CloakWorks Compliance

Mugatu AI, Inc. is currently undergoing SOC 2 compliance auditing.

The audit has not been represented as complete. We do not claim a completed SOC 2 attestation or an available SOC 2 report. Audit type, scope, auditor, and completion date are not announced here.

SOC 2 evaluates controls within a defined service scope; it is an independent attestation, not a blanket product certification. Contact us for the current audit status and available assurance materials.

CloakWorks is designed to help reduce accidental disclosure of sensitive information in AI workflows through local detection and masking. These safeguards can support a healthcare organization’s privacy program; they do not establish HIPAA compliance by themselves.

• Validate masking against your actual workflows before handling protected health information (PHI).
• Automated masking alone does not establish HIPAA Safe Harbor de-identification or an expert determination.
• Assess access controls, workforce practices, risk management, and the receiving AI service separately.
• Determine whether a business associate agreement is required and obtain one before a covered service handles PHI. No executed BAA is promised by this page.

We do not claim HIPAA certification or guarantee that installing CloakWorks makes an organization or AI service HIPAA compliant.

CloakWorks is designed to help teams reduce unintended disclosure of sensitive technical information. It does not determine export classification, authorize exports, or replace an organization’s export-control program.

• Keep ITAR-controlled technical data out of unapproved AI services, even when masking is enabled.
• Review destination, recipient authorization, access by foreign persons, and applicable export permissions with qualified export-control counsel.
• Validate controls for your deployment; do not assume masking removes export-control obligations.

No ITAR registration, government approval, or guaranteed ITAR compliance is claimed here.

Evaluate the product version, deployment configuration, data flows, contractual terms, and available evidence before approving regulated use. Product safeguards complement—not replace—your legal and security review.

Read our Data Privacy terms, Information Security Policy, and Audit Rights. References to assurance reports in contract documents do not mean an audit has already been completed.