Docs/Account/Security/Compliance

Compliance

Vyntech Account is designed to help you meet common compliance frameworks. This page maps our features to specific compliance controls and explains how to configure your tenant for regulatory requirements.

Supported Frameworks

🛡️ SOC 2 Type II

Trust services criteria — security, availability, processing integrity, confidentiality, privacy

📋 ISO 27001

Information security management system (ISMS) — Annex A controls

🇪🇺 GDPR

EU General Data Protection Regulation — data subject rights, lawful processing, data minimization

🏥 HIPAA

Health Insurance Portability and Accountability Act — PHI safeguards, access controls, audit trails

💳 PCI-DSS

Payment Card Industry Data Security Standard — strong authentication, access control, monitoring

SOC 2 Mapping

How Vyntech Account features map to SOC 2 Type II trust services criteria.

Control	Description	Vyntech Account Features
CC6.1	Logical access	RBAC, roles, permissions, Cedar policies
CC6.2	User provisioning	User API, registration, deprovisioning workflows
CC6.3	Access removal	Session revocation, user deletion, role unassignment
CC6.6	System boundaries	Tenant isolation, network policies, IP restrictions
CC7.2	Monitoring	Risk engine, audit logs, webhooks
CC7.3	Incident detection	Anomaly detection, blocked login alerts, risk scoring
CC8.1	Change management	Settings audit trail, immutable logs

ISO 27001 Mapping

Annex A controls and how Vyntech Account supports them.

Control	Description	Vyntech Account Features
A.9.1	Access control policy	Per-tenant settings, password policies, MFA enforcement
A.9.2	User access management	Registration, role assignment, MFA enrollment
A.9.3	User responsibilities	Password policies, MFA enforcement, session awareness
A.9.4	System access control	IP restrictions, session limits, risk engine
A.12.4	Logging and monitoring	Audit logs, webhook notifications, event subscriptions

GDPR

Vyntech Account supports EU data protection requirements through the following mechanisms:

•Data minimization: Only necessary identity data is collected (email, display name, auth credentials). No tracking or profiling beyond authentication.
•Right to erasure: DELETE /users/:id permanently removes all user data including sessions, audit entries (anonymized), and role assignments.
•Data portability: GET /users/:id returns all user data in JSON format, enabling export and transfer to other systems.
•Data residency: Data is stored in the AU region by default. Enterprise plans can configure specific regions (EU, US, APAC) to satisfy data locality requirements.
•Consent: User registration constitutes explicit consent. No additional tracking cookies or analytics are used beyond authentication functions.
•Breach notification: Automated alerts via webhooks and email. Supports 72-hour notification process with incident detail export.

HIPAA

For healthcare organizations handling Protected Health Information (PHI):

•PHI access controls: RBAC and Cedar policies provide fine-grained access control to ensure only authorized personnel access protected data.
•Audit trail: Complete, immutable audit log for all access to protected data — who accessed what, when, and from where.
•Automatic session timeout: Configurable idle_timeout_seconds ensures sessions expire after inactivity, preventing unauthorized access to unattended workstations.
•Encryption: Data encrypted at rest (AES-256-GCM) and in transit (TLS 1.3). All sensitive fields are encrypted at the application layer.
•BAA: Business Associate Agreement available on the Enterprise plan. Contact sales to execute.

PCI-DSS

For organizations processing payment card data:

•Strong authentication: MFA enforcement for all users with access to cardholder data environments.
•Password complexity and rotation: Configurable password policies including minimum length, complexity rules, and rotation intervals.
•Session management: Idle timeout, maximum concurrent sessions, and automatic session invalidation after inactivity.
•Audit logging: Complete logging of all administrative access, configuration changes, and authentication events.
•Network segmentation: Tenant isolation, IP allowlists/blocklists, and network policies restrict access to authorized networks only.

Configuring for Compliance

Recommended tenant settings for each framework:

🛡️ For SOC 2

•Enable audit logs (retained ≥ 1 year)
•Enforce MFA for all users
•Set session limits (max 5 concurrent)
•Enable webhook notifications for security events

🏥 For HIPAA

•Set idle timeout to 1800 seconds (30 minutes)
•Enforce MFA for all users
•Enable IP restrictions (allowlist only)
•Retain audit logs for minimum 6 years

💳 For PCI-DSS

•Password rotation every 90 days
•Enforce MFA for all administrative access
•IP restrictions — allowlist only
•Max concurrent sessions: 1
•Idle timeout: 900 seconds (15 minutes)

See the Tenant Settings guide for implementation details on all configurable options.

Data Residency

The default data region is Australia (ap-southeast-2). All tenant data — users, sessions, audit logs, policies — is stored within this region.

Enterprise plans can request specific regions: US (us-east-1), EU (eu-west-1), or APAC (ap-southeast-2). Data never leaves the configured region — no cross-region replication or processing.

Audit Log Retention

Standard Plans

Logs retained for 1 year. Sufficient for most SOC 2 and ISO 27001 requirements.

Enterprise / Compliance Add-on

Logs retained for 7 years. Meets HIPAA and PCI-DSS long-term retention requirements.

Tamper-evident: All audit logs are immutable and hash-chained. Each entry includes a cryptographic hash of the previous entry, making it computationally infeasible to alter historical records without detection.

What's Next

Security Architecture →

Deep dive into cryptographic choices, infrastructure security, and threat model

Tenant Settings →

Configure security policies, access controls, and compliance-related settings

Session Management →

Idle timeouts, concurrent session limits, and session revocation

Plans & Quotas →

Feature availability, retention periods, and limits by plan tier