Compliance

Overview

The Prizm platform is designed to help organizations meet regulatory requirements across multiple compliance frameworks. Compliance in Prizm is built into the core platform architecture through Privacy by Design principles, ensuring controls are always active and verifiable.

Supported Frameworks

GDPR

General Data Protection Regulation
EU personal data processing; any organization handling EU resident data.

CCPA / CPRA

California Privacy Rights Act
California resident data; US businesses above the revenue/data threshold.

HIPAA

Health Insurance Portability and Accountability Act
US healthcare data (PHI); covered entities and business associates.

SOC 2 Type II

Service Organization Control 2
SaaS and service providers; customer trust and assurance reporting.

ISO 27001

Information Security Management System
Global standard for systematic information security management.

Platform Controls

Control Area	Prizm Feature
Data Subject Rights	Built-in tooling for access, rectification, erasure, and portability requests
Consent Management	Configurable consent tracking and withdrawal workflows
Data Classification	Automated identification of personal data (PII) across datasets
Data Minimization	Fine-grained access controls limit personal data exposure
Breach Notification	Audit logging and alerting tools support 72-hour breach reporting
Data Residency	EU data region selection prevents cross-border transfers where restricted
Privacy by Design	Data protection controls are architectural, not optional add-ons

Key Articles Addressed

Article	Topic	Prizm Control
Art. 5	Principles of processing	Data classification, access controls, audit logging
Art. 17	Right to erasure	Data deletion workflows with audit trail
Art. 25	Privacy by design	Architectural privacy controls, PII masking
Art. 30	Records of processing	Audit log export and processing activity records
Art. 32	Security of processing	AES-256, TLS 1.3, access controls, monitoring
Art. 33	Breach notification	Real-time alerting, incident management tooling

HIPAA

For organizations handling Protected Health Information (PHI), Prizm provides controls that support HIPAA Security Rule requirements across all three safeguard categories:

Administrative Safeguards

Role-based access controls with documented assignment history
Workforce training record support
Contingency planning documentation
Access review and de-provisioning audit trail

Physical Safeguards

Physical security of underlying cloud infrastructure is documented in Prizm’s Data Center Security policy and covered under the shared responsibility model with cloud providers.

Technical Safeguards

Encryption at rest (AES-256) and in transit (TLS 1.3)
Unique user identification via SSO and MFA
Automatic session logoff with configurable idle timeout
Comprehensive audit controls with immutable logs
End-to-end encryption for all PHI in transit

Prizm supports Business Associate Agreement (BAA) execution for covered entities. Contact your account team to initiate the BAA process.

SOC 2 Type II

Trust Services Criteria Coverage

Category	Criteria	Prizm Controls
Security	CC6 – Logical and Physical Access	RBAC, MFA, SSO, access reviews
Availability	A1 – Availability	SLA monitoring, redundancy, incident management
Confidentiality	C1 – Confidentiality	Data classification, encryption, access controls
Processing Integrity	PI1 – Processing Integrity	Audit logging, data validation, change management
Privacy	P1–P8 – Privacy	PII identification, consent management, data subject rights

ISO 27001

Annex A Controls Alignment

Prizm’s security architecture aligns with ISO 27001:2022 Annex A controls across the following domains:

Annex A Control	Description	Prizm Implementation
A.5	Organizational controls	Information security policies, roles, and responsibilities
A.8.3	Information access restriction	RBAC and ABAC implementation
A.8.5	Secure authentication	MFA, SSO, session management
A.8.15	Logging	Comprehensive audit log coverage
A.8.24	Use of cryptography	AES-256 and TLS 1.3 standards

Audit Capabilities

What Is Logged

Every significant action in Prizm generates an audit event:

User authentication events (login, logout, failed attempts, MFA)
Resource access events (view, create, edit, delete) with full context
Permission and role assignment changes
Administrative actions (configuration changes, user management)
Data export and download events
API access with client identification

Audit Log Attributes

Attribute	Description
`timestamp`	UTC timestamp with millisecond precision
`user_id`	Authenticated user identifier
`event_type`	Categorized action (auth, read, write, admin, etc.)
`resource`	Type and identifier of the affected resource
`ip_address`	Source IP (maskable for privacy if configured)
`outcome`	Success, failure, or partial completion with reason code
`session_id`	Correlated session ID for timeline reconstruction

Compliance Reporting

Prizm provides built-in reports to support certification workflows:

Report	Contents
Access Review	Current role assignments by user, group, or resource
Privilege Activity	Audit log summaries filtered by event type or user
Data Classification	Inventory of classified data assets and access controls
Change Management	Timeline of configuration and permission changes
Exception Report	Policy violations, failed access attempts, and anomalies

Reports can be scheduled, exported as PDF/CSV/JSON, and integrated with GRC platforms via API.

Shared Responsibility

Compliance is a shared responsibility between Prizm and customer organizations:

Area	Prizm	Customer
Platform Security	Encryption, patching, infrastructure security	Configuration, access policies
Identity Management	SSO integration, MFA capabilities	IdP management, user lifecycle
Data Classification	Classification engine, masking controls	Policy definition, review cycles
Audit Logging	Log generation, immutability, retention	Log review, alerting rules, SIEM integration
Compliance Certification	SOC 2 Type II, ISO 27001 for the platform	Customer’s own certifications using Prizm controls

Get Started

Core Concepts

Platform

Architecture

Data Sources

Integrations

Security & Access Control

Deployment

Help

Settings

MCP

Release Notes

API Reference

Overview

Supported Frameworks

GDPR

CCPA / CPRA

HIPAA

SOC 2 Type II

ISO 27001

Platform Controls

Key Articles Addressed

HIPAA

SOC 2 Type II

Trust Services Criteria Coverage

ISO 27001

Annex A Controls Alignment

Audit Capabilities

What Is Logged

Audit Log Attributes

Compliance Reporting

Shared Responsibility

​Overview

​Supported Frameworks

GDPR

CCPA / CPRA

HIPAA

SOC 2 Type II

ISO 27001

​GDPR

​Platform Controls

​Key Articles Addressed

​HIPAA

​SOC 2 Type II

​Trust Services Criteria Coverage

​ISO 27001

​Annex A Controls Alignment

​Audit Capabilities

​What Is Logged

​Audit Log Attributes

​Compliance Reporting

​Shared Responsibility

Overview

Supported Frameworks

GDPR

Platform Controls

Key Articles Addressed

HIPAA

SOC 2 Type II

Trust Services Criteria Coverage

ISO 27001

Annex A Controls Alignment

Audit Capabilities

What Is Logged

Audit Log Attributes

Compliance Reporting

Shared Responsibility