travisjneuman/.claude/compliance-engineering

Compliance Engineering

Framework Overview

SOC 2 Controls in Code

Audit Logging

interface AuditEvent {
  timestamp: string;
  actor: { id: string; role: string; ip: string };
  action: string;
  resource: { type: string; id: string };
  outcome: 'success' | 'failure';
  metadata: Record<string, unknown>;
}
async function auditLog(event: AuditEvent): Promise<void> {
  // Write-once, append-only storage (immutable)
  await auditStore.append({
    ...event,
    timestamp: new Date().toISOString(),
    hash: computeChainHash(event), // tamper detection
  });
}

Access Control

// RBAC with principle of least privilege
const permissions = {
  admin: ['read', 'write', 'delete', 'manage_users'],
  editor: ['read', 'write'],
  viewer: ['read'],
} as const;
function authorize(user: User, action: string, resource: Resource): boolean {
  const allowed = permissions[user.role];
  if (!allowed?.includes(action)) {
    auditLog({ action, outcome: 'failure', actor: user, resource });
    return false;
  }
  return true;
}

HIPAA Technical Safeguards

• Encryption at rest: AES-256 for PHI storage, AWS KMS / GCP KMS for key management
• Encryption in transit: TLS 1.2+ mandatory, certificate pinning for mobile
• Access controls: Unique user IDs, automatic logoff, MFA required
• Audit controls: Log all PHI access, retain logs 6+ years, tamper-evident
• Data backup: Encrypted backups, tested restore procedures, geographic redundancy

GDPR Implementation

Consent Management

interface ConsentRecord {
  userId: string;
  purpose: string;
  granted: boolean;
  timestamp: string;
  source: 'explicit' | 'legitimate_interest';
  withdrawable: boolean;
}
// Data Subject Access Request (DSAR)
async function handleDSAR(userId: string, type: 'access' | 'erasure' | 'portability') {
  switch (type) {
    case 'access': return await exportUserData(userId); // JSON/CSV
    case 'erasure': return await deleteUserData(userId); // Right to be forgotten
    case 'portability': return await exportPortableData(userId); // Machine-readable
  }
}

Data Minimization

• Collect only what's needed for the stated purpose
• Set retention policies with automatic deletion
• Pseudonymize where possible (replace PII with tokens)
• Anonymize for analytics (k-anonymity, differential privacy)

Consumer Web App Defaults

• [ ] Fonts, CSS, and JS self-hosted (next/font, @fontsource/*); no fonts.googleapis.com on page view (GDPR IP leak; Munich court, 2022)
• [ ] Session replay (Sentry Replay, PostHog, Hotjar, Clarity, LogRocket, FullStory) off until consent, inputs masked (California CIPA wiretap claims)
• [ ] Marketing email: unsubscribe link, List-Unsubscribe header, physical postal address (CAN-SPAM)
• [ ] Subscriptions: renewal terms next to the button, express consent, online cancellation (California ARL, FTC ROSCA)
• [ ] Age policy: not child-directed, or verifiable parental consent before collecting data from under-13s (COPPA)
• [ ] Public user uploads: DMCA designated agent registered with the Copyright Office (renew every 3 years) and a notice-and-takedown page (17 U.S.C. 512(c))

PCI-DSS Key Controls

• Never store CVV/CVC — ever, in any form
• Tokenize card numbers — use Stripe/Braintree tokens instead of raw PANs
• Network segmentation — isolate cardholder data environment (CDE)
• Quarterly vulnerability scans — ASV-approved external scans
• Penetration testing — annual at minimum, after significant changes

Compliance as Code

• Policy as code: Open Policy Agent (OPA), AWS Config Rules, Azure Policy
• Infrastructure compliance: Terraform Sentinel, Checkov, tfsec
• Runtime compliance: Falco for container monitoring, AWS GuardDuty
• Evidence collection: Automated screenshot/log collection for audit evidence