Compliance

BitDrip ships built-in compliance profiles for six regulatory frameworks. This guide explains what each profile covers, how to activate it, and how to validate your configuration before an audit.

Supported Frameworks

Framework	Scope	Primary data types protected
GDPR	EU personal data	PII, special-category data
HIPAA	US healthcare	PHI, PII adjacent to health
PCI DSS	Payment card data	Card numbers, CVV, PINs
SOC 2	Service organization controls	Credentials, secrets, PII
ISO 27001	Information security management	Credentials, proprietary data
CCPA	California consumer data	PII for California residents

BitDrip provides technical controls that support compliance. Achieving certification also requires organizational policies, training, vendor management, and other controls outside the scope of software.

Activating a Compliance Profile

1. Admin Dashboard → Policies → Compliance Profiles
2. Select the framework that applies to your organization
3. Click Activate
4. Choose the enforcement mode:
   • Strict — violations are blocked immediately
   • Warn — users are warned but may proceed
   • Monitor — violations are logged silently (useful during rollout)
5. Optionally, layer multiple profiles (e.g., GDPR + SOC 2 simultaneously)

Policy changes take effect within the Redis cache TTL (5 minutes by default). For immediate effect, flush the cache:

redis-cli -u "$REDIS_URL" FLUSHDB

Framework Reference

GDPR

What it blocks: Full names with identifiers, email addresses, phone numbers, national IDs (SSN, passport numbers, EU national identity numbers), biometric identifiers, health data used in non-medical contexts.

Audit requirements: Every evaluation is logged with user ID (pseudonymized), timestamp, action, and data category. Export audit logs via Audit → Policy Events → Export CSV to produce a processing activity record.

Data retention: GDPR requires you to configure appropriate retention periods. Set DATA_RETENTION_DAYS on the Policy Engine (default: 90 days). Audit logs are purged automatically after this period.

Key article mappings:

Control	Article	BitDrip mechanism
Data minimization	Art. 5(1)(c)	Content hash only — no raw content stored
Purpose limitation	Art. 5(1)(b)	Per-org policy scopes
Breach notification data	Art. 33	Audit log export + chain verification

---

HIPAA

What it blocks: All 18 PHI identifiers including: names, geographic data below state level, dates (except year) for individuals, phone numbers, fax numbers, email addresses, Social Security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate/license numbers, vehicle identifiers, device identifiers, URLs, IP addresses, biometric identifiers, full-face photographs, and any other unique identifying numbers.

Audit requirements: HIPAA Security Rule §164.312(b) requires audit controls. BitDrip's audit log satisfies this with tamper-evident SHA-256 hash chaining. Run the verification script quarterly:

node scripts/verify-audit-chain.js

Business Associate considerations: If BitDrip processes PHI on behalf of a covered entity, you may need a Business Associate Agreement (BAA) with your infrastructure providers (your cloud provider, hosting company, or data center operator).

---

PCI DSS

What it blocks: Primary Account Numbers (PANs), card verification codes (CVV/CVC/CAV), PINs, magnetic stripe data, and chip data. Luhn algorithm validation is applied to numeric strings that could be PANs.

Scope reduction: BitDrip acts as a technical control at the AI service boundary. Blocking PAN transmission via AI services may help reduce PCI DSS scope for those systems, but your security assessor determines scope.

Required evidence for QSA:

• Audit log showing PANs were blocked at the policy layer
• Network diagram showing BitDrip sits between users and AI services
• Proof of log retention ≥ 1 year (PCI DSS Req. 10.7)

Set DATA_RETENTION_DAYS=365 for PCI compliance.

---

SOC 2

What it blocks: API keys, passwords, private keys, bearer tokens, AWS/GCP/Azure credentials, connection strings, and other secrets.

Trust Service Criteria mapping:

Criterion	BitDrip control
CC6.1 (logical access)	Role-based access control, API key scopes
CC6.6 (security configuration)	Security hardening guide
CC6.7 (data in transit)	TLS 1.2+ enforced
CC7.2 (monitoring)	Structured JSON logging with configurable log drain
CC9.2 (vendor risk)	SBOM, cosign image signatures

Evidence collection: Export audit logs and security event logs before your SOC 2 observation period ends. The monitoring section covers log drain configuration for continuous collection.

---

ISO 27001

What it blocks: Credentials and secrets (Annex A.9 — Access control). Warns on PII and proprietary data patterns.

Annex A control mapping:

Control	BitDrip feature
A.9.4.2 (secure log-on)	JWT auth, rate-limited login, MFA via Keycloak
A.12.4.1 (event logging)	Structured audit log with all actions
A.12.4.2 (log protection)	SHA-256 hash chain, append-only audit table
A.14.2.8 (system security testing)	Policy testing (see Testing guide)
A.18.1.3 (protection of records)	Log retention policy on your storage

---

CCPA

What it blocks: PII categories defined by CCPA for California residents: identifiers, commercial information, internet activity, geolocation, biometric data, professional/employment data, education data, inferences used to build profiles.

Opt-out integration: CCPA grants consumers the right to opt out of data "sales." If your AI service use constitutes a sale under CCPA, configure a ccpa_opted_out user attribute and create a policy rule that applies stricter blocking for opted-out users.

---

Validating Your Configuration

Before an audit, run through this checklist:

1. Profile is active

Dashboard → Policies → Compliance Profiles — your target framework shows Active.

2. All data categories are covered

Use the Policy Test page (Dashboard → Policies → Test) to submit representative test inputs for each data category your organization handles. Confirm each returns the expected action (block or warn). See the Policy Testing guide for test case examples.

3. Audit log is running and intact

# Export the last 1,000 entries
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  "https://your-api-gateway/api/v1/audit/export?limit=1000" \
  > audit-sample.json

# Verify hash chain
node scripts/verify-audit-chain.js audit-sample.json

Expected output: ✓ Chain integrity verified — N entries, no gaps detected

4. Log retention meets framework requirements

Framework	Minimum retention
GDPR	As long as data is processed (typically 90 days minimum)
HIPAA	6 years from creation or last effective date
PCI DSS	12 months
SOC 2	Audit observation period + 1 year

Verify your DATA_RETENTION_DAYS setting and your log storage retention policy match the strictest framework you're operating under.

5. TLS is enforced end-to-end

# Check TLS version accepted by your API Gateway
nmap --script ssl-enum-ciphers -p 443 your-api-gateway.example.com

TLSv1.0 and TLSv1.1 should not appear in the output.

6. Access control review

Dashboard → Users → review that:

• No super_admin accounts belong to departed employees
• Service accounts use API keys with the minimum required scope
• API keys have expiry dates set

7. Chain verification is scheduled

Add the verification script to your weekly runbook or a CI job:

node scripts/verify-audit-chain.js
# Exits non-zero if chain is broken — wire to an alert

Generating Compliance Reports

Dashboard → Reports → Compliance:

• Policy Events Summary — violations by category, action, and user over a date range
• Framework Coverage — which rules are active and their trigger counts
• Audit Export — full export for auditor review

Reports can be exported as CSV or printed to PDF using your browser's print dialog. For evidence packages, include:

1. Printable compliance report saved as PDF
2. Audit log export (JSON)
3. Chain verification output
4. Screenshot of active compliance profile configuration