Compliance
Supported Frameworks
EchelonGraph continuously evaluates your infrastructure against 300+ compliance frameworks with thousands of automated controls:
| Framework | Category | Key Focus |
|---|---|---|
| SOC 2 Type II | Trust Services | Security, availability, processing integrity, confidentiality, privacy |
| GDPR | Privacy | Data protection, consent, data subject rights, breach notification |
| ISO 27001:2022 | International | Information security management system (ISMS) — Annex A controls |
| NIST CSF 2.0 | Federal | Govern, Identify, Protect, Detect, Respond, Recover |
| PCI DSS 4.0 | Payment | Cardholder data protection, network segmentation |
| HIPAA | Healthcare | Protected health information (ePHI) — Security Rule safeguards |
| DPDP Act (India) | Privacy | Digital personal data protection |
| ISMS-P (Korea) | Regional | Information security management + privacy certification |
| CIS AWS Foundations v3.0.0 | Cloud Benchmark | IAM, CloudTrail, KMS, networking, S3, RDS hardening |
| CIS GCP Foundations v2.0.0 | Cloud Benchmark | IAM, audit logs, VPC, GCS, Cloud SQL, GKE hardening |
| CIS Kubernetes v1.9 | K8s Benchmark | Section 5 policies — RBAC, Pod Security, NetworkPolicy |
| Pod Security Standards | Kubernetes | Privileged / Baseline / Restricted policy tiers |
| NIST AI RMF 1.0 | AI Governance | Govern, Map, Measure, Manage of AI risk |
| EU AI Act | AI Governance | High-risk AI obligations — Articles 9-17, transparency, post-market |
| ISO/IEC 42001:2023 | AI Governance | AI management system (AIMS) |
| MITRE ATLAS | AI Security | Adversarial threat landscape for AI systems |
| OWASP Top 10 for LLM Applications | AI Security | Security risks unique to LLM-based systems |
How Scoring Works
1. Discovery
Scanners inventory your entire cloud infrastructure — compute, network, storage, identity, databases, and certificates — using read-only API access.
2. Control Mapping
The compliance engine maps each framework's controls to specific infrastructure checks. For example, encryption-in-transit controls map to TLS on load balancers, HTTPS-only storage policies, and encrypted database connections.
3. Evaluation
Each control is evaluated as:
- Pass: All associated checks pass
- Fail: One or more critical checks fail
- Partial: Some checks pass, non-critical checks fail
- N/A: Control is not applicable to your infrastructure
4. Trending
Historical scores enable 30/60/90-day trend analysis, compliance drift detection, and audit-ready reporting.
Continuous Monitoring
The compliance engine re-evaluates all controls for every tenant on a 5-minute cron over the assets already in your inventory, and every asset upsert fires a signed notify webhook that re-scores the affected controls inside a 30-second SLA (measured at about 11 seconds on our own estate, 2026-08-07). New and changed cloud assets reach that inventory on the posture sweep — daily on Free, Starter and Team, hourly on Pro and Enterprise, where continuous scanning is enabled — pulled forward on any plan by the change watcher when it sees something move.
When a compliance score changes:
- Dashboard: the new score, its evidence and the named resource are current on your next page load — never further behind your cloud than your plan's sweep cadence (a day on Free, Starter and Team; an hour on Pro and Enterprise), and usually sooner, because the change watcher pulls the sweep forward
- Findings feed: a control that flips to fail is raised as a finding with the offending resource named, and auto-closes on the sweep after you fix it
- Audit log: every score change is recorded with timestamp and cause
Not yet shipped: push alerting on a compliance-score *drop*. There is no producer that emails or webhooks you the moment a control flips — that path exists today only for CVE matches against your inventory. If you need to be paged on compliance drift, poll the score API or the findings feed; do not assume a notification will arrive.
Evidence Collection
EchelonGraph automates evidence collection for audit preparation, generating the documentation your auditors need:
- Security scan results: Automated scanning results captured per deployment
- Audit log exports: On-demand export of all security events
- System health reports: Continuous monitoring data for availability evidence
- Compliance score history: Stored automatically for historical trend analysis
SOC 2 Type II Readiness
EchelonGraph addresses all five Trust Services Criteria:
| Criteria | What EchelonGraph Provides |
|---|---|
| Security | Role-based access control, MFA, encrypted tokens, field-level encryption |
| Availability | Auto-scaling infrastructure, health monitoring, automated recovery |
| Processing Integrity | Input validation, tenant isolation, immutable audit trail |
| Confidentiality | AES-256 encryption at rest, TLS in transit, secrets management |
| Privacy | Data minimization, configurable retention, GDPR compliance |
GDPR Compliance
Data Subject Rights
EchelonGraph supports all GDPR data subject rights:
| Right | Article | How It Works |
|---|---|---|
| Access | Art. 15 | Users can view their profile and activity history |
| Rectification | Art. 16 | Users and admins can update profile information |
| Erasure | Art. 17 | Admins can delete users; full tenant deletion available on request |
| Restrict Processing | Art. 18 | Tenant scanning can be paused while preserving data |
| Data Portability | Art. 20 | Export compliance reports and data in JSON or CSV |
| Object | Art. 21 | Users can unsubscribe from communications |
Privacy by Design
- Data minimization: We only collect data necessary for cloud security analysis
- Purpose limitation: Data is used solely for security posture management
- Configurable retention: Set your own retention periods with automated data purge
- Pseudonymization: Security scan data is decoupled from personal identifiers
Report Generation
Generate audit-ready compliance reports in CSV or JSON:
- Executive summary: Overall posture score and trend
- Per-control evidence: Pass/fail status with supporting data for each control
- Remediation guidance: Prioritized action items for failing controls
- Historical comparison: Score changes over the reporting period
Available report types: executive, compliance, scan, alert, and asset inventory.