compliance-engineeringSOC2, HIPAA, GDPR, PCI-DSS, FedRAMP compliance implementation in code. Audit logging, data encryption, access controls, privacy by design, and regulatory requirement mapping. Use when implementing compliance controls, preparing for audits, or building privacy-compliant systems.
Independent GitHub snapshot · Automated classification · Original documentation governs
| Framework | Scope | Key Requirements |
|---|---|---|
| SOC 2 | Service organizations | Security, availability, confidentiality, privacy, processing integrity |
| HIPAA | Healthcare data (PHI) | Encryption, access controls, audit logging, BAAs |
| GDPR | EU personal data | Consent, data minimization, right to erasure, DPIAs |
| PCI-DSS | Payment card data | Network segmentation, encryption, access controls, logging |
| FedRAMP | US government cloud | NIST 800-53 controls, continuous monitoring, authorization |
interface AuditEvent {
timestamp: string;
actor: { id: string; role: string; ip: string };
action: string;
resource: { type: string; id: string };
outcome: 'success' | 'failure';
metadata: Record<string, unknown>;
}
async function auditLog(event: AuditEvent): Promise<void> {
// Write-once, append-only storage (immutable)
await auditStore.append({
...event,
timestamp: new Date().toISOString(),
hash: computeChainHash(event), // tamper detection
});
}
// RBAC with principle of least privilege
const permissions = {
admin: ['read', 'write', 'delete', 'manage_users'],
editor: ['read', 'write'],
viewer: ['read'],
} as const;
function authorize(user: User, action: string, resource: Resource): boolean {
const allowed = permissions[user.role];
if (!allowed?.includes(action)) {
auditLog({ action, outcome: 'failure', actor: user, resource });
return false;
}
return true;
}
interface ConsentRecord {
userId: string;
purpose: string;
granted: boolean;
timestamp: string;
source: 'explicit' | 'legitimate_interest';
withdrawable: boolean;
}
// Data Subject Access Request (DSAR)
async function handleDSAR(userId: string, type: 'access' | 'erasure' | 'portability') {
switch (type) {
case 'access': return await exportUserData(userId); // JSON/CSV
case 'erasure': return await deleteUserData(userId); // Right to be forgotten
case 'portability': return await exportPortableData(userId); // Machine-readable
}
}
next/font, @fontsource/*); no fonts.googleapis.com on page view (GDPR IP leak; Munich court, 2022)