A compliance primitive is a runnable control — not a paragraph in a policy. Assemble them into any of the 64 supported frameworks, or your own. Every primitive ships implemented, with continuous control checks.
Keeps records for a mandated min/max period, then queues disposal.
Implemented · continuous control check
Irreversibly destroys or de-identifies data, with proof.
Implemented · continuous control check
Assigns sensitivity labels that drive all downstream primitive parameters.
Implemented · continuous control check
Restricts collection to what is necessary for a stated purpose.
Implemented · continuous control check
Constrains storage/processing location and cross-border transfer.
Implemented · continuous control check
Machine-readable export of a subject’s data.
Implemented · continuous control check
Deletes on verified request, cascading to processors.
Implemented · continuous control check
Recoverable copies plus restorability validation.
Implemented · continuous control check
Verifies identity before any access.
Implemented · continuous control check
Grants only permitted actions per role or attribute.
Implemented · continuous control check
Keeps every grant at the minimum needed.
Implemented · continuous control check
No single person controls an entire critical process.
Implemented · continuous control check
Periodically re-approves every access grant.
Implemented · continuous control check
No shared accounts — every action is attributable.
Implemented · continuous control check
Lifetime, timeout and re-authentication rules.
Implemented · continuous control check
Immutable, attributable who/what/when/why without obscuring prior values.
Implemented · continuous control check
Keeps audit logs for the mandated period.
Implemented · continuous control check
Scheduled human or automated review of logs.
Implemented · continuous control check
Time synchronization every record can rely on.
Implemented · continuous control check
Tracks possession and handling of evidence end-to-end.
Implemented · continuous control check
Attributable, legible, contemporaneous, original, accurate records.
Implemented · continuous control check
Binds an authenticated identity to a record with legal meaning.
Implemented · continuous control check
Draft → review → approve → effective → retire workflow.
Implemented · continuous control check
Every change creates a new, comparable version.
Implemented · continuous control check
Read-and-understood / certification capture.
Implemented · continuous control check
Collect → store → withdraw → renew consent.
Implemented · continuous control check
Serves the right notice at the right moment.
Implemented · continuous control check
Data is used only for its declared purpose.
Implemented · continuous control check
Honors channel and processing preferences.
Implemented · continuous control check
Deadline clock plus required content per regulation.
Implemented · continuous control check
Produces and tracks mandated filings.
Implemented · continuous control check
Protected internal reporting route.
Implemented · continuous control check
Identify → score → treat risks on a cadence.
Implemented · continuous control check
Assesses processing before it starts.
Implemented · continuous control check
Extends the controls to processors and suppliers.
Implemented · continuous control check
Recurs any obligation on a schedule.
Implemented · continuous control check
Right course to the right role at the right time.
Implemented · continuous control check
Evidence of completion, retained.
Implemented · continuous control check
Demonstrated capability, signed off.
Implemented · continuous control check
Stored data is unreadable without keys.
Implemented · continuous control check
Data in motion is protected end-to-end.
Implemented · continuous control check
Generate → rotate → destroy keys, on policy.
Implemented · continuous control check
Pseudonymizes data for safe secondary use.
Implemented · continuous control check
Every change is proposed, approved, and traceable.
Implemented · continuous control check
Known-good baselines, detected drift.
Implemented · continuous control check
Find, rank and remediate weaknesses.
Implemented · continuous control check
Timely, verified patching.
Implemented · continuous control check
Controls checked as they run, not annually.
Implemented · continuous control check
Detects unauthorized modification.
Implemented · continuous control check
Every asset known, owned and tracked.
Implemented · continuous control check
Temperature/humidity with excursion handling.
Implemented · continuous control check
Instruments proven accurate, on schedule.
Implemented · continuous control check
Physical activity, recorded.
Implemented · continuous control check
With segregation of duties and e-signature built in.
Implemented · continuous control check
Investigation → root cause → action → effectiveness check.
Implemented · continuous control check
Captures, evaluates and closes deviations.
Implemented · continuous control check
Unanswered obligations climb the ladder automatically.
Implemented · continuous control check
Documented evidence the system does what it claims.
Implemented · continuous control check
The shared engines the 58 primitives are built on — so a fix or an improvement lands everywhere at once.
The shared clock behind every retention and disposal rule.
One label change re-tunes every dependent control.
Deadlines with escalation, reused by every notification rule.
The approval engine every workflow primitive builds on.
The risk loop shared by every assessment primitive.
The immutable ledger behind every audit trail.