Shipping Claude agents under HIPAA, SOC 2 and SOX

A regulated Claude agent is one that can see protected health information, financial records or privileged legal text, and that has to survive a security review. The model is the easy part. The hard part is data flow, logging, access and a refusal path a lawyer can read.

We work in HIPAA, SOC 2, SOX and privilege-aware legal settings. Those engagements ship a compliance architecture document with the code. They do not ship a chatbot on a public API key in a slide.

What reviewers actually ask

• Where does data sit, and which subprocessors see it (Anthropic API, Bedrock, Vertex)?
• Is PII redacted before it hits the model, or is the model in a private VPC?
• Who can trigger a write, and is there an audit trail?
• What happens on injection, timeout or a tool returning someone else's record?

If you cannot answer those, read prompt injection defense and Claude on Bedrock, Vertex or the Anthropic API before you argue about prompts.

Isolated deployments are a product choice

Public-sector and some healthcare buyers need data residency and no training on their traffic. That is a platform decision, not a prompt decision. Pick the runtime first, then design tools against it.

The minimum package we hand to security

1. Data-flow diagram for one production seam
2. Tool allow-list and human-review map
3. Logging and retention policy
4. Eval cases for leakage, refusal and injection
5. An owner for incidents

That package is why regulated pilots leave staging. Quality still needs an eval harness. Safety needs the package. Skip either and the review meeting becomes the blocker.

If this is your environment, say so in the first call. The audit is scoped to measure it, not to pretend a consumer demo will pass.