Compliance & Certifications

Compliance & Certifications

Overview

CodeDD is built to meet the strictest security and privacy standards. Whether you're subject to GDPR, require SOC 2 compliance, or need to meet ISO 27001 standards, CodeDD's architecture and processes are designed for compliance from the ground up.

Security Certifications

SOC 2 Type II

What It Is:

• Service Organization Control 2
• Independent audit of security practices
• Focuses on: Security, Availability, Processing Integrity, Confidentiality, Privacy
• Annual attestation by certified auditors

CodeDD's SOC 2 Coverage:

Security:

• ✅ Access controls and authentication
• ✅ Encryption at rest and in transit
• ✅ Secure development practices
• ✅ Incident response procedures
• ✅ Vendor management

Confidentiality:

• ✅ Data classification
• ✅ Encryption implementation
• ✅ Access restrictions
• ✅ Non-disclosure agreements
• ✅ Secure deletion practices

Availability:

• ✅ Uptime monitoring (99.9% SLA)
• ✅ Disaster recovery
• ✅ Redundant infrastructure
• ✅ Regular backups (excluding source code)
• ✅ Business continuity planning

Report Availability:

• Annual SOC 2 Type II reports available to enterprise customers
• NDA required for report access
• Covers 12-month audit period

ISO 27001

Information Security Management System (ISMS)

What It Is:

• International standard for information security
• Comprehensive security framework
• Risk-based approach
• Continuous improvement cycle

CodeDD's ISO 27001 Implementation:

A.8 Asset Management:

• ✅ Information asset inventory
• ✅ Acceptable use policies
• ✅ Return of assets procedures
• ✅ Classification of information

A.9 Access Control:

• ✅ Access control policy
• ✅ User access management
• ✅ User responsibility documentation
• ✅ System access control

A.10 Cryptography:

• ✅ Cryptographic controls policy
• ✅ Key management procedures
• ✅ AES-256 encryption standard
• ✅ TLS 1.3 for transmission

A.12 Operations Security:

• ✅ Documented operating procedures
• ✅ Change management
• ✅ Capacity management
• ✅ Protection against malware
• ✅ Logging and monitoring

A.13 Communications Security:

• ✅ Network security controls
• ✅ Network segregation
• ✅ Secure information transfer
• ✅ Non-disclosure agreements

A.14 System Acquisition:

• ✅ Security requirements analysis
• ✅ Secure development lifecycle
• ✅ Test data protection
• ✅ Change control procedures

A.18 Compliance:

• ✅ Legal and contractual requirements
• ✅ Intellectual property rights
• ✅ Privacy and PII protection
• ✅ Audit compliance

Data Privacy Regulations

GDPR (EU General Data Protection Regulation)

Applicability:

• EU-based customers
• Processing EU citizen data
• Global best practice

GDPR Principles Met:

1. Lawfulness, Fairness, and Transparency:

• ✅ Clear privacy policy
• ✅ Explicit consent for processing
• ✅ Transparent processing activities
• ✅ Documented legal basis

2. Purpose Limitation:

• ✅ Code analyzed only for audit purposes
• ✅ No secondary use of data
• ✅ Clear purpose documentation

3. Data Minimization:

• ✅ Only necessary data processed
• ✅ Source code not permanently stored
• ✅ Metadata minimization
• ✅ No PII collection from code

4. Accuracy:

• ✅ Accurate audit results
• ✅ User can request corrections
• ✅ Version control for results

5. Storage Limitation:

• ✅ Zero retention of source code
• ✅ Audit results retained per contract
• ✅ Deletion upon request
• ✅ Automated retention policies

6. Integrity and Confidentiality:

• ✅ AES-256 encryption
• ✅ Access controls
• ✅ Secure deletion
• ✅ Audit trails

7. Accountability:

• ✅ Data Protection Officer appointed
• ✅ Privacy Impact Assessments conducted
• ✅ Processor agreements in place
• ✅ Regular compliance audits

GDPR Rights Supported:

Right to Access:

• Users can request all data CodeDD holds
• Provided within 30 days
• Machine-readable format available

Right to Rectification:

• Incorrect audit results can be corrected
• Updated within 72 hours of request

Right to Erasure ("Right to be Forgotten"):

• Complete deletion of all data
• Includes backups and archives
• Confirmation provided within 30 days
• Verification of deletion

Right to Data Portability:

• Export audit results in JSON/CSV format
• Machine-readable
• Transfer to third parties supported

Right to Object:

• Users can object to processing
• Processing stopped immediately
• Data deleted upon request

Data Breach Notification:

• Breach detected: <24 hours
• Regulators notified: <72 hours
• Users notified: <72 hours
• Incident report provided

CCPA (California Consumer Privacy Act)

California-Specific Requirements:

Right to Know:

• ✅ What personal information collected
• ✅ Sources of information
• ✅ Business purpose for collection
• ✅ Third parties receiving data

Right to Delete:

• ✅ Delete personal information upon request
• ✅ Deletion confirmation
• ✅ Service provider deletion included

Right to Opt-Out:

• ✅ Opt-out of data "sale" (N/A - we don't sell data)
• ✅ Clear opt-out mechanisms

Non-Discrimination:

• ✅ No different pricing for privacy requests
• ✅ Equal service quality

Industry-Specific Compliance

Financial Services (GLBA, PCI-DSS)

For FinTech Audits:

GLBA (Gramm-Leach-Bliley Act):

• ✅ Safeguarding financial information
• ✅ Encryption of sensitive data
• ✅ Access controls
• ✅ Incident response plans

PCI-DSS (If Payment Code Analyzed):

• ✅ Secure network transmission (TLS 1.3)
• ✅ Encryption of cardholder data
• ✅ Access control measures
• ✅ Regular security testing
• ✅ Maintain security policy

Note: CodeDD flags payment card data found in code and recommends removal

Healthcare (HIPAA)

For HealthTech Audits:

HIPAA Compliance:

• ✅ Business Associate Agreement (BAA) available
• ✅ Encryption of PHI (if found in code)
• ✅ Access controls and audit logs
• ✅ Breach notification procedures
• ✅ Secure disposal of PHI

PHI Detection:

• AI identifies potential PHI in code
• Flags for immediate attention
• Recommends removal/tokenization
• Does not store PHI

Government (FedRAMP, NIST)

For GovTech Audits:

NIST Cybersecurity Framework:

• ✅ Identify: Asset management, risk assessment
• ✅ Protect: Access control, encryption
• ✅ Detect: Continuous monitoring, anomaly detection
• ✅ Respond: Incident response plan
• ✅ Recover: Backup and recovery procedures

NIST SP 800-171:

• ✅ 14 control families implemented
• ✅ CUI (Controlled Unclassified Information) protection
• ✅ Incident reporting
• ✅ Security awareness training

FedRAMP (In Progress):

• Working toward FedRAMP Moderate authorization
• Expected completion: 2026 Q4
• Allows federal agency use

Third-Party Integrations

Sub-Processor Compliance

AI Service Providers:

• ✅ SOC 2 Type II certified
• ✅ Zero data retention policies
• ✅ Data Processing Agreements (DPAs) in place
• ✅ GDPR-compliant

Cloud Infrastructure:

• ✅ AWS (SOC 2, ISO 27001, FedRAMP)
• ✅ Data residency options (EU, US)
• ✅ Encryption at rest and in transit
• ✅ Regular security audits

Database (TypeDB):

• ✅ Self-hosted (not SaaS)
• ✅ Full control over data
• ✅ Encrypted storage
• ✅ Regular backups (excluding code)

Vendor Management

Due Diligence Process:

1. Security questionnaire
2. Certification verification (SOC 2, ISO)
3. DPA/BAA execution
4. Annual re-assessment
5. Continuous monitoring

Security Practices

Secure Development Lifecycle

OWASP Secure Coding Practices:

• ✅ Input validation
• ✅ Output encoding
• ✅ Authentication and password management
• ✅ Session management
• ✅ Access control
• ✅ Cryptographic practices
• ✅ Error handling and logging
• ✅ Data protection
• ✅ Communication security

DevSecOps:

• ✅ Security automated in CI/CD
• ✅ Dependency vulnerability scanning
• ✅ Static code analysis (SAST)
• ✅ Dynamic analysis (DAST)
• ✅ Container security scanning
• ✅ Infrastructure-as-Code security

Penetration Testing

Annual Penetration Testing:

• External penetration test (annual)
• Internal penetration test (annual)
• Application security assessment (quarterly)
• Conducted by certified third parties
• Findings remediated within SLA

Vulnerability Management

Continuous Scanning:

• Dependency vulnerability scanning (daily)
• Infrastructure scanning (weekly)
• Container image scanning (on build)
• Zero-day vulnerability monitoring

Patch Management:

• Critical vulnerabilities: <24 hours
• High severity: <7 days
• Medium severity: <30 days
• Low severity: <90 days

Audit & Assurance

Independent Audits

Annual Audits:

• SOC 2 Type II (annual)
• ISO 27001 surveillance (annual)
• Penetration testing (annual)
• GDPR compliance (annual)

Quarterly Reviews:

• Access control review
• Encryption key management review
• Incident response testing
• Disaster recovery testing

Continuous Monitoring

Real-Time Security:

• SIEM (Security Information and Event Management)
• Intrusion detection/prevention
• Anomaly detection
• 24/7 security operations center (SOC)

Metrics Tracked:

• Failed authentication attempts
• Unusual data access patterns
• System performance anomalies
• Encryption key access
• Data deletion verification

Customer Responsibilities

Shared Responsibility Model

CodeDD's Responsibilities:

• ✅ Secure infrastructure
• ✅ Encryption implementation
• ✅ Access controls
• ✅ Secure deletion
• ✅ Compliance adherence

Customer's Responsibilities:

• ⚠️ Access token management (don't share)
• ⚠️ User access control (limit who can audit)
• ⚠️ Data classification (tell us sensitivity)
• ⚠️ Compliance requirements (notify us of special needs)
• ⚠️ Incident reporting (tell us if you suspect breach)

Documentation & Evidence

Compliance Artifacts Available

Upon Request (NDA Required):

• SOC 2 Type II Report
• ISO 27001 Certificate
• Penetration test summaries
• Security policies and procedures
• Data Processing Agreement (DPA)
• Business Associate Agreement (BAA)
• Sub-processor list

Publicly Available:

• Privacy Policy
• Terms of Service
• Security overview (high-level)
• Certification badges

Geographic Considerations

Data Residency

Options:

• US (Default): AWS US-East-1
• EU: AWS EU-West-1 (Ireland) - GDPR-compliant
• Custom: Enterprise customers can specify region

Data Transfer Mechanisms:

• Standard Contractual Clauses (SCCs)
• Adequacy decisions (where applicable)
• Data Processing Agreements (DPAs)

Local Regulations

Compliance Support:

• US: CCPA, GLBA, HIPAA
• EU: GDPR, ePrivacy Directive
• UK: UK GDPR, Data Protection Act 2018
• Canada: PIPEDA
• Australia: Privacy Act 1988
• Custom: Consult for specific jurisdictions

Incident Response

Security Incident Procedures

Detection:

• Automated monitoring alerts
• Manual reporting by team
• Customer reports
• Third-party notifications

Response Timeline:

• Detection: <1 hour (automated)
• Initial assessment: <4 hours
• Containment: <24 hours
• Notification (if required): <72 hours
• Remediation: Varies by severity
• Post-incident review: Within 2 weeks

Customer Communication:

• Immediate: Critical incidents affecting data
• 24 hours: High-severity incidents
• 72 hours: Regulatory notification timeline
• 1 week: Post-incident report

Key Takeaways

For Investors:

• Due Diligence Simplified: CodeDD meets compliance requirements
• Risk Transfer: Compliance burden on CodeDD, not portfolio companies
• Audit Evidence: Comprehensive documentation available
• Regulatory Confidence: Multi-jurisdiction compliance

For CTOs:

• Vendor Risk Management: SOC 2 and ISO 27001 certified
• Compliance Inheritance: Use CodeDD's compliance for your needs
• Audit Support: Documentation for your auditors
• Continuous Improvement: Regular audits and updates

Next Steps

• Review Data Encryption
• Learn about Secure Data Deletion
• Understand Repository Connection Security
• Request compliance documentation: compliance@codedd.ai