The SC//HyperCore™ HyperVisor is designed to be a compliance-ready foundation. Its design, controls, and work practices align with the frameworks your auditors care about. It also gives you the proof you need to show compliance. This page covers the frameworks SC//Platform™ aligns with and the platform controls that help with compliance work. It also sets out the shared responsibility model, which shows where Scale Computing’s duties end and yours begin.
Compliance-ready foundation
SC//Platform is designed to help you meet strict security and compliance needs. That matters most in fields with tight rules, such as healthcare, retail, financial services, and government. The platform aligns with the principles and best practices of common security and privacy frameworks, including:
- HIPAA for protected health information.
- PCI DSS for cardholder data environments.
- GDPR for personal data of EU data subjects.
Customer control of data and access
SC//Platform is built so that you keep full control of your data, systems, and access policies. No root or privileged access is given to outside parties. You choose the controls that meet your compliance mandates:
- your own encryption, including guest-OS encryption with vTPM, as described in Encryption and Boot Integrity
- your own authentication, including OIDC and MFA, as described in Access Control and Authentication
- your own access policies
Security and audit capabilities
Built-in features help you meet your audit needs, both legal and internal. These include Role-Based Access Control, detailed system logging, secure update processes, and strong network isolation. SC//Platform is open about what it does and watches itself closely. So it is easier to gather the proof that you are ready for an audit. For example:
- Admin actions and security events, logged for audit and sent to your SIEM via syslog or API.
- Signed, traceable software updates that show how the cluster reached its current software version.
- Documented separation between cluster control (SC//HyperCore) and cloud orchestration (SC//Fleet™ Manager).
SC//Platform makes the layers underneath simpler while keeping your control and security. That gives you a strong, compliance-ready foundation for the rules you face now and in the future.
SOC 2 and ISO/IEC 27001
Scale Computing aligns its information security practices with ISO/IEC 27001 and SOC 2 to support enterprise-grade governance and risk management across SC//HyperCore and SC//Fleet Manager.
ISO/IEC 27001 is the basis for Scale Computing’s internal Information Security Management System (ISMS). It guides how Scale Computing puts technical controls, vulnerability management, and ongoing risk checks in place across its systems and work.
SOC 2 coverage for SC//HyperCore and SC//Fleet Manager is a SOC 2 Type 2 report scoped to the Security Trust Services Criterion. The Security criterion covers the controls that protect systems and data from unauthorized access, such as access controls, audit logging, and incident response processes.
To share Scale Computing’s reports with your auditors, ask your usual Scale Computing contact for a copy.
Regulated data: Different markets and sectors face different compliance rules. Scale Computing does not access personal information about its customers’ end users. So it is not directly subject to sectoral laws such as HIPAA or GLBA. SC//Platform is designed to help you meet those duties. But you must still confirm that your whole solution meets the rules that apply to you. That includes the operating systems, applications, and data on top of SC//Platform.
Shared responsibility model
Scale Computing and the customers who run SC//Platform share the job of security. SC//Platform is built on secure foundations. Your site is most secure when you pair those foundations with sound work practices.
Scale Computing is responsible for:
- Secure platform design and architecture.
- Regular patching of the SC//HyperCore and SC//Fleet Manager software.
- Secure, signed software updates shipped through trusted pipelines.
- Secure default settings for the platform.
- Readiness to respond to incidents, including monitoring, running the IRP, and keeping customers informed.
You, as the customer or partner, are responsible for:
- Managing user and identity access on the cluster and in any connected identity provider.
- Strong password and authentication policies (for example, turning on MFA in your IdP).
- Checking audit logs and feeding them into your SIEM or other detection tools.
- Securing the applications and operating systems that run on SC//Platform. This includes guest patching, hardening, and encryption.
- Staying compliant with the rules that apply to your business. That includes any documents, processes, and evidence your auditor requires.
Pair a securely built platform with careful practices in your own environment. Then you can build highly secure, resilient deployments that protect the applications and data running on the SC//HyperCore platform.