Enterprise / Security & Governance

Compliance

Browse docs

--- title: "Compliance" description: "Configure audit immutability, data residency, PII logging policies, evidence export, and access review cadence for regulatory compliance." icon: "shield-check" ---

Overview

Enterprise compliance controls extend the audit logging system with regulatory-grade features for SOC 2, GDPR, HIPAA, and ISO 27001 frameworks. These controls are gated by the Enterprise compliance capability.

Configuration

Enable compliance controls in your Enterprise profile:

yaml

compliance:
  enabled: true
  audit_immutability: true
  data_residency: "us"
  pii_logging_policy: "redact"
  evidence_retention_days: 365
  access_review_cadence_days: 90
  evidence_export_target: "s3://aurora-compliance-evidence"

Environment Variables

env

COMPLIANCE_ENABLED=true
COMPLIANCE_AUDIT_IMMUTABILITY=true
COMPLIANCE_DATA_RESIDENCY=us
COMPLIANCE_PII_LOGGING_POLICY=redact
COMPLIANCE_EVIDENCE_RETENTION_DAYS=365
COMPLIANCE_ACCESS_REVIEW_CADENCE_DAYS=90
COMPLIANCE_EVIDENCE_EXPORT_TARGET=s3://aurora-compliance-evidence

Settings Reference

Setting	Type	Default	Description
`enabled`	bool	`false`	Master switch for compliance controls
`audit_immutability`	bool	`false`	When true, audit records cannot be deleted or modified after writing
`data_residency`	string	`"unspecified"`	Declared data residency region (e.g., `us`, `eu`, `custom-identifier`)
`pii_logging_policy`	string	`"redact"`	PII handling in logs: `redact` (replace with `[REDACTED]`), `hash` (replace with hash), `block` (prevent logging bodies entirely)
`evidence_retention_days`	int	`365`	Retention period in days for compliance evidence records
`access_review_cadence_days`	int	`90`	Recommended interval between access review audits
`evidence_export_target`	string	â€”	S3 URI or other storage path for periodic evidence export

Audit Immutability

When audit_immutability: true, the system prevents:

Deletion of audit log entries after they are persisted
Modification of existing audit records
Truncation of audit tables

This satisfies the "once written, never changed" requirement for SOC 2 and HIPAA audit controls.

PII Logging Policy

Controls how personally identifiable information is handled in log records:

Policy	Behavior
`redact`	Detected PII is replaced with `[REDACTED]` before storage. Original request is unaffected.
`hash`	Detected PII is replaced with a deterministic hash. Useful for deduplication without exposing raw PII.
`block`	Request and response bodies are not logged at all when PII may be present.

The PII detection covers email addresses, phone numbers, social security numbers, and credit card patterns.

Data Residency

Declare the geographic region where data should be stored and processed. This is primarily a declarative control for compliance documentation. Combine with deployment-level controls (VPC region, database location, S3 bucket region) to enforce actual data residency.

Evidence Export

Configure periodic export of compliance evidence to an external storage target:

yaml

compliance:
  evidence_export_target: "s3://aurora-compliance-evidence"

Evidence exports include:

Immutable audit log snapshots
Compliance configuration attestations
Access review records

The export format is JSON with integrity metadata for audit verification.

Access Reviews

The access_review_cadence_days setting establishes the recommended interval for reviewing user access permissions. This is a planning value used for compliance documentation and reporting.

Admin API

Feature status is available from the dashboard features endpoint:

bash

curl -H "Authorization: Bearer $AURORA_MASTER_KEY" \
  http://your-aurora-host/admin/api/v1/dashboard/features

Compliance status is visible in the dashboard under Enterprise -> Compliance.

Compliance Frameworks

Framework	Relevant Controls
SOC 2	Audit logging, change management, access controls
GDPR	Data processing records, PII protection, data residency
HIPAA	Access audit trail, modification logging, integrity controls
ISO 27001	Logging and monitoring, access review, evidence management

← All docs

Enterprise / Security & Governance

Compliance

Browse docs

Overview

Configuration

Enable compliance controls in your Enterprise profile:

yaml

compliance:
  enabled: true
  audit_immutability: true
  data_residency: "us"
  pii_logging_policy: "redact"
  evidence_retention_days: 365
  access_review_cadence_days: 90
  evidence_export_target: "s3://aurora-compliance-evidence"

Environment Variables

env

COMPLIANCE_ENABLED=true
COMPLIANCE_AUDIT_IMMUTABILITY=true
COMPLIANCE_DATA_RESIDENCY=us
COMPLIANCE_PII_LOGGING_POLICY=redact
COMPLIANCE_EVIDENCE_RETENTION_DAYS=365
COMPLIANCE_ACCESS_REVIEW_CADENCE_DAYS=90
COMPLIANCE_EVIDENCE_EXPORT_TARGET=s3://aurora-compliance-evidence

Settings Reference

Setting	Type	Default	Description
`enabled`	bool	`false`	Master switch for compliance controls
`audit_immutability`	bool	`false`	When true, audit records cannot be deleted or modified after writing
`data_residency`	string	`"unspecified"`	Declared data residency region (e.g., `us`, `eu`, `custom-identifier`)
`pii_logging_policy`	string	`"redact"`	PII handling in logs: `redact` (replace with `[REDACTED]`), `hash` (replace with hash), `block` (prevent logging bodies entirely)
`evidence_retention_days`	int	`365`	Retention period in days for compliance evidence records
`access_review_cadence_days`	int	`90`	Recommended interval between access review audits
`evidence_export_target`	string	â€”	S3 URI or other storage path for periodic evidence export

Audit Immutability

When audit_immutability: true, the system prevents:

Deletion of audit log entries after they are persisted
Modification of existing audit records
Truncation of audit tables

This satisfies the "once written, never changed" requirement for SOC 2 and HIPAA audit controls.

PII Logging Policy

Controls how personally identifiable information is handled in log records:

Policy	Behavior
`redact`	Detected PII is replaced with `[REDACTED]` before storage. Original request is unaffected.
`hash`	Detected PII is replaced with a deterministic hash. Useful for deduplication without exposing raw PII.
`block`	Request and response bodies are not logged at all when PII may be present.

The PII detection covers email addresses, phone numbers, social security numbers, and credit card patterns.

Data Residency

Evidence Export

Configure periodic export of compliance evidence to an external storage target:

yaml

compliance:
  evidence_export_target: "s3://aurora-compliance-evidence"

Evidence exports include:

Immutable audit log snapshots
Compliance configuration attestations
Access review records

The export format is JSON with integrity metadata for audit verification.

Access Reviews

The access_review_cadence_days setting establishes the recommended interval for reviewing user access permissions. This is a planning value used for compliance documentation and reporting.

Admin API

Feature status is available from the dashboard features endpoint:

bash

curl -H "Authorization: Bearer $AURORA_MASTER_KEY" \
  http://your-aurora-host/admin/api/v1/dashboard/features

Compliance status is visible in the dashboard under Enterprise -> Compliance.

Compliance Frameworks

Framework	Relevant Controls
SOC 2	Audit logging, change management, access controls
GDPR	Data processing records, PII protection, data residency
HIPAA	Access audit trail, modification logging, integrity controls
ISO 27001	Logging and monitoring, access review, evidence management