> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dqlabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance

> GDPR, CCPA, HIPAA, SOC 2, and ISO 27001 compliance controls.

<script type="application/ld+json">
  {`{
            "@context": "https://schema.org",
            "@type": "TechArticle",
            "headline": "Compliance",
            "description": "GDPR, CCPA, HIPAA, SOC 2, and ISO 27001 compliance controls.",
            "url": "https://docs.dqlabs.ai/security/compliance",
            "publisher": {
              "@type": "Organization",
              "name": "DQLabs Inc",
              "logo": "https://media.brand.dev/332adc35-5bc4-4d2b-bf78-256aa4a5e414.svg"
            }
            }`}
</script>

## Overview

The Prizm platform is designed to help organizations meet regulatory requirements across multiple compliance frameworks. Compliance in Prizm is built into the core platform architecture through Privacy by Design principles, ensuring controls are always active and verifiable.

## Supported Frameworks

<CardGroup cols={2}>
  <Card title="GDPR" icon="building-columns">
    **General Data Protection Regulation**<br />EU personal data processing; any organization handling EU resident data.
  </Card>

  <Card title="CCPA / CPRA" icon="building-columns">
    **California Privacy Rights Act**<br />California resident data; US businesses above the revenue/data threshold.
  </Card>

  <Card title="HIPAA" icon="building-columns">
    **Health Insurance Portability and Accountability Act**<br />US healthcare data (PHI); covered entities and business associates.
  </Card>

  <Card title="SOC 2 Type II" icon="building-columns">
    **Service Organization Control 2**<br />SaaS and service providers; customer trust and assurance reporting.
  </Card>

  <Card title="ISO 27001" icon="building-columns">
    **Information Security Management System**<br />Global standard for systematic information security management.
  </Card>
</CardGroup>

***

## GDPR

### Platform Controls

| Control Area        | Prizm Feature                                                                 |
| ------------------- | ----------------------------------------------------------------------------- |
| Data Subject Rights | Built-in tooling for access, rectification, erasure, and portability requests |
| Consent Management  | Configurable consent tracking and withdrawal workflows                        |
| Data Classification | Automated identification of personal data (PII) across datasets               |
| Data Minimization   | Fine-grained access controls limit personal data exposure                     |
| Breach Notification | Audit logging and alerting tools support 72-hour breach reporting             |
| Data Residency      | EU data region selection prevents cross-border transfers where restricted     |
| Privacy by Design   | Data protection controls are architectural, not optional add-ons              |

### Key Articles Addressed

| Article | Topic                    | Prizm Control                                       |
| ------- | ------------------------ | --------------------------------------------------- |
| Art. 5  | Principles of processing | Data classification, access controls, audit logging |
| Art. 17 | Right to erasure         | Data deletion workflows with audit trail            |
| Art. 25 | Privacy by design        | Architectural privacy controls, PII masking         |
| Art. 30 | Records of processing    | Audit log export and processing activity records    |
| Art. 32 | Security of processing   | AES-256, TLS 1.3, access controls, monitoring       |
| Art. 33 | Breach notification      | Real-time alerting, incident management tooling     |

***

## HIPAA

For organizations handling Protected Health Information (PHI), Prizm provides controls that support HIPAA Security Rule requirements across all three safeguard categories:

<AccordionGroup>
  <Accordion title="Administrative Safeguards">
    * Role-based access controls with documented assignment history
    * Workforce training record support
    * Contingency planning documentation
    * Access review and de-provisioning audit trail
  </Accordion>

  <Accordion title="Physical Safeguards">
    Physical security of underlying cloud infrastructure is documented in Prizm's Data Center Security policy and covered under the shared responsibility model with cloud providers.
  </Accordion>

  <Accordion title="Technical Safeguards">
    * Encryption at rest (AES-256) and in transit (TLS 1.3)
    * Unique user identification via SSO and MFA
    * Automatic session logoff with configurable idle timeout
    * Comprehensive audit controls with immutable logs
    * End-to-end encryption for all PHI in transit
  </Accordion>
</AccordionGroup>

<Note>
  Prizm supports Business Associate Agreement (BAA) execution for covered entities. Contact your account team to initiate the BAA process.
</Note>

***

## SOC 2 Type II

### Trust Services Criteria Coverage

| Category             | Criteria                          | Prizm Controls                                              |
| -------------------- | --------------------------------- | ----------------------------------------------------------- |
| Security             | CC6 – Logical and Physical Access | RBAC, MFA, SSO, access reviews                              |
| Availability         | A1 – Availability                 | SLA monitoring, redundancy, incident management             |
| Confidentiality      | C1 – Confidentiality              | Data classification, encryption, access controls            |
| Processing Integrity | PI1 – Processing Integrity        | Audit logging, data validation, change management           |
| Privacy              | P1–P8 – Privacy                   | PII identification, consent management, data subject rights |

***

## ISO 27001

### Annex A Controls Alignment

Prizm's security architecture aligns with ISO 27001:2022 Annex A controls across the following domains:

| Annex A Control | Description                    | Prizm Implementation                                       |
| --------------- | ------------------------------ | ---------------------------------------------------------- |
| A.5             | Organizational controls        | Information security policies, roles, and responsibilities |
| A.8.3           | Information access restriction | RBAC and ABAC implementation                               |
| A.8.5           | Secure authentication          | MFA, SSO, session management                               |
| A.8.15          | Logging                        | Comprehensive audit log coverage                           |
| A.8.24          | Use of cryptography            | AES-256 and TLS 1.3 standards                              |

***

## Audit Capabilities

### What Is Logged

Every significant action in Prizm generates an audit event:

* User authentication events (login, logout, failed attempts, MFA)
* Resource access events (view, create, edit, delete) with full context
* Permission and role assignment changes
* Administrative actions (configuration changes, user management)
* Data export and download events
* API access with client identification

### Audit Log Attributes

| Attribute    | Description                                              |
| ------------ | -------------------------------------------------------- |
| `timestamp`  | UTC timestamp with millisecond precision                 |
| `user_id`    | Authenticated user identifier                            |
| `event_type` | Categorized action (auth, read, write, admin, etc.)      |
| `resource`   | Type and identifier of the affected resource             |
| `ip_address` | Source IP (maskable for privacy if configured)           |
| `outcome`    | Success, failure, or partial completion with reason code |
| `session_id` | Correlated session ID for timeline reconstruction        |

### Compliance Reporting

Prizm provides built-in reports to support certification workflows:

| Report                  | Contents                                                 |
| ----------------------- | -------------------------------------------------------- |
| **Access Review**       | Current role assignments by user, group, or resource     |
| **Privilege Activity**  | Audit log summaries filtered by event type or user       |
| **Data Classification** | Inventory of classified data assets and access controls  |
| **Change Management**   | Timeline of configuration and permission changes         |
| **Exception Report**    | Policy violations, failed access attempts, and anomalies |

Reports can be scheduled, exported as PDF/CSV/JSON, and integrated with GRC platforms via API.

***

## Shared Responsibility

Compliance is a shared responsibility between Prizm and customer organizations:

| Area                     | Prizm                                         | Customer                                           |
| ------------------------ | --------------------------------------------- | -------------------------------------------------- |
| Platform Security        | Encryption, patching, infrastructure security | Configuration, access policies                     |
| Identity Management      | SSO integration, MFA capabilities             | IdP management, user lifecycle                     |
| Data Classification      | Classification engine, masking controls       | Policy definition, review cycles                   |
| Audit Logging            | Log generation, immutability, retention       | Log review, alerting rules, SIEM integration       |
| Compliance Certification | SOC 2 Type II, ISO 27001 for the platform     | Customer's own certifications using Prizm controls |