Compliance Overview

Rack Gateway is designed with compliance in mind, providing the controls and audit capabilities needed for SOC 2, HIPAA, and other regulatory frameworks.

Compliance Features

Audit Logging

Complete, append-only, hash-chained audit trail of every request, written before the gateway acts.

Learn more →

Access Controls

Role-based access control with least privilege enforcement.

Learn more →

Data Protection

Encryption at rest and in transit, with optional S3 WORM storage.

Learn more →

SOC 2 Alignment

Controls mapped to SOC 2 Trust Services Criteria.

Learn more →

Compliance Architecture

Key Compliance Controls

Authentication and Access

Control	Implementation	Evidence
Unique user identification	Google OAuth with email	User records
Multi-factor authentication	TOTP, WebAuthn, YubiKey	MFA enrollment records
Access control	RBAC with 5 roles	Role assignments
Session management	Configurable timeouts	Session records
Password policy	Delegated to Google Workspace	N/A (no local passwords)

Audit and Monitoring

Control	Implementation	Evidence
Activity logging	All API requests logged	Audit log entries
User actions	Who did what, when	Audit trail
Access attempts	Successful and failed	RBAC decisions
Secret protection	Env var values redacted unless an app lists them as visible	Redacted logs
Log integrity	HMAC hash chain, hourly verification, S3 Object Lock anchors	Verification status, anchors

Data Protection

Control	Implementation	Evidence
Encryption in transit	TLS 1.2+ required	HTTPS configuration
Encryption at rest	RDS and S3 encryption with AWS KMS; MFA secrets and the Slack token also encrypted with `COLUMN_ENCRYPTION_KEY`	KMS key policy
Data retention	Audit events are never deleted; anchors are locked for the bucket’s default Object Lock retention	Object Lock configuration
Data deletion	Users and tokens can be deleted; their audit history stays	Audit log

Compliance Checklist

Before Production

OAuth configured with domain restriction
MFA required for all users (the default)
RBAC roles assigned appropriately
Audit logging configured and tested
S3 WORM bucket configured (if required)
Session timeout set appropriately
HTTPS enabled with valid certificate
Access review process documented

Ongoing Operations

Supported Frameworks

Rack Gateway provides controls that support compliance with:

Framework	Alignment Level	Key Features
SOC 2 Type II	Strong	Full audit trail, RBAC, MFA, encryption
HIPAA	Partial	Access controls, audit logging, encryption
PCI DSS	Partial	Access controls, logging, secure configuration
ISO 27001	Partial	Information security controls
GDPR	Partial	Access controls, audit trail

Evidence Collection

For compliance audits, Rack Gateway provides:

Automated Evidence

Audit logs: Complete activity history
User records: All users with roles and status
Session records: Authentication history
Token records: API token usage and lifecycle
Configuration: Current security settings

Manual Evidence

Access review documentation
Incident response records
Change management records
Training records

Audit Log Queries

Use the Audit Logs page, its API with an admin’s session (API tokens can’t read audit logs), or SQL:

# API: last 7 days for a user
curl -b "session_token=$SESSION_TOKEN" \
  "https://gateway.example.com/api/v1/audit-logs?user=alice@example.com&range=7d"

Compliance Reporting

User Access Report

Field	Description
User email	Unique identifier
Role	Current role assignment
Last login	Most recent authentication
MFA status	Enrolled methods
API tokens	Number of active tokens

Activity Report

Field	Description
Date range	Reporting period
Total events	Number of audit entries
Unique users	Active users
Top actions	Most common operations
Denied requests	RBAC denials

Next Steps

SOC 2 - SOC 2 control mapping
Audit Trail - Detailed audit logging
Data Retention - Retention policies