Compliance Frameworks
DevDiff helps organizations enforce security, privacy, and sovereignty policies across enterprise teams through declarative compliance profiles.
🔒 Supported Frameworks
Use the compliance engine to immediately audit and enforce policies for the following regulatory frameworks:
| Framework ID | Regulation / Standard | Target Jurisdiction | Enforced Policies & Config Changes |
|---|---|---|---|
| gdpr | General Data Protection Regulation | European Union / EEA | Forces local-only AI execution (localOnly: true), disables outbound network telemetries, sets strict token sanitization. |
| ccpa | California Consumer Privacy Act | United States (CA) | Zero-telemetry caching, local audit trail logging, and automatic workspace data-minimization. |
| hipaa | Health Insurance Portability & Accountability Act | United States (Healthcare) | Enforces strict secret and credential redaction, locks audit logs locally with AES encryption. |
| soc2 | SOC 2 Type II Security Trust | Global (Service Orgs) | Enables full network access logging, file access history trails, and third-party plugin checksum checks. |
| fedramp | FedRAMP Security Standards | United States (Gov/Cloud) | Forces FIPS-compliant local cryptos, locks out non-whitelisted shell execution commands, and restricts network scopes. |
| iso27001 | ISO/IEC 27001 Information Security | Global (Enterprise) | Configures log retention controls, locks file scanning scopes, and enables periodic config auditing. |
| pipeda | Personal Information Protection Act | Canada | Strict data minimization, local data sovereign hosting, and no external log transfers. |
| lgpd | Lei Geral de Proteção de Dados | Brazil | Local AI fallback priority, zero third-party token transit caching. |
| pdpa | Personal Data Protection Act | Singapore / APAC | Data minimization, local-only routing for PII structures, zero trace retention. |
| australia_privacy | Australian Privacy Principles (APP) | Australia | Enforces strict regional data sovereign boundaries, disabling cloud model fallbacks. |
Enforcing a Framework Configuration
To apply a compliance profile:
bash
# Preview what changes the framework will make to .devdiff.config.js
devdiff compliance apply --framework gdpr --dry-run
# Apply the framework configuration to your project config
devdiff compliance apply --framework gdprThis command updates your root .devdiff.config.js to enforce the corresponding security, privacy, and routing boundaries automatically.
Validating Compliance Status
Check if your current workspace configuration complies with active profiles:
bash
# Check compliance status
devdiff compliance status
# Run full configuration validation
devdiff compliance validate --frameworks all