Compliance
Vyntech Account is designed to help you meet common compliance frameworks. This page maps our features to specific compliance controls and explains how to configure your tenant for regulatory requirements.
Supported Frameworks
π‘οΈ SOC 2 Type II
Trust services criteria β security, availability, processing integrity, confidentiality, privacy
π ISO 27001
Information security management system (ISMS) β Annex A controls
πͺπΊ GDPR
EU General Data Protection Regulation β data subject rights, lawful processing, data minimization
π₯ HIPAA
Health Insurance Portability and Accountability Act β PHI safeguards, access controls, audit trails
π³ PCI-DSS
Payment Card Industry Data Security Standard β strong authentication, access control, monitoring
SOC 2 Mapping
How Vyntech Account features map to SOC 2 Type II trust services criteria.
| Control | Description | Vyntech Account Features |
|---|---|---|
| CC6.1 | Logical access | RBAC, roles, permissions, Cedar policies |
| CC6.2 | User provisioning | User API, registration, deprovisioning workflows |
| CC6.3 | Access removal | Session revocation, user deletion, role unassignment |
| CC6.6 | System boundaries | Tenant isolation, network policies, IP restrictions |
| CC7.2 | Monitoring | Risk engine, audit logs, webhooks |
| CC7.3 | Incident detection | Anomaly detection, blocked login alerts, risk scoring |
| CC8.1 | Change management | Settings audit trail, immutable logs |
ISO 27001 Mapping
Annex A controls and how Vyntech Account supports them.
| Control | Description | Vyntech Account Features |
|---|---|---|
| A.9.1 | Access control policy | Per-tenant settings, password policies, MFA enforcement |
| A.9.2 | User access management | Registration, role assignment, MFA enrollment |
| A.9.3 | User responsibilities | Password policies, MFA enforcement, session awareness |
| A.9.4 | System access control | IP restrictions, session limits, risk engine |
| A.12.4 | Logging and monitoring | Audit logs, webhook notifications, event subscriptions |
GDPR
Vyntech Account supports EU data protection requirements through the following mechanisms:
- β’Data minimization: Only necessary identity data is collected (email, display name, auth credentials). No tracking or profiling beyond authentication.
- β’Right to erasure:
DELETE /users/:idpermanently removes all user data including sessions, audit entries (anonymized), and role assignments. - β’Data portability:
GET /users/:idreturns all user data in JSON format, enabling export and transfer to other systems. - β’Data residency: Data is stored in the AU region by default. Enterprise plans can configure specific regions (EU, US, APAC) to satisfy data locality requirements.
- β’Consent: User registration constitutes explicit consent. No additional tracking cookies or analytics are used beyond authentication functions.
- β’Breach notification: Automated alerts via webhooks and email. Supports 72-hour notification process with incident detail export.
HIPAA
For healthcare organizations handling Protected Health Information (PHI):
- β’PHI access controls: RBAC and Cedar policies provide fine-grained access control to ensure only authorized personnel access protected data.
- β’Audit trail: Complete, immutable audit log for all access to protected data β who accessed what, when, and from where.
- β’Automatic session timeout: Configurable
idle_timeout_secondsensures sessions expire after inactivity, preventing unauthorized access to unattended workstations. - β’Encryption: Data encrypted at rest (AES-256-GCM) and in transit (TLS 1.3). All sensitive fields are encrypted at the application layer.
- β’BAA: Business Associate Agreement available on the Enterprise plan. Contact sales to execute.
PCI-DSS
For organizations processing payment card data:
- β’Strong authentication: MFA enforcement for all users with access to cardholder data environments.
- β’Password complexity and rotation: Configurable password policies including minimum length, complexity rules, and rotation intervals.
- β’Session management: Idle timeout, maximum concurrent sessions, and automatic session invalidation after inactivity.
- β’Audit logging: Complete logging of all administrative access, configuration changes, and authentication events.
- β’Network segmentation: Tenant isolation, IP allowlists/blocklists, and network policies restrict access to authorized networks only.
Configuring for Compliance
Recommended tenant settings for each framework:
π‘οΈ For SOC 2
- β’Enable audit logs (retained β₯ 1 year)
- β’Enforce MFA for all users
- β’Set session limits (max 5 concurrent)
- β’Enable webhook notifications for security events
π₯ For HIPAA
- β’Set idle timeout to 1800 seconds (30 minutes)
- β’Enforce MFA for all users
- β’Enable IP restrictions (allowlist only)
- β’Retain audit logs for minimum 6 years
π³ For PCI-DSS
- β’Password rotation every 90 days
- β’Enforce MFA for all administrative access
- β’IP restrictions β allowlist only
- β’Max concurrent sessions: 1
- β’Idle timeout: 900 seconds (15 minutes)
See the Tenant Settings guide for implementation details on all configurable options.
Data Residency
The default data region is Australia (ap-southeast-2). All tenant data β users, sessions, audit logs, policies β is stored within this region.
Enterprise plans can request specific regions: US (us-east-1), EU (eu-west-1), or APAC (ap-southeast-2). Data never leaves the configured region β no cross-region replication or processing.
Audit Log Retention
Standard Plans
Logs retained for 1 year. Sufficient for most SOC 2 and ISO 27001 requirements.
Enterprise / Compliance Add-on
Logs retained for 7 years. Meets HIPAA and PCI-DSS long-term retention requirements.
Tamper-evident: All audit logs are immutable and hash-chained. Each entry includes a cryptographic hash of the previous entry, making it computationally infeasible to alter historical records without detection.
What's Next
Security Architecture β
Deep dive into cryptographic choices, infrastructure security, and threat model
Tenant Settings β
Configure security policies, access controls, and compliance-related settings
Session Management β
Idle timeouts, concurrent session limits, and session revocation
Plans & Quotas β
Feature availability, retention periods, and limits by plan tier