{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"antigen","name":"Antigen","domain":"antigen.sh","category":"AI tools","one_liner":"Continuous offensive security for the enterprise.","trust_center_url":"https://trust.antigen.sh/","security_page_url":null,"url":"https://certreports.com/vendors/antigen/security","last_verified_at":"2026-09-30T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"hipaa","framework_name":"HIPAA","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states that it will sign a business associate agreement on its trust centre (Vanta) as of 30 Sep 2026.","kind":null,"status_text":"Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured)","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-30","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/antigen/hipaa","evidence":[{"source_type":"trust_center","source_name":"Antigen trust centre (Vanta)","url":"https://trust.antigen.sh/","fetched_at":"2026-09-29 02:04:27.735556+00","content_hash":"107588ca26f5d2eb58ffcf7b961408bb889ae93776180cca35f996d143759fc4","wayback_url":null,"quote":"HIPAA","confidence":1},{"source_type":"trust_center","source_name":"Antigen trust centre (Vanta)","url":"https://trust.antigen.sh/","fetched_at":"2026-09-18 23:12:17.285369+00","content_hash":"96574d06d1bb2acfe839cd3a1e4a85912ddb53e6c9f6d9941d48bab8c912dc54","wayback_url":null,"quote":"HIPAA","confidence":1}]},{"framework":"gdpr","framework_name":"GDPR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a data processing agreement on its trust centre (Vanta) as of 30 Sep 2026.","kind":null,"status_text":"Vendor states GDPR on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-30","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/antigen/gdpr","evidence":[{"source_type":"trust_center","source_name":"Antigen trust centre (Vanta)","url":"https://trust.antigen.sh/","fetched_at":"2026-09-29 02:04:27.735556+00","content_hash":"107588ca26f5d2eb58ffcf7b961408bb889ae93776180cca35f996d143759fc4","wayback_url":null,"quote":"GDPR","confidence":1},{"source_type":"trust_center","source_name":"Antigen trust centre (Vanta)","url":"https://trust.antigen.sh/","fetched_at":"2026-09-18 23:12:17.285369+00","content_hash":"96574d06d1bb2acfe839cd3a1e4a85912ddb53e6c9f6d9941d48bab8c912dc54","wayback_url":null,"quote":"GDPR","confidence":1}]}],"brief":{"summary":"Antigen states on its trust centre that it displays a HIPAA badge, as of 18 Sep 2026, though the vendor's BAA availability has not yet been captured as separate evidence, so it should be treated only as a self-reported claim. Antigen states on its trust centre that it meets GDPR requirements, as of 18 Sep 2026. No public evidence was found for SOC 2 as of 19 Sep 2026. No public evidence was found for ISO/IEC 27001 as of 19 Sep 2026. No public evidence was found for FedRAMP or the EU-US Data Privacy Framework as of 19 Sep 2026.","bullets":["HIPAA: vendor states on its trust centre it displays a HIPAA badge (claim only; BAA availability not yet captured), as of 18 Sep 2026.","GDPR: vendor states on its trust centre, as of 18 Sep 2026.","SOC 2, ISO/IEC 27001, FedRAMP, EU-US Data Privacy Framework: no public evidence found, as of 19 Sep 2026."],"model":"claude-sonnet-5 (subscription)","generated_at":"2026-09-19 12:29:55.320126+00"},"legal_docs":[{"kind":"subprocessors","url":"https://trust.antigen.sh/","availability":"public","detail":"5 subprocessors listed on the trust centre","as_of":"2026-09-30"},{"kind":"privacy","url":"https://antigen.sh/privacy","availability":"public","detail":null,"as_of":"2026-09-30"}],"documents":[{"type":"soc2_report","title":"SOC 2 Type II — Letter of Engagement","availability":"on_request","source_url":"https://trust.antigen.sh/","last_seen":"2026-09-30"}],"statements":[{"topic":"penetration_testing","question":"How does Antigen isolate pen testing environments?","answer":"Every engagement executes inside a dedicated Firecracker microVM with its own Linux kernel, enforced by hardware-level CPU virtualization (Intel VT-x). This is the same isolation technology that underpins AWS Lambda. Each environment is network-isolated through kernel-level policy enforcement. Agents can only reach targets that have been explicitly authorized through our target approval process. Sandbox environments cannot access other customer environments, Antigen internal systems, or any infrastructure outside the authorized scope.","value":null,"regions":[],"source_url":"https://trust.antigen.sh/faq?s=crrb3k2yy8w34kt1szfu0","as_of":"2026-09-30"}],"security_profile":{"iso42001":null,"trains_on_customer_data":null,"data_residency_regions":[],"pen_test_cadence":null,"as_of":"2026-09-30"},"regulations_url":"https://certreports.com/api/v1/vendors/antigen/regulations/{regulation}","subprocessors":[{"name":"Amazon Web Services","domain":"amazon.com","purpose":"Data storage, cloud hosting, and AI services","location":"Global (localization available in United States, European Union, Southeast Asia, Japan, Australia)","vendor_url":"https://certreports.com/vendors/amazon/security"},{"name":"Anthropic","domain":"anthropic.com","purpose":"AI services","location":"United States","vendor_url":"https://certreports.com/vendors/anthropic/security"},{"name":"Baseten","domain":"baseten.co","purpose":"AI services","location":"United States","vendor_url":null},{"name":"GitHub","domain":"github.com","purpose":"Version control","location":"United States","vendor_url":"https://certreports.com/vendors/github/security"},{"name":"Google Workspace","domain":"google.com","purpose":"Identity provider","location":null,"vendor_url":"https://certreports.com/vendors/google/security"}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-11-03T18:56:10.712Z"}