What's the compliance story for AI memory?
SOC 2, ISO 27001, GDPR, HIPAA-ready depending on deployment. bRRAIn's encryption, audit, role hierarchy, and right-to-erasure make compliance a configuration question, not a rewrite.
Compliance as configuration
Most AI platforms treat compliance as a sales-cycle afterthought — retrofitting audit logs, encryption, and access controls onto an architecture that was not designed for them. bRRAIn inverts this. The Security Policy Engine, Vault, and Control Plane are the compliance substrate; SOC 2, ISO 27001, GDPR, and HIPAA posture are configurations on top of them. The Security overview documents the full control mapping. Compliance becomes a switch-flip exercise rather than an engineering rewrite, which is what makes the platform approvable for regulated-industry deployments.
SOC 2 and ISO 27001 out of the box
SOC 2 Type II and ISO 27001 both center on encryption, access control, audit logging, and change management — all of which bRRAIn implements natively. Encryption at rest and in transit come from the Vault envelope design. Access control comes from the Control Plane 7-tier role model. Audit logging comes from the Security Policy Engine. Change management comes from versioned policy-as-code. A Managed Install deployment ships with the controls mapped to SOC 2 Trust Services Criteria and ISO 27001 Annex A controls, making the audit package a review rather than a build.
GDPR: right-to-erasure and data minimization
GDPR adds two requirements beyond general security: right-to-erasure and data minimization. bRRAIn's Vault supports per-item redaction with cryptographic guarantees — a redacted item is purged from storage and from derived memory, and the Consolidator propagates the removal across downstream references. Data minimization is enforced at ingestion via Control Plane rules that specify which fields enter the graph. EU deployments also support regional hosting so personal data stays within EU infrastructure. GDPR becomes a configuration of existing primitives.
HIPAA-ready with BAA
HIPAA compliance requires a Business Associate Agreement, full audit trails, encryption, and access controls that specifically track PHI handling. bRRAIn's Managed Install tier supports a BAA and ships with HIPAA-aligned configuration profiles — PHI is tagged at ingestion, scoped to healthcare workspaces, and tracked through every query in the Security Policy Engine logs. The MCP Gateway restricts outbound tool calls to BAA-covered destinations. Healthcare customers can deploy a HIPAA-covered workload without custom engineering; the controls are built-in.
Compliance evolves with your business
Compliance is not a one-time event — new regulations ship every year, and bRRAIn is designed to accommodate them through policy updates rather than platform rewrites. The Security Policy Engine is versioned and diffable, so when a new rule lands (PCI DSS 4.0, EU AI Act, state-level privacy laws), it becomes a new policy bundle. A certified Security Controller manages the lifecycle. The posture stays current as the regulatory landscape moves, which is often the hardest part of compliance at scale.
Relevant bRRAIn products and services
- Security overview — full mapping of controls to SOC 2, ISO 27001, GDPR, and HIPAA requirements.
- Security Policy Engine — audit logging and policy enforcement that powers every compliance framework.
- bRRAIn Vault — envelope encryption and per-item redaction for GDPR and HIPAA primitives.
- Control Plane — 7-tier role model that satisfies access-control requirements across frameworks.
- Managed Install — deployment tier that ships with BAA support and pre-configured compliance profiles.
- Security Controller certification — trains the operator who owns the evolving compliance lifecycle.