AEGIS is not just a monitoring layer. It's an engine that checks, signs, and locks in evidence for 158 controls across 12 regulatory frameworks on its own, with no human hand on the evidence chain. The system builds the bundle your auditor reads.
Most compliance tools scan your infrastructure and watch for problems. They flag things that look wrong. But they don't sign anything, lock anything in, or create proof you can check that shows the control's real state at a specific moment. That gap between watching and proving is what makes audits expensive.
Each control goes through a five-stage pipeline. It runs on STM32N6 (Arm Cortex-M33, hardware AES-256). It typically takes 6.5 ms from starting the check to having a signed envelope ready to export.
When your auditor reviews AEGIS evidence, they're reading outputs the system signed, not notes a person put together from screenshots. The SHA3-256 digest ties the evidence to the control's real state at the moment it was checked. The Ed25519 and ML-DSA-65 signatures prove the digest hasn't changed since the system created it. The Base L2 anchor stamps a timestamp on-chain that nobody can fake or backdate. No part of the evidence chain depends on a person holding onto it.
{
"control_id": "CC6.1",
"pass": true,
"score": 1.0,
"duration_ms":6.53,
"sha3_256": "99f432dd70f9cd54a3b2e1078fdf44c2a73b...",
"ed25519": "3O7pN2XqR1sK9vA...base64-truncated...",
"ml_dsa_65": "MIIBIjANBgkqh...base64-truncated...",
"anchored_at":"2026-05-08T00:00:00Z",
"chain": "base",
"block": 18447293
}
Vanta, Drata, and Secureframe are monitoring tools. They watch your infrastructure and build dashboards showing where you stand. AEGIS is a proof engine. This isn't just a marketing difference. It changes what evidence your auditor can actually rely on.
| Capability | Vanta / Drata / Secureframe | Hive AEGIS / HIVECOMPLY |
|---|---|---|
| Approach | Continuous monitoring (infrastructure observation) |
Continuous attestation (system signs its own evidence) |
| Evidence format | Compliance posture dashboard; screenshots; human-assembled logs | Machine-signed JSON envelopes with SHA3-256 + Ed25519 + ML-DSA-65 |
| SOC 2 report production | ✕ Human CPA firm produces the report; tool supplies supporting data | ✓ AEGIS-Report produces the auditor-ready evidence bundle; CPA reviews machine output |
| Cryptographic signatures on evidence | ✕ None. Logs are unsigned records | ✓ Ed25519 + ML-DSA-65 on every envelope; SHA3-256 integrity digest |
| Post-quantum readiness | ✕ Not offered | ✓ TACHYON ML-DSA-65 (FIPS 204) + SLH-DSA on every signed artifact |
| On-chain anchoring | ✕ Not offered | ✓ AEGIS-Seal anchors bundles on Base L2 with tamper-evident timestamp |
| Frameworks covered | ● SOC 2, ISO 27001, HIPAA, GDPR (broad but shallow) | ✓ 12 frameworks natively: SOC 2, ISO 27001/17/18/701/36, 42001, EU AI Act, GDPR, eIDAS 2.0, NIS2, DORA |
| Cross-framework leverage | ✕ Manual consultant spreadsheet | ✓ 2.32x built in. One control setup satisfies an average of 2.32 framework requirements |
| Speed per control | ● Periodic scans (hourly or daily); no real-time audit capability | ✓ 6.5 ms per control via POST /v1/aegis/control/audit |
| Full-fleet scan time | ● Hours for a full evidence collection pass | ✓ 460 ms for all 158 controls |
| Physics-based entropy source | ✕ Not applicable | ✓ MAPET-X: 24-axis physics entropy (terrestrial, quantum optic, subatomic, bio, cosmic, agricultural) |
| Cryptographic deletion proofs | ✕ Not offered | ✓ Signed deletion envelopes via AEGIS-Report; auditable proof that data was erased |
| Swarm-validated entropy provenance | ✕ Not applicable | ✓ T-THRESH consensus across distributed nodes before entropy is admitted to key generation |
| Self-verify with curl | ✕ Proprietary dashboard only; no open inspection endpoint | ✓ curl -s https://receipts.thehiveryiq.com/v1/aegis/score |
Vanta, Drata, and Secureframe are effective tools that serve many organizations well. This comparison just points out the structural differences in how each approach builds evidence, not general product quality. Both approaches still need a CPA firm for a formal SOC 2 Type 1 or Type 2 opinion.
AEGIS is made of seven separate pieces, each with its own job. They share a common audit bus and a signing key built from MAPET-X randomness.
The main check runner. It takes a control ID through POST /v1/aegis/control/audit, runs the check against your live system, captures the pass or fail result, computes the SHA3-256 digest, and hands the envelope to the signing chain. Target speed: 6.5 ms typical, under 500 ms at the outside.
Runs all 158 controls in one coordinated pass via POST /v1/aegis/scan. It runs controls at the same time when it can, and in order when the order matters. The full run finishes in 460 ms. Results get rolled up into a framework-level matrix.
Works out the weighted composite score across all frameworks. You can pull it via GET /v1/aegis/score. The score reflects the current machine-checked and self-attested control states. Current composite: 96.2. 32.9% of controls are machine-checked.
Packages signed envelopes for export through HIVECOMPLY (POST /v1/hivecomply/bundle/export and POST /v1/hivecomply/bundle/verify). The output is a JSON archive with every control result, every signature, and the MAPET-X randomness proof. The auditor can check the bundle without touching your internal systems.
Translates back and forth with outside governance, risk, and compliance platforms. It takes in outside compliance events via POST /v1/hivecomply/event/ingest. It exports in formats that work with common GRC toolchains. You don't have to rip out your existing GRC tools to use it.
Tracks how each framework's score moves over time. It flags controls trending toward failure before they cross the line. You can pull it via GET /v1/aegis/matrix and the HIVECOMPLY framework map. It gives your compliance team a heads-up instead of a surprise after the fact.
Locks each signed evidence bundle onto Base L2 (EIP-4844 compatible). The on-chain record stamps a timestamp that nobody can backdate. The transaction hash is included in the evidence bundle, so auditors have their own way to check it through the public Base block explorer. Treasury: 0x15184Bf50B3d3F52b60434f8942b7D52F2eB436E.
The cross-framework layer that ties it all together. It maps each control to every regulation it satisfies via GET /v1/hivecomply/framework/map and GET /v1/hivecomply/control/status. It works out the 2.32x leverage ratio. It tracks SOC 2 TSC 2017, ISO 27001:2022, ISO 27017, 27018, 27701, 27036, 42001, EU AI Act, GDPR, eIDAS 2.0, NIS2, and DORA in one place.
HIVECOMPLY maps every control you set up to every regulation it satisfies. The cross-framework leverage ratio is 2.32x. One setup satisfies an average of 2.32 framework requirements. Total mapped controls: 158.
All endpoints are live at https://receipts.thehiveryiq.com. Health checks don't need a login. Audit and scan endpoints need a signed request header. The evidence bundles you get back from a scan are the same files the auditor reviews.
# Retrieve the live composite score and framework breakdown curl -s https://receipts.thehiveryiq.com/v1/aegis/score # Audit a single control (CC6.1: Logical access control) curl -s -X POST https://receipts.thehiveryiq.com/v1/aegis/control/audit \ -H 'Content-Type: application/json' \ -d '{"control_id":"CC6.1"}' # Retrieve the full control-to-framework matrix curl -s https://receipts.thehiveryiq.com/v1/aegis/matrix # Export a signed evidence bundle curl -s -X POST https://receipts.thehiveryiq.com/v1/hivecomply/bundle/export
SOC 2 and ISO 27001 set the floor you have to clear. They spell out minimum control requirements for security, availability, confidentiality, and privacy. But they don't cover what happens if today's cryptography breaks, how you prove your randomness source is trustworthy, or how you prove data was actually deleted. AEGIS covers all four of those gaps on purpose.
When GDPR Article 17 calls for erasure, or a customer asks you to delete their data, AEGIS-Report issues a signed deletion envelope. It contains the SHA3-256 digest of the data marked for erasure, a timestamp, the Ed25519 and ML-DSA-65 signatures over the deletion record, and an on-chain anchor through AEGIS-Seal. The result is proof anyone can check that data was erased, not just a person's word that it was erased. SOC 2 and ISO 27001 require you to write down your deletion procedures. Neither one requires cryptographic proof that deletion actually happened.
Every control evidence envelope in AEGIS carries an ML-DSA-65 signature (FIPS 204, the government's post-quantum signature standard) on top of the classical Ed25519 signature. ML-DSA-65 comes from the CRYSTALS-Dilithium family, chosen by NIST during its post-quantum cryptography standardization process. That means if a powerful enough quantum computer ever breaks today's elliptic-curve cryptography, the evidence chain still holds up under the post-quantum signature. SOC 2 and ISO 27001 mention cryptographic controls but don't require post-quantum readiness. AEGIS gives it to you by default, not as an option you have to turn on.
AEGIS-Seal locks each evidence bundle onto the Base L2 blockchain. The record holds the bundle hash and the block's timestamp. That timestamp comes from the Base network itself. Nobody can change it, not even Hive Civilization. That gives auditors a way to check things on their own: they can look at the on-chain record directly through the public Base block explorer and confirm the evidence bundle existed at the time it claims, without having to trust Hive Civilization's servers or records. No SOC 2 or ISO 27001 requirement covers on-chain timestamping. It's something AEGIS does on its own.
The keys that sign AEGIS evidence envelopes come from randomness gathered through MAPET-X, a 24-source physics-based randomness system. MAPET-X pulls randomness from the ground (gravity, magnetic fields, seismic activity), light and quantum sources (photon arrival, polarization), subatomic events (radioactive decay, cosmic muons), biological signals (heart-rate variance, EEG), space (cosmic background radiation, solar wind), and even soil (microbial activity). Before any of that randomness gets used to build a key, T-THRESH checks it across a spread-out group of MAPET-X nodes. That group check means no single broken sensor can poison the randomness pool. SOC 2 and ISO 27001 cover key management broadly. Neither one covers where your randomness physically comes from or how it gets validated by a group of nodes.
These four capabilities don't replace a formal SOC 2 Type 1 or Type 2 opinion, an ISO 27001 certification, or any other third-party audit. Cryptographic deletion proofs, post-quantum signatures, on-chain anchors, and swarm-checked randomness are engineering pieces that strengthen the evidence chain. They don't replace the decision of an independent auditor or certification body. Hive Civilization is aiming for a SOC 2 Type 1 engagement in Q4 2026. Right now the state is self-attested. See the SOC 2 Self-Attested inventory and ISO 27001 Self-Attested inventory for the full control-by-control disclosure.
32.9% of the 158 controls are machine-checked. AEGIS probes them, hashes them, and signs them with no person involved. The other 67.1% are self-attested. A person reviewed the control, wrote down how it's set up, and signed off on it. We won't tell you otherwise.
AEGIS checks these controls on its own. The check runs against your live system, captures the result, computes a SHA3-256 digest, and signs the envelope with Ed25519 and ML-DSA-65. The score for these controls reflects what the system actually saw, not what a person reported. This group includes: logical access setups (CC6.x), encryption state of data at rest and in transit, certificate validity, endpoint detection agent status, and infrastructure configuration baselines. Machine-checked controls get rechecked on every scan cycle (460 ms for the full fleet).
These controls need decision, policy review, or process checks that can't be turned into a simple pass or fail test. Examples include: governance controls (CC1.x, commitment to integrity), risk assessment processes (CC3.x), vendor management reviews (ISO 27036), and AI-specific governance items (ISO 42001, EU AI Act). A person reviewed each self-attested control against what it requires, wrote down the real state honestly, and signed off on it. Self-attested controls get reviewed every quarter. The next review is planned for Q3 2026.
We won't tell you that 96.2 means everything is fully compliant. It means that across all 158 controls mapped to 12 frameworks, the weighted score as of the last scan is 96.2 out of 100. Some controls are still just planned. Some are partly done. The full control-by-control inventory is at thehiveryiq.com/security/soc2-self-attested/ and thehiveryiq.com/security/iso-27001-self-attested/. We publish the honest state because an audit that only shows you green lights isn't really an audit.
Every AEGIS evidence envelope gets signed by two algorithms side by side. The classical path uses Ed25519. The post-quantum path uses ML-DSA-65 from the TACHYON family. Both signatures have to check out for the evidence to count. That's the multi-assumption approach: it stays secure unless all three underlying assumptions fail at the same time.
ML-DSA-65 (CRYSTALS-Dilithium, FIPS 204) plus SLH-DSA (stateless hash-based) plus ECDSA all run side by side. All three have to produce valid signatures. The AEGIS envelope carries ML-DSA-65 plus Ed25519 by default. SLH-DSA is there for archival-grade evidence that needs hash-only security.
Signing keys for AEGIS evidence envelopes live in T-VAULT, a post-quantum key vault running on STM32N6 hardware with AES-256 at rest. Keys are built from MAPET-X randomness after T-THRESH checks it across a group of nodes. Keys get rotated without any service downtime through T-AGILITY.
As NIST's post-quantum standards change over time, T-AGILITY lets us swap the signing algorithm without a redeploy. The AEGIS envelope format includes an algorithm ID field. Old envelopes still check out under the algorithm that made them. New envelopes use the current default. No evidence gets stranded when we switch algorithms.
The full TACHYON setup, ten products, three assumption families, MAPET-X randomness grouping, and the physics-based key chain, is written up at thehiveryiq.com/tachyon/. Here's the multi-assumption idea in plain terms: a TACHYON-signed artifact stays secure unless the lattice math, the hash-function math, and the physics-based randomness all fail at the same time. The odds of all three independent things failing together is the product of each one's own odds of failing.
Every attestation event can be anchored as a Purity receipt through POST /v1/purity/cert/issue. Receipt tiers reflect how durable and how widely spread the on-chain anchor is. Higher tiers spread to more nodes and last longer.
| Sphere | Price per receipt | Description |
|---|---|---|
| Whisper | $0.0001 | Minimal on-chain anchor; single-node confirmation; suitable for high-frequency low-value events |
| Echo | $0.0008 | Two-node propagation; standard compliance event logging |
| Cipher | $0.0012 | Three-node propagation with ML-DSA-65 counter-signature on the anchor transaction |
| Thunder | $0.0024 | Five-node propagation; recommended for GDPR deletion proof anchoring |
| Cathedral | $0.0048 | Full-quorum propagation; suitable for control evidence anchoring in regulated industries |
| Constellation | $0.0096 | Cross-chain propagation; long-retention archival anchor for audit artifacts |
| Nebula | $0.0192 | Extended propagation with MAPET-X entropy provenance attestation attached |
| Galaxy | $0.0384 | Full-swarm propagation; SOC 2 Type 2 grade anchoring with T-THRESH validated entropy |
| Genesis | $0.0768 | Maximum tier; all nodes, all chains, full MAPET-X entropy certificate, 7-year retention guarantee |
The compliance dashboard shows the live score, per-framework breakdown, per-control evidence state, and the honest disclosure of what is machine-verified versus self-attested. Every number is sourced from a signed AEGIS envelope.
Every Hive surface signs its own evidence with the same primitives: SHA3-256 canonical hashing, Ed25519 + ML-DSA-65 dual signatures, and a published Merkle Mountain Range root. The receipt is the audit evidence. That same envelope works the same way everywhere: every transaction, every framework, every surface.