Compliance and audits
Your rules, checked on every release
Hamming checks your agent against the regulations it must follow, starting before launch.
Frameworks
The regulations your agent must follow.
- HIPAA, PCI, and GDPR
- Industry-specific regulations
Sensitive data
Handling of sensitive customer information.
- PHI and PII redaction
- US-only data residency, with single-tenant deployment for stricter isolation
- Role-based access to production calls
Audit trail
Every evaluation on the record, ready when an auditor asks.
- Every test run, configuration change, and user action, timestamped with who ran it and with what parameters
- The complete input and output of each run
- Audit logs exported via webhooks to your SIEM
Reports anyone can read
Reports that show what was tested, what failed, and what was fixed.
Findings
3 findings · 1,240 scenarios · release 2.401 / Critical, up close
Agent · 00:41
“Sure, the card on file ends in 4417.”
Caught before release· regression test added, reruns on every release
Compliance reporting
Evidence of compliance, generated automatically.
- Documented agent behavior and performance
- Evidence for regulators
- Compliance metrics tracked over time, as proof of continuous monitoring
Security reports
Your agent's security posture, documented.
- Security findings and their status
- The fix recommended for each
- Improvements over time
Stakeholder reports
The right level of detail for each audience.
- Custom reports for each stakeholder
- Summaries for executives
Hamming works with
All integrations
Questions about
compliance.
Browse every answer on the FAQ pageNo. We do not sell customer data or train on it. It is used to provide the service to you, and for nothing else.
Yes. Hamming signs BAAs and supports HIPAA-aligned workflows and PHI/PII redaction options. We support US-only data residency by default, with single-tenant deployment available for stricter isolation.
Our RBAC system lets you restrict PHI data access to authorized personnel while giving contractors access to testing environments only.
Hamming is SOC 2 Type II certified. We support SSO with Okta, Microsoft Entra ID, and Google Workspace, role-based access control per workspace, and customer-managed encryption keys for single-tenant deployments.
Enterprise customers can request our security packet, including penetration test results and architecture documentation.
Yes. Hamming generates detailed reports showing test coverage, pass rates, failure analysis, and trend data. Reports can be exported as PDFs for stakeholder reviews or regulatory audits.
Use these reports to demonstrate testing methodology, prove agent reliability, and document your voice AI governance process.
By default, all Hamming data stays in the United States. We also offer EU clusters for GDPR compliance. Single-tenant deployments can be provisioned in your preferred region with complete data isolation.
Data retention is configurable per workspace, from 7 days to unlimited, with PII and PHI redaction options at ingestion.
Related
reading.
- HIPAA-Compliant Voice Agents: How to Build and Test SafelyComplete guide to building and testing HIPAA-compliant voice agents.
- HIPAA PHI Clinical Workflow Testing ChecklistStep-by-step checklist for testing healthcare voice agent workflows.
- SOC 2 Compliance for Voice AIHow Hamming achieved SOC 2 compliance for enterprise voice AI testing.
- AI Voice Agent Compliance & SecuritySecurity best practices for enterprise voice agent deployments.
- An Introduction to Voice Agent GuardrailsHow guardrails protect voice agents from compliance and security risks.
- 5 Failure Modes That Make Voice Agents Unsafe in Clinical SettingsCritical failure modes to test for in healthcare voice deployments.