, contractual or organisational reasons can be served end-to-end on the same platform without AI invocation.

Multi-tenant by design.

Every organisation on the platform is a tenant within a hierarchical model. Tenant isolation is enforced at every layer: data, access, communication, configuration.

Access control and isolation.

Platform access is governed by role and resolved per request. Tenants are isolated from one another; principals cannot access or enumerate resources outside their authorised scope.

Serverless and ephemeral compute.

Workloads exist for the duration of their use and are reclaimed afterwards. There is no long-running shared infrastructure within which one tenant's data could persist into another's request.

Infrastructure as code.

Every infrastructure component is defined in code and version-controlled. No manual changes are made to the production environment.

Encryption at rest.

All persistent data is encrypted at rest. Stored artefacts use AES-256.

Encryption in transit.

All communication with the platform is over HTTPS. Internal service-to-service communication is encrypted in transit.

Data residency.

Customer data is stored in the AWS region specified for the engagement. Deployments are available in the following regions:

Data retention.

Retention of assessment data (findings, evidence, scan outputs) is configurable at the tenant or engagement level. The retention period is agreed in engagement scoping rather than imposed by a platform default, letting the operator and the client align it with their own regulatory, contractual or operational requirements.

Audit log retention is held separately and follows a longer schedule. Audit data (user actions, finding state changes, assessment events, communications) is retained for seven years by default to support compliance, regulatory and historical-review requirements.

Customer-initiated deletion is supported. Timing of deletion, including any retention obligations that may apply, is confirmed in writing during engagement scoping.

Sensitive content handling.

Findings and artefacts containing sensitive technical or organisational information are subject to the same access controls as the engagement they belong to. Sharing of artefacts outside the engagement requires explicit action and is recorded in the audit trail.

Identity provider.

Authentication is via Amazon Cognito with federation to enterprise identity providers: Google Workspace, GitHub, and SAML-based providers including enterprise single sign-on. There is no self-registration; users are provisioned by an administrator.

Session management.

Access tokens are short-lived. Refresh tokens are bounded and revocable. Sessions are scoped to the identity provider's session policies where federation is in use.

Domain restriction.

Organisations may restrict invitations to specified email domains. The platform validates the domain of every invited user against the organisation's allowed list.

External client access.

Client contacts who receive briefings or disclosure notifications access the relevant view via a single-use, time-limited secure link. They do not receive a platform account. Links are bound to a specified email address; the email is verified before access is granted. Every issuance, verification and use of a link is recorded in the audit trail.

Amazon Web Services.

Compute, storage, database, authentication, transactional email, and other foundational services. The platform's production environment is operated entirely within AWS.

Anthropic.

Large language model inference used in the analytical phases of HiveSec Engine's assessment methodologies. Inference is invoked only where the underlying assessment data has materially changed and reasoning is required; deterministic execution paths complete without involvement of the Anthropic or any other AI provider.