Skip to main content

Compliance Overview

ASCEND provides comprehensive compliance controls aligned with major regulatory frameworks for enterprise AI governance. The platform's 12-layer defense-in-depth security architecture maps directly to these compliance frameworks, enabling organizations to maintain regulatory compliance while governing AI operations.

Supported Frameworks​

FrameworkCoverageCertification
SOC 2 Type IIFullAudit-ready
HIPAAFullBAA available
PCI-DSSFullLevel 1 compliant
NIST 800-53FullRev 5 aligned
NIST CSFFullv2.0 aligned
GDPRFullEU compliant
SOXFullSection 404
MITRE ATT&CKFullv14 mapped

Compliance Architecture​

┌─────────────────────────────────────────────────────────────────┐
│                    ASCEND COMPLIANCE LAYER                       │
├─────────────────────────────────────────────────────────────────┤
│                                                                  │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐          │
│  │   SOC 2      │  │    HIPAA     │  │   PCI-DSS    │          │
│  │  Type II     │  │  Safeguards  │  │  Requirements│          │
│  └──────┬───────┘  └──────┬───────┘  └──────┬───────┘          │
│         │                 │                 │                    │
│         └─────────────────┼─────────────────┘                    │
│                           ▼                                      │
│  ┌─────────────────────────────────────────────────────────┐    │
│  │              Unified Control Framework                   │    │
│  │                                                          │    │
│  │  • Access Control (AC)    • Audit & Accountability (AU) │    │
│  │  • Configuration Mgmt (CM) • Identification & Auth (IA) │    │
│  │  • System & Comms (SC)    • System & Info Integrity (SI)│    │
│  └─────────────────────────────────────────────────────────┘    │
│                           │                                      │
│                           ▼                                      │
│  ┌─────────────────────────────────────────────────────────┐    │
│  │                 Compliance Engine                        │    │
│  │                                                          │    │
│  │  Action → NIST Control → MITRE Technique → Risk Score   │    │
│  └─────────────────────────────────────────────────────────┘    │
│                                                                  │
└─────────────────────────────────────────────────────────────────┘

Control Categories​

Access Control (AC)​

Controls governing who can access what resources under what conditions.

ControlDescriptionImplementation
AC-2Account ManagementUser provisioning, role assignment
AC-3Access EnforcementPolicy-based authorization
AC-4Information Flow EnforcementData classification controls
AC-6Least PrivilegeMinimal access permissions

Audit and Accountability (AU)​

Controls ensuring comprehensive audit trails and accountability.

ControlDescriptionImplementation
AU-2Audit EventsEvent logging configuration
AU-6Audit Review & AnalysisLog analysis and alerting
AU-7Audit ReductionLog filtering and summarization
AU-9Protection of Audit InfoImmutable audit logs

Configuration Management (CM)​

Controls for managing system configurations securely.

ControlDescriptionImplementation
CM-3Configuration Change ControlChange management workflows
CM-6Configuration SettingsSecure baseline configurations
CM-8Information System InventoryAsset management

Identification and Authentication (IA)​

Controls for identity verification and authentication.

ControlDescriptionImplementation
IA-2Identification & AuthenticationUser/agent authentication
IA-4Identifier ManagementUnique identifier assignment
IA-5Authenticator ManagementCredential lifecycle

System and Communications Protection (SC)​

Controls protecting system boundaries and communications.

ControlDescriptionImplementation
SC-7Boundary ProtectionNetwork segmentation
SC-8Transmission ConfidentialityTLS 1.3 encryption
SC-13Cryptographic ProtectionAES-256 encryption

System and Information Integrity (SI)​

Controls ensuring system and data integrity.

ControlDescriptionImplementation
SI-3Malicious Code ProtectionThreat detection
SI-4System MonitoringReal-time monitoring
SI-12Information HandlingData lifecycle management

Automatic Compliance Mapping​

Every agent action is automatically mapped to compliance controls:

{
  "action_type": "database_write",
  "compliance_mapping": {
    "nist_control": "AC-3",
    "nist_family": "Access Control",
    "nist_description": "Access Enforcement",
    "mitre_tactic": "TA0003",
    "mitre_technique": "T1098",
    "soc2_control": "CC6.1",
    "pci_requirement": "7.1"
  }
}

Mapping Coverage​

Action CategoryNIST ControlsMITRE TacticsSOC 2
Read OperationsAC-3, AU-2TA0009CC6.1
Write OperationsAC-3, AU-9TA0003CC6.1
Delete OperationsAC-6, CM-3TA0040CC7.1
Data ExportAC-4, SI-12TA0010CC6.1
AuthenticationIA-2, IA-5TA0006CC6.1
System ChangesCM-3, SI-4TA0005CC7.2

Compliance Reports​

Available Report Types​

ReportFrequencyFormatPurpose
SOC 2 EvidenceOn-demandPDF/JSONAuditor review
HIPAA Audit TrailDailyJSONPHI access tracking
PCI-DSS ComplianceMonthlyPDFPayment data compliance
NIST Control StatusWeeklyJSONControl effectiveness
Risk AssessmentReal-timeDashboardCurrent risk posture

Generating Reports​

# SOC 2 evidence export
curl "https://pilot.owkai.app/api/compliance/export/soc2" \
  -H "X-API-Key: your_api_key"

# HIPAA audit trail
curl "https://pilot.owkai.app/api/compliance/export/hipaa?days=30" \
  -H "X-API-Key: your_api_key"

# NIST control assessment
curl "https://pilot.owkai.app/api/compliance/export/nist" \
  -H "X-API-Key: your_api_key"

Audit Trail Structure​

Every action generates an immutable audit record:

{
  "audit_id": "aud_20250115_143052_a1b2c3d4",
  "timestamp": "2025-01-15T14:30:52Z",
  "organization_id": 4,
  "user_id": 15,
  "agent_id": "customer-service-agent",
  "action": {
    "type": "database_write",
    "description": "Update customer record",
    "target": "customers.email",
    "risk_score": 45
  },
  "compliance": {
    "nist_control": "AC-3",
    "mitre_tactic": "TA0003",
    "soc2_control": "CC6.1",
    "pci_requirement": "7.1"
  },
  "decision": {
    "status": "approved",
    "method": "auto_approve",
    "reason": "Risk below threshold"
  },
  "context": {
    "ip_address": "10.0.1.50",
    "session_id": "sess_abc123",
    "correlation_id": "corr_xyz789"
  }
}

Data Residency​

Ascend supports configurable data residency for compliance:

RegionData CenterCompliance
US EastAWS us-east-2SOC 2, HIPAA, PCI-DSS
US WestAWS us-west-2SOC 2, HIPAA, PCI-DSS
EUAWS eu-west-1GDPR, SOC 2
UKAWS eu-west-2UK GDPR, SOC 2

Encryption Standards​

Data at Rest​

Data TypeEncryptionKey Management
DatabaseAES-256-GCMAWS KMS
BackupsAES-256-GCMAWS KMS
Audit LogsAES-256-GCMAWS KMS
Config FilesAES-256-GCMAWS KMS

Data in Transit​

ConnectionProtocolCertificate
APITLS 1.3RSA-2048
WebSocketWSS/TLS 1.3RSA-2048
DatabaseTLS 1.3RDS CA
InternalmTLSInternal CA

Compliance API​

Access compliance data programmatically:

# Get compliance status
GET /api/compliance/status

# Get control mappings
GET /api/compliance/controls

# Export audit trail
GET /api/compliance/audit-trail?start=2025-01-01&end=2025-01-31

# Generate compliance report
POST /api/compliance/reports/generate

12-Layer Security to Compliance Mapping​

ASCEND's security architecture directly supports compliance requirements:

LayerSOC 2HIPAAPCI-DSSNIST 800-53
1. Rate LimitingCC7.1164.312(e)Req 6.5SC-5
2. Prompt SecurityCC6.1164.312(e)Req 6.5SI-10
3. Code AnalysisCC6.1164.312(e)Req 6.5SI-10
4. Action GovernanceCC7.1164.312(a)Req 7.1AC-3
5. JWT AuthenticationCC6.1164.312(d)Req 8.2IA-2
6. API Key AuthCC6.1164.312(d)Req 8.6IA-5
7. RBACCC6.2, CC6.3164.312(a)Req 7.1AC-2
8. BYOK EncryptionCC6.7164.312(e)Req 3.5SC-28
9. Audit LoggingCC7.1164.312(b)Req 10.1AU-2
10. Input ValidationCC6.1164.312(e)Req 6.5SI-10
11. Secrets ManagementCC6.7164.312(e)Req 3.5SC-12
12. Security HeadersCC6.1164.312(e)Req 6.5SC-8

OWASP LLM Top 10 Coverage​

ASCEND provides protection against LLM-specific vulnerabilities:

OWASP IDVulnerabilityASCEND ControlStatus
LLM01Prompt Injection20 pattern detectionProtected
LLM02Insecure OutputCode analysis, validationProtected
LLM04Model DoSRate limiting, kill switchProtected
LLM06Sensitive DisclosurePrompt security, RLSProtected
LLM07Insecure PluginAction governanceProtected
LLM08Excessive AgencyRBAC, approvalsProtected

Next Steps​

For compliance questions or audit support, contact compliance@owkai.app