Global Privacy & Regulatory Compliance
EDDI provides built-in compliance for GDPR, CCPA, EU AI Act, HIPAA, PIPEDA, LGPD, APPI, POPIA, PDPA, Malaysia PDPA, PIPL, and more β with cascade data erasure, cryptographic audit trails, and one unified API.
Compliance by Architecture
Regulated industries cannot bolt compliance onto AI systems after the fact. EDDI embeds the technical foundations for global regulatory compliance into the platform architecture itself β immutable audit trails, cascade data erasure, processing restrictions, cryptographic integrity, and role-based access control are core capabilities, not add-ons. One unified API covers data subject rights for every jurisdiction.
AI Governance Frameworks
As governments worldwide introduce AI-specific legislation, organizations need platforms that provide transparency, traceability, and human oversight from day one. EDDI's architecture addresses the core technical requirements of major AI governance frameworks.
EU AI Act β European Union
The EU AI Act (Regulation 2024/1689) is the world's first comprehensive AI law, establishing risk-based requirements for AI systems. EDDI provides the technical foundations for compliance with its high-risk AI system requirements:
- Immutable Audit Trails β Every operation recorded with HMAC-SHA256 cryptographic integrity (Art. 12 β Record-Keeping)
- Decision Transparency β Full pipeline tracing shows how AI decisions were made, including model name, prompt, and response (Art. 13 β Transparency)
- Human Oversight β Management UI enables human review, intervention, and emergency stop (Art. 14 β Human Oversight)
- Risk Classification β Architecture supports high-risk AI system requirements with configurable controls (Art. 9 β Risk Management)
- Reproducibility β Configuration-as-code enables exact reproduction of AI behavior for regulatory audits (Art. 17 β Quality Management)
- Data Governance β OIDC/Keycloak RBAC, vault-based secret management, input/output logging (Art. 10 β Data Governance)
NIST AI Risk Management Framework β United States
The NIST AI RMF (AI 100-1) provides a voluntary framework for managing AI risks across four functions: Govern, Map, Measure, and Manage. EDDI's architecture provides technical capabilities that support organizations pursuing NIST AI RMF alignment:
- Govern β RBAC roles (eddi-admin, eddi-editor, eddi-viewer), immutable audit ledger, and documented data flows support AI governance structures
- Map β Pipeline tracing and conversation logging enable comprehensive AI risk identification and documentation
- Measure β Prometheus metrics, token/cost tracking, and per-agent usage analytics provide measurable AI performance and risk indicators
- Manage β Processing restriction API, human oversight via Manager UI, and configurable retention policies enable risk mitigation controls
ISO/IEC 42001 β AI Management Systems
ISO/IEC 42001:2023 establishes requirements for an AI Management System (AIMS). EDDI provides technical capabilities that support organizations pursuing ISO 42001 certification:
- Documented AI Policies β Configuration-as-code means all agent behavior is defined in auditable JSON β rules, workflows, LLM configurations, and deployment descriptors
- Risk Assessment β Audit trails capture complete decision histories for risk evaluation and impact assessments
- Operational Controls β RBAC, vault-based secret management, and processing restrictions provide operational governance
- Performance Monitoring β Prometheus metrics, Grafana dashboards, and CQRS telemetry enable continuous AI performance evaluation
Data Privacy Regulations
EDDI provides unified data subject rights endpoints that satisfy the technical requirements of every major privacy regulation worldwide. One API covers cascade erasure, full data export, and processing restriction β regardless of jurisdiction.
GDPR β European Union / EEA
The General Data Protection Regulation (EU 2016/679) is the gold standard for data privacy. EDDI implements GDPR data subject rights as first-class API endpoints backed by cascade operations across all 5 data stores:
- Right to Erasure (Art. 17) β
DELETE /admin/gdpr/{userId}cascades across user memories, conversations, managed conversation mappings, database logs (SHA-256 pseudonymized), and audit ledger (SHA-256 pseudonymized) - Right of Access / Portability (Art. 15/20) β
GET /admin/gdpr/{userId}/exportreturns all user data as structured, machine-readable JSON - Right to Restriction (Art. 18) β
POST /admin/gdpr/{userId}/restrictfreezes processing while preserving data, blocking new conversations and message processing - PII-Safe Logging β GDPR operations log SHA-256 pseudonyms, never raw user IDs
- Configurable Retention β Per-category retention policies for conversations (365 days default), user memories (manual), and audit entries (indefinite for EU AI Act)
- MCP Tools β
delete_user_dataandexport_user_dataenable AI-orchestrated compliance workflows
CCPA / CPRA β California, United States
The California Consumer Privacy Act and California Privacy Rights Act grant consumers rights to know, delete, and opt out of data sales. EDDI satisfies CCPA's technical requirements through its GDPR-compatible API:
- Right to Know (Β§1798.100) β The GDPR export endpoint provides all personal information in a structured, machine-readable format
- Right to Delete (Β§1798.105) β The GDPR erasure endpoint provides cascade deletion across all data stores
- Do Not Sell (Β§1798.120) β EDDI architecturally cannot sell personal information β it is middleware infrastructure that processes data exclusively on behalf of the deployer
PIPEDA β Canada
Canada's Personal Information Protection and Electronic Documents Act (2000, amended 2023) governs commercial data processing through 10 Fair Information Principles. EDDI's architecture maps directly to each principle:
- Accountability β Immutable HMAC-signed audit ledger traces all operations
- Limiting Collection β Token-aware windowing limits data sent to LLMs; configurable retention auto-deletes old conversations
- Limiting Use/Disclosure β Data used only for configured agent interactions; audit trail logs every LLM invocation
- Safeguards β AES-256-GCM envelope encryption (Secrets Vault), HMAC-SHA256 audit integrity, Keycloak OIDC, RBAC
- Individual Access β Full data export via REST API returns all memories, conversations, and managed conversation mappings as JSON
- Challenging Compliance β Cascade deletion across all 5 data stores; audit trail pseudonymized (not deleted) for legal retention obligations
LGPD β Brazil
Brazil's Lei Geral de Proteção de Dados (2018, effective 2020) grants extensive data subject rights closely mirroring GDPR. EDDI covers all Article 18 rights with built-in technical capabilities:
- Access to Data (Art. 18, II) β Full JSON data export
- Correction (Art. 18, III) β User memories updatable via
PUT /usermemorystore/memories - Anonymization/Deletion (Art. 18, IV) β Cascade deletion with SHA-256 pseudonymization of audit records
- Data Portability (Art. 18, V) β Machine-readable JSON export includes all user data
- Deletion of Unnecessary Data (Art. 18, VI) β Configurable retention policies with automatic cleanup
- Consent Revocation (Art. 18, IX) β End conversation and cascade delete endpoints provide the technical mechanism
APPI β Japan
Japan's Act on the Protection of Personal Information (2003, significantly amended 2022) is one of Asia's most mature data protection laws. Japan holds an EU adequacy decision, facilitating cross-border data flows. EDDI provides:
- Security Measures (Art. 23) β AES-256-GCM vault encryption, HMAC-SHA256 audit integrity, Keycloak OIDC, RBAC, SSRF protection
- Disclosure to Data Subjects (Art. 33) β Full data export via REST API
- Correction and Deletion (Art. 34-35) β Memory updates for correction; cascade deletion for erasure
- Pseudonymized Information (2022 amendment) β GDPR erasure uses SHA-256 pseudonymization, satisfying APPI's pseudonymized information category
- Cross-Border Transfer Documentation (Art. 28) β LLM provider data flows documented; audit trail records which model/provider processed each turn
POPIA β South Africa
South Africa's Protection of Personal Information Act (2013, effective 2021) establishes 8 data processing conditions aligned with EU standards. EDDI provides built-in technical capabilities for each condition:
- Accountability (Condition 1) β HMAC-signed audit ledger, documented data flows, Apache 2.0 open-source code
- Processing Limitation (Condition 2) β Token-aware windowing, configurable retention, idle conversation auto-end
- Information Quality (Condition 5) β Timestamped, versioned conversation state; user memories updatable via REST API
- Security Safeguards (Condition 7) β AES-256-GCM encryption, HMAC integrity, Keycloak OIDC, RBAC, SSRF protection
- Data Subject Participation (Condition 8) β Full data export and cascade deletion endpoints
PDPA β Singapore & Thailand
The Personal Data Protection Acts in Singapore (2012, amended 2021) and Thailand (2019, effective 2022) are Southeast Asia's most mature privacy frameworks. EDDI covers the technical obligations of both jurisdictions:
- Access Obligation β Full data export via REST API and MCP tools
- Correction Obligation β User memories updatable via REST API
- Protection Obligation β AES-256-GCM encryption, HMAC audit integrity, Keycloak OIDC, RBAC
- Retention Limitation β Configurable auto-cleanup with idle conversation timeout
- Data Breach Notification β Incident response runbook template included in EDDI documentation
PDPA β Malaysia
Malaysia's Personal Data Protection Act 2010 (Act 709, amended 2024) governs commercial processing of personal data through 7 data protection principles. EDDI provides the technical controls to support deployer compliance:
- General Principle (Β§6) β Configurable retention policies and processing-restriction endpoint support purpose-limited, consent-based processing
- Security Principle (Β§9) β AES-256-GCM vault encryption, HMAC-SHA256 audit integrity, Keycloak OIDC, RBAC, SSRF protection
- Retention Principle (Β§10) β Configurable per-category retention with automatic cleanup; idle conversation auto-end
- Data Integrity Principle (Β§11) β Timestamped, versioned conversation state; user memories updatable via REST API
- Access Principle (Β§12) β Full data export via
GET /admin/gdpr/{userId}/exportreturns all user data as structured JSON - Cross-Border Transfers (Β§129) β Self-hosted architecture enables deployers to control data residency; audit trail documents all LLM provider data flows
PIPL β China
China's Personal Information Protection Law (2021) is one of the world's most comprehensive data protection laws, governing the processing of personal information of individuals within China. EDDI provides the technical infrastructure for PIPL-compliant deployments:
- Lawful Processing (Art. 13) β Configuration-driven agent behavior ensures processing stays within defined purposes; processing restriction API freezes activity on demand
- Individual Rights (Art. 44β49) β Full data export, cascade deletion, and processing restriction endpoints cover right to know, copy, correct, delete, and restrict
- Data Security (Art. 51) β AES-256-GCM vault encryption, HMAC-SHA256 audit integrity, Keycloak OIDC, RBAC, zero
eval() - Cross-Border Transfers (Art. 38β39) β Self-hosted architecture enables on-premises deployment within China; audit trail documents all external data flows for security assessments
- Automated Decision-Making (Art. 24) β Immutable audit trails with full pipeline tracing provide transparency into AI decision-making; human oversight via Management UI
- Data Retention (Art. 19) β Configurable retention policies with automatic cleanup enforce minimum-necessary storage periods
Additional Jurisdictions
Industry-Specific Compliance
HIPAA β US Healthcare
The Health Insurance Portability and Accountability Act establishes safeguards for Protected Health Information (PHI). EDDI provides the technical infrastructure for HIPAA-compliant AI deployments:
- Access Controls (Β§164.312(a)) β Keycloak OIDC with role-based access (eddi-admin, eddi-editor, eddi-viewer)
- Audit Controls (Β§164.312(b)) β HMAC-signed, immutable audit ledger records every operation with timestamps, user IDs, and outcomes
- Integrity Controls (Β§164.312(c)) β HMAC-SHA256 tamper detection on all audit entries
- Transmission Security (Β§164.312(e)) β TLS for transit; AES-256-GCM for secrets at rest via Secrets Vault
- Data Disposal (Β§164.310(d)(2)(i)) β GDPR cascade deletion endpoint permanently removes PHI across all data stores
- BAA Template β Business Associate Agreement template included in EDDI documentation for healthcare deployments
SOC 2 Readiness
SOC 2 Type II evaluates systems against Trust Services Criteria. EDDI's architecture provides technical controls that support organizations pursuing SOC 2 attestation:
- Security β OIDC/Keycloak authentication, RBAC, Secrets Vault (AES-256-GCM), zero eval(), path traversal protection, URL validation
- Availability β Horizontal scaling via NATS JetStream, dual database support (MongoDB/PostgreSQL), Kubernetes-native deployment
- Processing Integrity β Immutable HMAC-signed audit ledger with per-operation cryptographic integrity verification
- Confidentiality β Secret redaction filter scrubs API keys and vault references from audit entries; PII-safe logging with SHA-256 pseudonyms
- Privacy β Full data subject rights API (erasure, export, restriction), configurable retention, processing restriction controls
One API for Global Compliance
Every privacy regulation listed above is served by the same unified REST API and MCP tools. Whether you are responding to a GDPR erasure request in Germany, a CCPA deletion request in California, or a PDPA access request in Singapore β the same endpoints handle it all:
DELETE /admin/gdpr/{userId} β Cascade erasure across 5 data stores (user memories, conversations, managed mappings, logs, audit entries)GET /admin/gdpr/{userId}/export β Full user data export as structured JSON (memories, conversations, audit records)POST /admin/gdpr/{userId}/restrict β Freeze processing while preserving data for dispute resolutiondelete_user_data β AI-orchestrated cascade erasure (requires explicit confirmation)export_user_data β AI-orchestrated data export for automated DSAR workflowsBuilt for Regulated Industries Worldwide
Healthcare, financial services, government, manufacturing, and other regulated sectors can deploy EDDI with confidence. The platform provides the transparency, auditability, and control mechanisms required by 17+ regulatory frameworks β from the EU AI Act and GDPR in Europe to HIPAA in the United States, PIPEDA in Canada, LGPD in Brazil, APPI in Japan, POPIA in South Africa, PDPA in Southeast Asia, Malaysia's PDPA, and China's PIPL. Compliance is not an afterthought β it is an architectural foundation.