Level 4: Expert

Compliance & Enterprise

Master GDPR compliance, SOC 2 audit preparation, HIPAA requirements, audit log management, data residency strategies, and automated compliance reporting. Learn how to build audit-ready AI systems that meet regulatory requirements globally.

50 minutes
6 sections
Expert

GDPR Deep Dive

The General Data Protection Regulation (GDPR) applies to any organization processing EU citizens' personal data. AgentAIShield helps you meet all requirements.

Data Processing Agreements (DPAs)

Under GDPR Article 28, any vendor processing personal data on your behalf must sign a DPA. AgentAIShield provides:

// Request DPA signing curl -X POST https://agentaishield.com/api/v1/compliance/gdpr/dpa \ -H "Authorization: Bearer sk_live_..." \ -d '{ "organization_name": "ACME Corp", "legal_entity": "ACME Corporation Ltd", "signatory_name": "Jane Doe", "signatory_email": "[email protected]", "data_residency": "eu-west-1" }' // Response includes DocuSign envelope ID and signing link

Right to Access (Article 15)

Individuals can request copies of their personal data. AAIS automates this:

  1. User submits access request (via portal or email)
  2. Identity verification (email token or SSO)
  3. AAIS compiles all data: logs, PII detections, metadata
  4. Exports to machine-readable format (JSON, CSV)
  5. Delivers via encrypted download link (expires in 30 days)
  6. Logs access request for audit trail
// API endpoint for data subject access request (DSAR) curl -X POST https://agentaishield.com/api/v1/gdpr/dsar/access \ -H "Authorization: Bearer sk_live_..." \ -d '{ "email": "[email protected]", "verification_code": "sent-via-email", "include_raw_logs": false, // Redact other users' PII "format": "json" }' // Returns { "dsar_id": "dsar_abc123", "status": "processing", "estimated_completion": "2026-02-26T10:00:00Z", "download_link": null // Populated when ready }

Right to Deletion (Article 17)

"Right to be forgotten" — irreversibly delete all user data:

Irreversible Action

Deletion is permanent. Implement a 7-day grace period where requests are "pending" to catch accidental submissions. After grace period, data is unrecoverable.

// Right to deletion API curl -X POST https://agentaishield.com/api/v1/gdpr/dsar/delete \ -H "Authorization: Bearer sk_live_..." \ -d '{ "email": "[email protected]", "verification_code": "sent-via-email", "grace_period_days": 7, "reason": "User request via support ticket #4521" }' // Deletion process { "dsar_id": "dsar_del_xyz789", "status": "pending", "scheduled_deletion": "2026-03-04T00:00:00Z", // 7 days from now "cancellation_link": "https://aais.com/cancel/xyz789" }

Consent Management

Track opt-in/opt-out per processing purpose:

// Consent tracking data structure { "user_id": "usr_abc123", "consents": { "analytics": { "granted": true, "timestamp": "2026-01-15T09:30:00Z", "version": "v2.1", "ip_address": "203.0.113.10" }, "marketing": { "granted": false, "timestamp": "2026-01-15T09:30:00Z", "version": "v2.1" }, "security_monitoring": { "granted": true, // Legitimate interest, not consent-based "legal_basis": "legitimate_interest" } } }

PII Redaction Workflows

Automatically redact PII from logs:

Encryption vs Redaction

Encryption protects data at rest. Redaction removes PII entirely. For GDPR compliance, use both: encrypt everything, redact PII in long-term retention.

Data Portability (Article 20)

Users can export data in structured, machine-readable format:

// Export user data in portable format { "user_profile": { "email": "[email protected]", "created_at": "2025-06-10T14:22:00Z", "last_login": "2026-02-25T08:15:00Z" }, "requests": [ { "timestamp": "2026-02-24T16:30:00Z", "agent_id": "chatbot-v2", "input_redacted": "What is the weather in [LOCATION]?", "output_redacted": "The weather in [LOCATION] is sunny.", "pii_detected": ["location"] } ], "total_requests": 142, "export_timestamp": "2026-02-25T20:00:00Z" }

SOC 2 Readiness

SOC 2 Type II audits verify that you have effective controls for security, availability, confidentiality, processing integrity, and privacy.

Control Mapping

AAIS pre-maps features to SOC 2 Trust Service Criteria:

CC6.1 - Logical and Physical Access Controls

CC6.6 - Encryption

CC6.7 - Transmission Integrity

CC7.2 - System Monitoring

CC7.3 - Incident Response

// Generate SOC 2 control evidence curl -X POST https://agentaishield.com/api/v1/compliance/soc2/evidence \ -H "Authorization: Bearer sk_live_..." \ -d '{ "audit_period_start": "2025-03-01", "audit_period_end": "2026-02-28", "controls": ["CC6.1", "CC6.6", "CC6.7", "CC7.2", "CC7.3"], "include_screenshots": true, "format": "pdf" }' // Returns ZIP with: // - Control narratives (how it works) // - Configuration exports (proof it's enabled) // - Sample logs (showing it's working) // - Screenshots (visual evidence)

Audit Preparation Checklist

90 days before audit:

  1. Review control descriptions: Ensure AAIS configs match documented policies
  2. Test access controls: Verify RBAC, SSO, MFA are enforced
  3. Collect evidence: Export logs, configs, screenshots
  4. Identify gaps: Run AAIS compliance checker, remediate findings
  5. Document exceptions: Explain any deviations from standards
  6. Train team: Ensure admins can explain controls to auditors
Auditor-Friendly Reports

AAIS generates "auditor view" reports with plain-English explanations, visual diagrams, and timestamped evidence. Reduces audit prep time by 60%.

Evidence Collection Automation

Instead of manually gathering screenshots during audit:

// Automated evidence snapshot (runs monthly via cron) { "evidence_snapshot_id": "snap_202602", "timestamp": "2026-02-01T00:00:00Z", "controls": { "CC6.1_access_controls": { "screenshot": "s3://evidence/cc61-2026-02.png", "config_export": "s3://evidence/cc61-rbac-config.json", "sample_logs": "s3://evidence/cc61-access-logs-sample.csv", "user_count": 47, "mfa_enabled": 47, "sso_enabled": true } } }

Common SOC 2 Audit Findings (and how AAIS prevents them)

HIPAA Compliance

The Health Insurance Portability and Accountability Act (HIPAA) applies to healthcare data. AAIS meets all technical safeguards.

Business Associate Agreement (BAA)

Required for any vendor handling Protected Health Information (PHI):

// Request BAA signing curl -X POST https://agentaishield.com/api/v1/compliance/hipaa/baa \ -H "Authorization: Bearer sk_live_..." \ -d '{ "organization_name": "HealthTech Inc", "covered_entity": true, // or business_associate "signatory_name": "Dr. John Smith", "signatory_email": "[email protected]" }'

PHI Detection & Handling

AAIS automatically detects 18 HIPAA identifiers:

De-Identification vs Redaction

HIPAA allows de-identified data (18 identifiers removed) for research. AAIS supports both "Safe Harbor" (remove all 18) and "Expert Determination" (statistician certifies de-identification).

Encryption Requirements

HIPAA Security Rule requires encryption (addressable safeguard):

// HIPAA encryption evidence { "data_at_rest": { "database": "AES-256-GCM", "object_storage": "AWS S3 SSE-KMS", "kms_key_id": "arn:aws:kms:us-east-1:123456789:key/abc-def", "key_rotation_enabled": true, "last_rotation": "2025-12-01T00:00:00Z" }, "data_in_transit": { "tls_version": "1.3", "cipher_suites": ["TLS_AES_256_GCM_SHA384"], "certificate_expiry": "2027-02-25T23:59:59Z" } }

Access Logs (Audit Controls)

HIPAA requires tracking who accessed PHI:

// HIPAA audit log entry { "log_id": "audit_hipaa_xyz123", "timestamp": "2026-02-25T14:30:00Z", "user_id": "usr_doctor_jane", "user_email": "[email protected]", "action": "view_phi", "resource": { "type": "patient_record", "patient_id": "[REDACTED]", // Tokenized in logs "record_type": "diagnosis" }, "ip_address": "10.20.30.40", "device_info": "iPad; iOS 17.3", "session_id": "ses_abc789", "immutable_hash": "sha256:a1b2c3d4..." }

Breach Notification Workflow

If PHI is exposed (>500 individuals = breach):

  1. AAIS alerts security team within 1 hour of detection
  2. Incident response team investigates scope
  3. If confirmed breach: notify affected individuals within 60 days
  4. Notify HHS (via web portal) within 60 days
  5. If media-worthy (>500 individuals), notify prominent media outlets
  6. Document incident in breach log
Breach vs Incident

Not every PHI exposure is a breach. If data was encrypted and keys were not compromised, it's often not reportable. AAIS's incident classification helps determine reporting requirements.

Audit Log Management

Immutable, tamper-proof logs for compliance and forensics.

Immutable Log Storage

Audit logs use append-only storage with cryptographic verification:

// Immutable log entry structure { "entry_id": "log_000123456", "timestamp": "2026-02-25T20:15:30.442Z", "event": "user.role.changed", "data": { ... }, "previous_hash": "sha256:abc123...", "current_hash": "sha256:def456...", "merkle_root": "sha256:root789...", "trusted_timestamp": { "authority": "rfc3161.timestamp.authority.com", "signature": "base64..." } }

SIEM Integration

Forward logs to Security Information and Event Management systems:

// Configure SIEM forwarding curl -X POST https://agentaishield.com/api/v1/integrations/siem \ -H "Authorization: Bearer sk_live_..." \ -d '{ "provider": "splunk", "endpoint": "https://splunk.company.com:8088/services/collector", "token": "your-hec-token", "event_types": [ "security.injection_detected", "security.pii_detected", "auth.login_failed", "config.changed" ], "batch_size": 100, "flush_interval_seconds": 60 }'

Retention Policies

Configure retention per log type and compliance requirement:

// Multi-tier retention policy { "log_types": { "security_events": { "retention_days": 2555, // 7 years "archive_after_days": 365, "storage_tier": "glacier" }, "hipaa_access_logs": { "retention_days": 2190, // 6 years "immutable": true }, "general_activity": { "retention_days": 90, "archive_after_days": 30 } } }

Log Search & Forensics

Powerful search for incident investigation:

// Search audit logs curl -X GET 'https://agentaishield.com/api/v1/logs/search' \ -H "Authorization: Bearer sk_live_..." \ -G \ --data-urlencode 'query=action:config.changed AND user_email:*@contractor.com' \ --data-urlencode 'start_time=2026-02-20T00:00:00Z' \ --data-urlencode 'end_time=2026-02-25T23:59:59Z' \ --data-urlencode 'limit=100'

Data Residency & Sovereignty

Control where data is stored and processed to meet local regulations.

Region Selection

Choose data residency region during org setup:

Residency Guarantee

Once a region is selected, all data (logs, configs, backups) stays in that geographic boundary. Cross-border transfers blocked at network level.

Cross-Border Data Flow

For multi-national organizations:

Data Sovereignty Requirements

Examples of country-specific regulations:

Compliance Note

AAIS currently does not operate data centers in Russia, China, or India. For these jurisdictions, use on-premise deployment or work with local cloud providers.

Building Compliance Reports

Automated report generation for auditors, regulators, and stakeholders.

PDF Report Generation

Create professional, branded compliance reports:

// Generate PDF compliance report curl -X POST https://agentaishield.com/api/v1/reports/generate \ -H "Authorization: Bearer sk_live_..." \ -d '{ "report_type": "soc2_evidence", "period_start": "2025-03-01", "period_end": "2026-02-28", "sections": [ "executive_summary", "trust_score_trends", "security_events", "access_controls", "encryption_evidence" ], "format": "pdf", "branding": { "logo_url": "https://company.com/logo.png", "primary_color": "#6366f1" } }' // Returns PDF download link

CSV Export for Analysis

Export raw data for custom analysis:

// CSV export example curl -X GET 'https://agentaishield.com/api/v1/reports/export' \ -H "Authorization: Bearer sk_live_..." \ -G \ --data-urlencode 'type=security_events' \ --data-urlencode 'start_date=2026-02-01' \ --data-urlencode 'end_date=2026-02-28' \ --data-urlencode 'format=csv' // Returns CSV with columns: // timestamp, event_type, agent_id, severity, description, user_id, ip_address

Auditor Workflows

Share evidence securely with external auditors:

  1. Generate compliance report (PDF or ZIP with logs)
  2. Upload to AAIS secure share (or your own S3 bucket)
  3. Create time-limited share link (expires in 7-30 days)
  4. Optional: require auditor email verification
  5. Track downloads in audit trail (who accessed when)
// Create auditor share link curl -X POST https://agentaishield.com/api/v1/reports/share \ -H "Authorization: Bearer sk_live_..." \ -d '{ "report_id": "rpt_abc123", "expires_in_days": 14, "require_email_verification": true, "allowed_emails": ["[email protected]"], "download_limit": 3 }' // Returns { "share_id": "share_xyz789", "url": "https://reports.agentaishield.com/share/xyz789", "expires_at": "2026-03-11T23:59:59Z" }

Scheduled Reports

Automate recurring compliance reports:

// Schedule recurring report curl -X POST https://agentaishield.com/api/v1/reports/schedule \ -H "Authorization: Bearer sk_live_..." \ -d '{ "name": "Monthly SOC 2 Evidence", "report_type": "soc2_evidence", "schedule": "0 0 1 * *", // First day of month, midnight UTC "format": "pdf", "recipients": [ "[email protected]", "[email protected]" ], "retention_days": 365 }'
Compliance Mastery Complete!

You now understand GDPR, SOC 2, HIPAA, audit logs, data residency, and automated reporting. Ready to harden your defenses? Explore Red Team Testing or Architecture & Scale next.

Previous: Enterprise Features Next: Red Team & Adversarial Testing
Last verified: March 2026 · Report an issue