Based on the available sources, Permit.io provides enterprise-grade security and compliance capabilities (1) (2) . The platform is ​*SOC 2 Type II*​ certified and offers ​*HIPAA-BAA*​ readiness . For compliance and audit purposes, Permit.io provides: • ​*Decision Logs*​: Human and machine-readable logs capturing every authorization event, enriched with detailed metadata for full transparency (1) • ​*Two Types of Audit Logs*​: Permit Audit Logs (tracking internal authorization system changes) and API Logs (monitoring API-based authorization events) • ​*Tamper-evident audit and decision logs*​ with debug trace-backs The platform also supports compliance alignment with ​*GDPR*​ and ​*CCPA*​ (2) . For on-premises deployments, you maintain control over encryption keys, network access, and logs, with no data leaving your perimeter (3) . However, the specific documentation regarding encryption at rest, encryption in transit, and a dedicated trust center isn't available in the sources I have access to. For comprehensive security documentation and audit materials, I recommend reaching out over Email to request access to their trust center or security documentation package. Would you like a general answer based on my knowledge instead?

To learn more, see the sources I considered: [[1] Permit Strength Points](https://docs.permit.io/concepts/differentiator-checklist) [[2] Why AI Agents Choose Permit.io for Authorization](https://www.permit.io/blog/why-ai-agents-choose-permitio-for-authorization) [[3] Deploying On-Perm Fine-Grained Authorization Service](https://www.permit.io/blog/deploying-on-perm-fine-grained-authorization-service)