Security & Compliance Quick-Ref (FDE)
Enough to earn a security team’s "yes": what SOC 2 / HIPAA / GDPR actually ask, how to handle data and secrets, and what reviews check.
The frameworks (what they care about)
- SOC 2
- Trust controls: access control, encryption, change mgmt, monitoring, vendor risk. Report, not a law.
- HIPAA
- US health data (PHI). Needs a BAA, encryption, access logs, minimum-necessary access.
- GDPR
- EU personal data. Lawful basis, data-subject rights (access/delete), data-residency, DPA.
- PCI-DSS
- Card data. Easiest win: never touch it — tokenize / use a processor.
Data handling
- Encrypt everywhere
- TLS in transit; encryption at rest. Non-negotiable table stakes.
- Data residency
- Know which region/network data must stay in. Drives the deployment target.
- Minimize + retain
- Collect only what you need; delete on a schedule. Less data = less risk.
- PII discipline
- Redact/mask in logs and prompts. Never paste customer PII into a third-party API without approval.
Secrets & access
- No secrets in code/repo
- Use their vault/KMS + env injection. Rotate. Never log a token.
- Least privilege
- Scope keys to exactly what’s needed; short-lived over long-lived.
- Audit trail
- Log who did what, when. Immutable, exportable — reviewers will ask.
- MFA + SSO
- Integrate with their identity provider; don’t create a parallel login.
The security review
- Bring the answers
- Data flow diagram, where data lives, encryption, access model, subprocessors.
- Smaller ask = faster yes
- Request minimum scope + a bounded footprint; huge asks stall.
- Involve them early
- A veto at the end kills the deal. Loop security in during discovery.