Regulatory Compliance (GDPR, HIPAA, SOC2)

Geode is designed to help organizations meet stringent regulatory compliance requirements across multiple frameworks including GDPR, HIPAA, SOC2, PCI DSS, and industry-specific regulations. This comprehensive guide covers how Geode’s security features support compliance objectives and best practices for deploying compliant graph database systems. <h3 id="compliance-framework-overview" class="position-relative d-flex align-items-center group"> Compliance Framework Overview <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="compliance-framework-overview" aria-haspopup="dialog" aria-label="Share link: Compliance Framework Overview"> Share link </button> </h3><div id="headingShareModal" class="heading-share-modal" role="dialog" aria-modal="true" aria-labelledby="headingShareTitle" hidden> <div class="hsm-dialog" role="document"> <div class="hsm-header"> <h2 id="headingShareTitle" class="h6 mb-0 fw-bold">Share this section</h2> <button type="button" class="hsm-close" aria-label="Close"> </button> </div> <div class="hsm-body"> <label for="headingShareInput" class="form-label small text-muted mb-1 text-uppercase fw-bold" style="font-size: 0.7rem; letter-spacing: 0.5px;">Permalink</label> <div class="input-group mb-4 hsm-url-group"> <input id="headingShareInput" type="text" class="form-control font-monospace" readonly aria-readonly="true" style="font-size: 0.85rem;" /> <button class="btn btn-primary hsm-copy" type="button" aria-label="Copy" title="Copy"> </button> </div> <div class="small fw-bold mb-2 text-muted text-uppercase" style="font-size: 0.7rem; letter-spacing: 0.5px;">Share via</div> <div class="hsm-share-grid"> <a id="share-twitter" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Twitter </a> <a id="share-linkedin" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> LinkedIn </a> <a id="share-facebook" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Facebook </a> </div> </div> </div> </div> <style> .heading-share-modal { position: fixed; inset: 0; display: flex; justify-content: center; align-items: center; background: rgba(0, 0, 0, 0.6); z-index: 1050; padding: 1rem; backdrop-filter: blur(4px); -webkit-backdrop-filter: blur(4px); } .heading-share-modal[hidden] { display: none !important; } .hsm-dialog { max-width: 420px; width: 100%; background: var(--bs-body-bg, #fff); color: var(--bs-body-color, #212529); border: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); border-radius: 1rem; box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25); overflow: hidden; animation: hsm-fade-in 0.2s ease-out; } @keyframes hsm-fade-in { from { opacity: 0; transform: scale(0.95); } to { opacity: 1; transform: scale(1); } } [data-bs-theme="dark"] .hsm-dialog { background: #1e293b; border-color: rgba(255,255,255,0.1); color: #f8f9fa; } .hsm-header { display: flex; justify-content: space-between; align-items: center; padding: 1rem 1.5rem; border-bottom: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); background: rgba(0,0,0,0.02); } [data-bs-theme="dark"] .hsm-header { background: rgba(255,255,255,0.02); border-color: rgba(255,255,255,0.1); } .hsm-close { background: transparent; border: none; color: inherit; opacity: 0.5; padding: 0.25rem 0.5rem; border-radius: 0.25rem; font-size: 1.2rem; line-height: 1; transition: opacity 0.2s; } .hsm-close:hover { opacity: 1; } .hsm-body { padding: 1.5rem; } .hsm-url-group { display: flex !important; align-items: stretch; } .hsm-url-group .form-control { flex: 1; min-width: 0; margin: 0; background: var(--bs-secondary-bg, #f8f9fa); border-color: var(--bs-border-color, #dee2e6); border-top-right-radius: 0; border-bottom-right-radius: 0; height: 42px; } .hsm-url-group .btn { flex: 0 0 auto; margin: 0; margin-left: -1px; border-top-left-radius: 0; border-bottom-left-radius: 0; height: 42px; display: flex; align-items: center; justify-content: center; padding: 0 1.25rem; z-index: 2; } [data-bs-theme="dark"] .hsm-url-group .form-control { background: #0f172a; border-color: #334155; color: #e2e8f0; } .hsm-share-grid { display: flex; flex-direction: column; gap: 0.5rem; } .hsm-share-grid .btn { display: flex; align-items: center; justify-content: center; font-size: 0.9rem; padding: 0.6rem; border-color: var(--bs-border-color); width: 100%; } [data-bs-theme="dark"] .hsm-share-grid .btn { color: #e2e8f0; border-color: #475569; } [data-bs-theme="dark"] .hsm-share-grid .btn:hover { background: #334155; border-color: #cbd5e1; } </style> <script> (function(){ const modal = document.getElementById('headingShareModal'); if(!modal) return; const input = modal.querySelector('#headingShareInput'); const copyBtn = modal.querySelector('.hsm-copy'); const twitter = modal.querySelector('#share-twitter'); const linkedin = modal.querySelector('#share-linkedin'); const facebook = modal.querySelector('#share-facebook'); const closeBtn = modal.querySelector('.hsm-close'); let lastFocus=null; let trapBound=false; function buildUrl(id){ return window.location.origin + window.location.pathname + '#' + id; } function isOpen(){ return !modal.hasAttribute('hidden'); } function hydrate(id){ const url=buildUrl(id); input.value=url; const enc=encodeURIComponent(url); const text=encodeURIComponent(document.title); if(twitter) twitter.href=`https://twitter.com/intent/tweet?url=${enc}&text=${text}`; if(linkedin) linkedin.href=`https://www.linkedin.com/sharing/share-offsite/?url=${enc}`; if(facebook) facebook.href=`https://www.facebook.com/sharer/sharer.php?u=${enc}`; } function openModal(id){ lastFocus=document.activeElement; hydrate(id); if(!isOpen()){ modal.removeAttribute('hidden'); } requestAnimationFrame(()=>{ input.focus(); }); trapFocus(); } function closeModal(){ if(!isOpen()) return; modal.setAttribute('hidden',''); if(lastFocus && typeof lastFocus.focus==='function') lastFocus.focus(); } function copyCurrent(){ try{ navigator.clipboard.writeText(input.value).then(()=>feedback(true),()=>fallback()); } catch(e){ fallback(); } } function fallback(){ input.select(); try{ document.execCommand('copy'); feedback(true);}catch(e){ feedback(false);} } function feedback(ok){ if(!copyBtn) return; const icon=copyBtn.querySelector('i'); if(!icon) return; const prev=copyBtn.getAttribute('data-prev')||icon.className; if(!copyBtn.getAttribute('data-prev')) copyBtn.setAttribute('data-prev',prev); icon.className= ok ? 'fa-duotone fa-clipboard-check':'fa-duotone fa-circle-exclamation'; setTimeout(()=>{ icon.className=prev; },1800); } function handleShareClick(e){ e.preventDefault(); const btn=e.currentTarget; const id=btn.getAttribute('data-share-target'); if(id) openModal(id); } function bindShareButtons(){ document.querySelectorAll('.h-share').forEach(btn=>{ if(!btn.dataset.hShareBound){ btn.addEventListener('click', handleShareClick); btn.dataset.hShareBound='1'; } }); } bindShareButtons(); if(document.readyState==='loading'){ document.addEventListener('DOMContentLoaded', bindShareButtons); } else { requestAnimationFrame(bindShareButtons); } document.addEventListener('click', function(e){ const shareBtn=e.target.closest && e.target.closest('.h-share'); if(shareBtn && !shareBtn.dataset.hShareBound){ handleShareClick.call(shareBtn, e); } }, true); document.addEventListener('click', e=>{ if(e.target===modal) closeModal(); if(e.target.closest && e.target.closest('.hsm-close')){ e.preventDefault(); closeModal(); } if(copyBtn && (e.target===copyBtn || (e.target.closest && e.target.closest('.hsm-copy')))) { e.preventDefault(); copyCurrent(); } }); document.addEventListener('keydown', e=>{ if(e.key==='Escape' && isOpen()) closeModal(); }); function trapFocus(){ if(trapBound) return; trapBound=true; modal.addEventListener('keydown', f=>{ if(f.key==='Tab' && isOpen()){ const focusable=[...modal.querySelectorAll('a[href],button,input,textarea,select,[tabindex]:not([tabindex="-1"])')].filter(el=>!el.hasAttribute('disabled')); if(!focusable.length) return; const first=focusable[0]; const last=focusable[focusable.length-1]; if(f.shiftKey && document.activeElement===first){ f.preventDefault(); last.focus(); } else if(!f.shiftKey && document.activeElement===last){ f.preventDefault(); first.focus(); } } }); } if(closeBtn) closeBtn.addEventListener('click', e=>{ e.preventDefault(); closeModal(); }); })(); </script>Modern enterprises must comply with multiple regulatory frameworks simultaneously. Geode provides the technical controls and capabilities needed to satisfy requirements across: <ul> <li>GDPR: European data protection and privacy regulation</li> <li>HIPAA: US healthcare data protection</li> <li>SOC2: Service organization security controls</li> <li>PCI DSS: Payment card industry data security</li> <li>ISO 27001: Information security management</li> <li>CCPA: California Consumer Privacy Act</li> <li>FedRAMP: US federal cloud security</li> </ul> <h3 id="gdpr-compliance" class="position-relative d-flex align-items-center group"> GDPR Compliance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="gdpr-compliance" aria-haspopup="dialog" aria-label="Share link: GDPR Compliance"> Share link </button> </h3>The General Data Protection Regulation (GDPR) imposes strict requirements on organizations that process personal data of EU residents. Geode provides technical capabilities to support GDPR compliance: <h4 id="right-to-access-article-15" class="position-relative d-flex align-items-center group"> Right to Access (Article 15) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="right-to-access-article-15" aria-haspopup="dialog" aria-label="Share link: Right to Access (Article 15)"> Share link </button> </h4>Data subjects have the right to obtain confirmation of whether their personal data is being processed. Geode supports this through comprehensive query capabilities: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Retrieve all personal data for a specific data subject MATCH (p:Person {email: $data_subject_email}) OPTIONAL MATCH (p)-[r]->(related) RETURN p, r, related; -- Find all locations where personal data appears MATCH (n) WHERE n.email = $data_subject_email OR n.ssn = $data_subject_ssn OR n.phone = $data_subject_phone RETURN labels(n), properties(n); </code></pre></div> <h4 id="right-to-erasure-article-17" class="position-relative d-flex align-items-center group"> Right to Erasure (Article 17) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="right-to-erasure-article-17" aria-haspopup="dialog" aria-label="Share link: Right to Erasure (Article 17)"> Share link </button> </h4>Data subjects can request deletion of their personal data. Geode supports complete and auditable deletion: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Delete all personal data for a data subject MATCH (p:Person {email: $data_subject_email}) DETACH DELETE p; -- Anonymize data while preserving graph structure MATCH (p:Person {email: $data_subject_email}) SET p.email = 'anonymized@deleted.local', p.name = 'Deleted User', p.ssn = NULL, p.phone = NULL, p.deleted_at = current_timestamp(); </code></pre></div>All deletion operations are logged in audit trails with: <ul> <li>Timestamp of deletion</li> <li>User who performed the deletion</li> <li>Data subject identifier</li> <li>Reason for deletion (if provided)</li> <li>Confirmation of cascading deletions</li> </ul> <h4 id="right-to-data-portability-article-20" class="position-relative d-flex align-items-center group"> Right to Data Portability (Article 20) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="right-to-data-portability-article-20" aria-haspopup="dialog" aria-label="Share link: Right to Data Portability (Article 20)"> Share link </button> </h4>Data subjects can receive their personal data in a structured, machine-readable format: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Export all personal data in structured format MATCH (p:Person {email: $data_subject_email}) OPTIONAL MATCH (p)-[r]->(related) RETURN { personal_info: properties(p), relationships: collect({ type: type(r), target: labels(related), properties: properties(r) }) } AS data_export; </code></pre></div> <h4 id="data-protection-by-design-article-25" class="position-relative d-flex align-items-center group"> Data Protection by Design (Article 25) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="data-protection-by-design-article-25" aria-haspopup="dialog" aria-label="Share link: Data Protection by Design (Article 25)"> Share link </button> </h4>Geode implements privacy-enhancing features by default: <ul> <li>Encryption at rest: All data encrypted using AES-256-GCM</li> <li>Encryption in transit: TLS 1.3 for all connections</li> <li>Pseudonymization: Support for hashed identifiers</li> <li>Data minimization: Field-level access control limits exposure</li> <li>Purpose limitation: Row-level security enforces usage boundaries</li> </ul> <h4 id="records-of-processing-activities-article-30" class="position-relative d-flex align-items-center group"> Records of Processing Activities (Article 30) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="records-of-processing-activities-article-30" aria-haspopup="dialog" aria-label="Share link: Records of Processing Activities (Article 30)"> Share link </button> </h4>Comprehensive audit logging documents all processing activities: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Configure GDPR-compliant audit logging geode serve --audit-log-level=compliance \ --audit-retention-days=2555 \ --audit-events=data_access,data_modification,data_deletion,data_export \ --audit-include-legal-basis=true </code></pre></div>Audit logs capture: <ul> <li>What personal data was accessed</li> <li>When it was accessed</li> <li>Who accessed it</li> <li>Purpose of access (via session metadata)</li> <li>Legal basis for processing</li> </ul> <h4 id="breach-notification-article-33" class="position-relative d-flex align-items-center group"> Breach Notification (Article 33) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="breach-notification-article-33" aria-haspopup="dialog" aria-label="Share link: Breach Notification (Article 33)"> Share link </button> </h4>Geode’s security monitoring helps detect and respond to data breaches: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Monitor for unusual access patterns jq 'select(.event_type == "authorization_failure")' audit.log \ | jq -s 'group_by(.user.ip_address) | map(select(length > 10))' # Identify mass data exports jq 'select(.operation.rows_returned > 1000 and .operation.type == "SELECT")' audit.log </code></pre></div> <h3 id="hipaa-compliance" class="position-relative d-flex align-items-center group"> HIPAA Compliance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="hipaa-compliance" aria-haspopup="dialog" aria-label="Share link: HIPAA Compliance"> Share link </button> </h3>The Health Insurance Portability and Accountability Act requires covered entities to protect health information. Geode provides technical safeguards for HIPAA compliance: <h4 id="administrative-safeguards" class="position-relative d-flex align-items-center group"> Administrative Safeguards <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="administrative-safeguards" aria-haspopup="dialog" aria-label="Share link: Administrative Safeguards"> Share link </button> </h4>164.308(a)(1)(ii)(D) - Information System Activity Review <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Enable comprehensive audit logging for HIPAA geode serve --audit-log-level=comprehensive \ --audit-phi-access=true \ --audit-retention-days=2555 \ --audit-log-encryption=aes-256-gcm </code></pre></div>164.308(a)(3) - Workforce Security Implement role-based access control: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create roles for different workforce members CREATE ROLE physician; CREATE ROLE nurse; CREATE ROLE billing_clerk; CREATE ROLE researcher; -- Grant minimum necessary permissions GRANT SELECT ON Patient TO physician; GRANT SELECT, INSERT, UPDATE ON MedicalRecord TO physician; GRANT SELECT ON Patient TO nurse WHERE assigned_nurse = current_user(); GRANT SELECT ON BillingInfo TO billing_clerk; </code></pre></div> <h4 id="physical-safeguards" class="position-relative d-flex align-items-center group"> Physical Safeguards <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="physical-safeguards" aria-haspopup="dialog" aria-label="Share link: Physical Safeguards"> Share link </button> </h4>164.310(d) - Device and Media Controls <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Secure backup with encryption geode backup create --encryption=aes-256-gcm \ --output=/secure/backup/location \ --verify-integrity=true # Secure disposal of old data geode data-purge --before-date=2019-01-01 \ --secure-delete=7-pass \ --audit-log=true </code></pre></div> <h4 id="technical-safeguards" class="position-relative d-flex align-items-center group"> Technical Safeguards <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="technical-safeguards" aria-haspopup="dialog" aria-label="Share link: Technical Safeguards"> Share link </button> </h4>164.312(a)(1) - Access Control Unique user identification and automatic logoff: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Configure session security geode serve --session-timeout=900 \ --require-unique-identifiers=true \ --automatic-logoff=true </code></pre></div>164.312(b) - Audit Controls <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Comprehensive audit controls geode serve --audit-events=all \ --audit-log-immutable=true \ --audit-log-integrity-check=hourly </code></pre></div>164.312(c) - Integrity Controls Cryptographic checksums for data integrity: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Enable integrity verification geode serve --data-integrity-checks=true \ --checksum-algorithm=sha256 \ --verify-on-read=true </code></pre></div>164.312(d) - Person or Entity Authentication Multi-factor authentication support: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Require MFA for PHI access geode serve --require-mfa=true \ --mfa-providers=totp,webauthn \ --mfa-grace-period=0 </code></pre></div>164.312(e) - Transmission Security TLS 1.3 encryption for all transmissions: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Enforce secure transmission geode serve --tls-min-version=1.3 \ --tls-cipher-suites=TLS_AES_256_GCM_SHA384 \ --require-client-certificates=true </code></pre></div> <h4 id="minimum-necessary-standard" class="position-relative d-flex align-items-center group"> Minimum Necessary Standard <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="minimum-necessary-standard" aria-haspopup="dialog" aria-label="Share link: Minimum Necessary Standard"> Share link </button> </h4>Implement minimum necessary access: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Row-level security for minimum necessary CREATE POLICY minimum_necessary_physicians ON Patient FOR SELECT TO physician USING (assigned_physician = current_user()); CREATE POLICY minimum_necessary_researchers ON Patient FOR SELECT TO researcher USING (patient_id IN (SELECT patient_id FROM research_cohort WHERE researcher = current_user())) WITH COLUMNS (age, diagnosis, treatment) -- Exclude name, SSN, address </code></pre></div> <h3 id="soc-2-compliance" class="position-relative d-flex align-items-center group"> SOC 2 Compliance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="soc-2-compliance" aria-haspopup="dialog" aria-label="Share link: SOC 2 Compliance"> Share link </button> </h3>Service Organization Control 2 focuses on security, availability, processing integrity, confidentiality, and privacy. Geode supports all five trust service criteria: <h4 id="security-common-criteria" class="position-relative d-flex align-items-center group"> Security (Common Criteria) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="security-common-criteria" aria-haspopup="dialog" aria-label="Share link: Security (Common Criteria)"> Share link </button> </h4>CC6.1 - Logical and Physical Access Controls <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Implement comprehensive access controls geode serve --rbac-enabled=true \ --require-authentication=true \ --password-policy=strict \ --session-security=high </code></pre></div>CC6.2 - Identification and Authentication <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Strong authentication requirements geode serve --password-min-length=14 \ --password-complexity=high \ --password-rotation-days=90 \ --lockout-threshold=5 \ --lockout-duration=30min </code></pre></div>CC6.6 - Logical and Physical Access Controls - Vulnerabilities Regular security updates and vulnerability management: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Check for security updates geode version --check-updates --security-only # Enable security monitoring geode serve --security-monitoring=enabled \ --vulnerability-scanning=continuous </code></pre></div>CC7.2 - System Monitoring - Detection of Security Events <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Real-time security monitoring geode serve --security-events=alert \ --alert-channels=email,pagerduty,slack \ --alert-threshold=medium </code></pre></div> <h4 id="availability" class="position-relative d-flex align-items-center group"> Availability <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="availability" aria-haspopup="dialog" aria-label="Share link: Availability"> Share link </button> </h4>A1.2 - Environmental Protections <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># High availability configuration geode serve --mode=cluster \ --replication-factor=3 \ --auto-failover=true \ --health-check-interval=10s </code></pre></div> <h4 id="processing-integrity" class="position-relative d-flex align-items-center group"> Processing Integrity <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="processing-integrity" aria-haspopup="dialog" aria-label="Share link: Processing Integrity"> Share link </button> </h4>PI1.5 - Data Validation <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Schema constraints ensure data integrity CREATE CONSTRAINT valid_ssn ON (p:Patient) ASSERT p.ssn MATCHES '^\d{3}-\d{2}-\d{4}$'; CREATE CONSTRAINT valid_email ON (u:User) ASSERT u.email MATCHES '^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'; </code></pre></div> <h4 id="confidentiality" class="position-relative d-flex align-items-center group"> Confidentiality <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="confidentiality" aria-haspopup="dialog" aria-label="Share link: Confidentiality"> Share link </button> </h4>C1.2 - Encryption of Confidential Information <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Comprehensive encryption geode serve --encryption-at-rest=aes-256-gcm \ --encryption-in-transit=tls-1.3 \ --key-rotation-days=90 \ --encryption-key-provider=hsm </code></pre></div> <h4 id="privacy" class="position-relative d-flex align-items-center group"> Privacy <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="privacy" aria-haspopup="dialog" aria-label="Share link: Privacy"> Share link </button> </h4>P4.2 - Obtaining Consent Track consent in the graph: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Model consent in the graph CREATE (p:Person {id: $person_id}) CREATE (c:Consent { purpose: 'marketing', granted_at: current_timestamp(), granted_by: $person_id, expires_at: timestamp() + duration('P1Y'), can_revoke: true }) CREATE (p)-[:GRANTED]->(c); -- Enforce consent in queries MATCH (p:Person {id: $person_id})-[:GRANTED]->(c:Consent) WHERE c.purpose = 'marketing' AND c.expires_at > current_timestamp() RETURN p; </code></pre></div> <h3 id="pci-dss-compliance" class="position-relative d-flex align-items-center group"> PCI DSS Compliance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="pci-dss-compliance" aria-haspopup="dialog" aria-label="Share link: PCI DSS Compliance"> Share link </button> </h3>For organizations handling payment card data, Geode supports PCI DSS requirements: <h4 id="requirement-2-strong-cryptography" class="position-relative d-flex align-items-center group"> Requirement 2: Strong Cryptography <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="requirement-2-strong-cryptography" aria-haspopup="dialog" aria-label="Share link: Requirement 2: Strong Cryptography"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># PCI DSS compliant encryption geode serve --encryption-algorithm=aes-256-gcm \ --key-length=256 \ --tls-version=1.3 </code></pre></div> <h4 id="requirement-8-strong-access-control" class="position-relative d-flex align-items-center group"> Requirement 8: Strong Access Control <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="requirement-8-strong-access-control" aria-haspopup="dialog" aria-label="Share link: Requirement 8: Strong Access Control"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># PCI DSS access controls geode serve --password-min-length=15 \ --password-complexity=strict \ --mfa-required=true \ --session-timeout=900 </code></pre></div> <h4 id="requirement-10-audit-logging" class="position-relative d-flex align-items-center group"> Requirement 10: Audit Logging <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="requirement-10-audit-logging" aria-haspopup="dialog" aria-label="Share link: Requirement 10: Audit Logging"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># PCI DSS audit requirements geode serve --audit-log-level=comprehensive \ --audit-log-tamper-proof=true \ --audit-retention-days=365 \ --audit-review-frequency=daily </code></pre></div> <h4 id="data-masking-for-pci" class="position-relative d-flex align-items-center group"> Data Masking for PCI <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="data-masking-for-pci" aria-haspopup="dialog" aria-label="Share link: Data Masking for PCI"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Mask credit card numbers in logs and queries MATCH (txn:Transaction) RETURN txn.id, substring(txn.card_number, 0, 4) + '********' + substring(txn.card_number, -4, 4) AS masked_card, txn.amount; </code></pre></div> <h3 id="compliance-monitoring" class="position-relative d-flex align-items-center group"> Compliance Monitoring <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="compliance-monitoring" aria-haspopup="dialog" aria-label="Share link: Compliance Monitoring"> Share link </button> </h3> <h4 id="automated-compliance-checks" class="position-relative d-flex align-items-center group"> Automated Compliance Checks <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="automated-compliance-checks" aria-haspopup="dialog" aria-label="Share link: Automated Compliance Checks"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Run compliance validation geode compliance-check --framework=gdpr,hipaa,soc2 \ --report-format=json \ --output=compliance-report.json # Example output: # { # "framework": "GDPR", # "status": "compliant", # "checks": { # "encryption_at_rest": "pass", # "encryption_in_transit": "pass", # "audit_logging": "pass", # "data_retention": "pass", # "access_controls": "pass" # }, # "recommendations": [] # } </code></pre></div> <h4 id="compliance-reporting" class="position-relative d-flex align-items-center group"> Compliance Reporting <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="compliance-reporting" aria-haspopup="dialog" aria-label="Share link: Compliance Reporting"> Share link </button> </h4>Generate compliance reports for auditors: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Generate SOC 2 compliance report geode compliance-report --framework=soc2 \ --start-date=2025-01-01 \ --end-date=2025-12-31 \ --include-evidence=true \ --output=soc2-report-2025.pdf # Generate GDPR data processing report geode compliance-report --framework=gdpr \ --report-type=processing-activities \ --include-legal-basis=true \ --output=gdpr-article-30-report.pdf </code></pre></div> <h3 id="best-practices" class="position-relative d-flex align-items-center group"> Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="best-practices" aria-haspopup="dialog" aria-label="Share link: Best Practices"> Share link </button> </h3><ol> <li>Defense in Depth: Implement multiple layers of security controls</li> <li>Regular Audits: Conduct periodic compliance audits and gap assessments</li> <li>Documentation: Maintain detailed documentation of security controls and processes</li> <li>Training: Ensure all users understand their compliance responsibilities</li> <li>Monitoring: Implement continuous compliance monitoring and alerting</li> <li>Incident Response: Develop and test incident response procedures</li> <li>Third-Party Risk: Assess compliance of all third-party integrations</li> <li>Data Lifecycle: Implement compliant data retention and deletion policies</li> <li>Encryption Everywhere: Encrypt data at rest, in transit, and in use</li> <li>Principle of Least Privilege: Grant minimum necessary access</li> </ol> <h3 id="compliance-certifications" class="position-relative d-flex align-items-center group"> Compliance Certifications <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="compliance-certifications" aria-haspopup="dialog" aria-label="Share link: Compliance Certifications"> Share link </button> </h3>Geode undergoes regular third-party audits and maintains certifications: <ul> <li>SOC 2 Type II: Annual audit by independent CPA firms</li> <li>ISO 27001: Information security management certification</li> <li>FedRAMP: Authorized for US federal government use</li> <li>HIPAA: Business Associate Agreement available</li> <li>GDPR: Data Processing Agreement available</li> </ul> Contact <a href="mailto:[email protected]" >[email protected]</a> for certification documentation. <h3 id="related-topics" class="position-relative d-flex align-items-center group"> Related Topics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="related-topics" aria-haspopup="dialog" aria-label="Share link: Related Topics"> Share link </button> </h3><ul> <li><a href="/tags/audit-logging/" >Audit Logging</a> - Comprehensive audit logging and compliance tracking</li> <li><a href="/tags/row-level-security/" >Row-Level Security</a> - Fine-grained access control</li> <li><a href="/tags/encryption/" >Encryption</a> - Data encryption at rest and in transit</li> <li><a href="/tags/governance/" >Governance</a> - Data governance policies and enforcement</li> <li><a href="/tags/configuration/" >Configuration</a> - Security configuration best practices</li> <li><a href="/docs/security/overview/" >Security Overview</a> - Security documentation</li> </ul>

Popular

Related Articles

Security and Compliance Guide

GQL Conformance Profile

Fraud Detection Guide

Security

Audit Logging and Compliance

Governance and Requirements Tracking