---
title: "Compliance mapping"
description: "GDPR, HIPAA, CCPA, GLBA, PCI DSS and FOIA, mapped requirement by requirement to what the product does and where that is written down."
canonical: https://keepitlocal.app/compliance
last-updated: 2026-09-13
---

# Compliance mapping

GDPR, HIPAA, CCPA, GLBA, PCI DSS and FOIA, mapped requirement by requirement to what the product does and where that is written down.

Engineering controls, not a certification. Nothing here has been reviewed by a lawyer or audited by a third party.

GDPR:
- Art. 5(1)(c), data minimisation: Document content never reaches the server. Per export it receives two checksums and a few counts, and the content security policy is what enforces that.
- Art. 5(1)(e), storage limitation: A retention period per data category, applied by a purge that records every run. Until a scheduler is provisioned the sweep is triggered by hand.
- Art. 13 and 14, transparency: The privacy notice lists every category held, why it is held, on what lawful basis and for how long.
- Art. 15 and 20, access and portability: Settings produces a zip of the account record the server holds: profile, sessions, memberships, certificates, published reports and the audit rows where the account is the actor.
- Art. 16, rectification: Name and avatar can be changed in Settings. Changing the account email is by request today.
- Art. 17, erasure: Self-service account deletion with re-authentication, and the exceptions for issued certificates are written down.
- Art. 28, processors: A published data processing agreement and a sub-processor list naming each recipient, its region and its transfer mechanism.
- Art. 32, security of processing: The technical and organisational measures in Annex II of the agreement.
- Art. 33, breach notification: A documented runbook with a 72 hour clock, summarised on the trust page.
- Art. 44 to 49, international transfers: The hosting region is the European Union, provider still to be confirmed. Transfers outside the EEA are made under the standard contractual clauses.

HIPAA Security Rule:
- Scope: The server holds no protected health information. The one place it touches PHI is the certificate, which records the checksum of the original file.
- 164.312(a)(1), access control: One account per person, no shared logins, role-based access and a guard at the top of every protected page and server action.
- 164.312(a)(2)(iii), automatic logoff: Idle and absolute session caps enforced on the server. A shorter, configurable idle window for regulated workspaces is open.
- 164.312(b), audit controls: Broad write coverage including failures, in a hash-chained trail. Logging of operator reads is still open.
- 164.312(c)(1), integrity: Certificates are signed and re-verified on read, and the audit trail carries a hash chain that shows whether a row was deleted, reordered or rewritten.
- 164.312(d), authentication: Argon2id, TOTP with a replay guard and backup codes, and an operator second factor the console's own toggles cannot switch off.
- 164.312(e)(1), transmission security: TLS with HSTS, a production boot check that refuses a non-https origin, and violation reporting on the policy that keeps documents in the tab.

CCPA and CPRA:
- 1798.100, notice at collection: The privacy notice lists every category collected and the purpose for each, before the account is created.
- 1798.105, right to delete: Self-service account and workspace deletion, with the retained categories and the reason for each written down.
- 1798.110 and 1798.115, right to know: The same Settings download answers it: a zip of the account record the server holds.
- 1798.120, opt out of sale or sharing: There is nothing to opt out of. We count visits on our own server in a form that identifies nobody, with no cookie; no advertising, no tracking pixels and no third-party scripts, and the sub-processor list names every recipient.
- 1798.140(ag), service provider terms: The data processing agreement binds processing to your documented instructions and forbids any other purpose.
- 1798.81.5, reasonable security: The measures in Annex II of the agreement, and the controls described on the trust page.

GLBA Safeguards Rule:
- 314.4(c)(1), access controls: Unique accounts, role-based access, per-page guards, and every query scoped by workspace.
- 314.4(c)(2), inventory of customer information: The privacy notice is that inventory: one row per category, with what it contains and how long it is kept.
- 314.4(c)(3), encryption in transit and at rest: TLS with HSTS in transit, and application-level encryption of the sensitive fields at rest. Disk-level encryption waits on the hosting decision.
- 314.4(c)(5), multi-factor authentication: TOTP with a replay guard and single-use backup codes, required for operator accounts.
- 314.4(c)(6), disposal of customer information: A retention period per category and a purge that applies it, plus account and workspace erasure on request.
- 314.4(f), oversight of service providers: Every sub-processor is named with its purpose, region and transfer mechanism, and the agreement covers the flow-down terms.
- 314.4(h), incident response plan: A documented runbook with a 72 hour clock and a defined severity ladder.

PCI DSS:
- 3.2.1, do not store what you do not need: No document content, no detector output and no file names reach the server, so no cardholder data can be stored in it.
- 3.3, mask the account number when displayed: A card number is found by its Luhn check and shown masked in the review panel; the value itself stays in the tab.
- 3.5, render the account number unreadable: A redacted PDF is written as a fresh raster with no text layer, so the number is gone from the file rather than covered on the page.
- 4.2, protect the account number in transit: The document is never transmitted. The policy that stops it is the one directive a reviewer can check in the response headers.
- 10.2, log access to system components: A hash-chained audit trail over account activity, including failures. It covers account actions, not document contents, which never leave the browser.
- 12.10, incident response: A documented runbook with a 72 hour clock.

FOIA:
- 552(b), exemptions applied to a release: Each mark can carry an exemption code, and the code is printed on the box in the exported file.
- 552(b)(6) and (b)(7)(C), personal privacy: Names, identifiers, contact details, dates and addresses are found by the detectors; you decide each one.
- 552(b), reasonably segregable material: A mark covers the matched value, not the paragraph around it, so what is releasable stays readable.
- 552(a)(8), records of the release: Every export can carry a certificate that a requester can check without an account, and a report saying what was taken out.
- Release integrity: The exported file is read back and checked before it is handed over, and the certificate records that the check ran.
- Consistency across a caseload: A workspace template fixes which kinds are accepted and which exemption label is stamped, so the next request is handled the same way.