compliance

Compliance Patterns

Regulatory compliance review for code that touches regulated data ${DEVFLOW_COMPLIANCE_SCOPE}. Use alongside devflow:security for complete coverage.

Iron Law

IF IT TOUCHES REGULATED DATA: CLASSIFY IT, MINIMIZE IT, ENCRYPT IT, AUDIT IT

Regulated data crossing a code path without classification, minimization, encryption, or an audit trail is a compliance gap — regardless of framework. No exceptions.

Active Frameworks

${DEVFLOW_COMPLIANCE_ACTIVE}

Scope Boundary

Compliance covers regulatory-specific gaps: retention, erasure/data-subject rights, audit-trail completeness (actor/purpose fields), segregation of duties, framework mapping, IaC exposure. Do NOT re-raise security lens findings (injection, secret handling, authN/Z) — reference those via framework mapping only.

Clean-Report Contract

If the diff/design has no regulated-data surface (no PII/PHI/payment fields, no sensitive data in logs, no IaC, no auth/audit/retention changes) → emit zero findings with a one-line "no compliance-relevant surface detected" note. Never manufacture findings.

Control Categories

1. Data Classification & Minimization

// VULNERABLE: full SSN stored when only last-4 needed
user.ssn = req.body.ssn;
// COMPLIANT: store minimum; annotate purpose + retention
user.ssnLast4 = req.body.ssn.slice(-4); // retention: 90d for verification

2. Sensitive Data in Logs & Errors

// VULNERABLE: PII in structured log
logger.info('login', { email, password, creditCard });
// COMPLIANT: omit or mask regulated fields
logger.info('login', { userId, ip });

3. Encryption In Transit & At Rest

// VULNERABLE: plaintext PHI written to disk
fs.writeFileSync('/data/patients.json', JSON.stringify(records));
// COMPLIANT: encrypt before write; TLS enforced at transport
await vault.encrypt(records, { key: 'phi-key', algo: 'AES-256-GCM' });