Compliance
Someone has to answer for it.
An agent can write a working application. It cannot sign a business associate agreement, choose where data lives, defend an access log to a reviewer, or be the party that answers when a regulator asks who approved the data model. That part has not been automated and is not close to being.
Regimes
What we build to.
Named only where a system has actually been built and shipped under the obligation.
- HIPAA
- Protected health information handled under the safeguards the rule requires, with the business associate relationship understood before the first record is stored. Built and shipped for clinical documentation and telemedicine already in use.
- GDPR and UK GDPR
- Lawful basis, consent capture, subject access, erasure and retention treated as data model decisions rather than policy documents written afterwards.
- Payment card scope
- Card data kept out of the system entirely by routing through hosted gateway flows, so the assessment surface stays as small as it can be. We do not store card numbers.
Controls
Implemented by default.
Not a hardening pass scheduled for later. These are structural decisions taken while the data model is still cheap to change.
- Audit trails covering who changed what, when, and from where
- Role-based access with an explicit authorisation matrix, not implicit checks
- Retention and deletion schedules enforced by the system, not by habit
- Consent capture and withdrawal recorded against the record it governs
- Data residency decided deliberately and documented
- Encryption in transit and at rest, with key handling stated
- Access logging on personal and financial data, retained and reviewable
- Least-privilege service accounts and scoped third-party credentials
Evidence
What gets handed over.
A security reviewer asks for the same things every time. They exist before the question is asked, and they are kept current as the system changes.
- 01 A data flow map showing every place personal data enters, rests and leaves
- 02 The authorisation matrix: every role against every action
- 03 The retention schedule, and where it is enforced in code
- 04 Access log design, including what is captured and for how long
- 05 A third-party processor list with what each one receives
- 06 Written answers to a standard vendor security questionnaire
The boundary
What stays with you.
Stated plainly, because a supplier claiming to own all of it has never been through an audit.
- The attestation or certification itself, which belongs to your organisation
- Organisational policy, staff training and access approvals
- Agreements with vendors other than us
- Incident response ownership, once the process is in place
- The lawful basis decision, which is a business decision before it is a technical one
Clarobix is not a certifying body and does not issue attestations. What we do is build the system that meets the requirement, produce the evidence a reviewer asks for, and keep both current as the system changes.
Applied here too: an enquiry sent through this site is stored so it cannot be lost in transit, and deleted automatically after 24 months. That figure is read from the setting the scheduled deletion runs on, not written separately into this sentence.
Facing a review, or overdue one?
A compliance readiness assessment is fixed in scope and delivered in writing. You are told what exists, what is missing, and what a reviewer will ask for first.