Compliance & data protection

This guide has grown into a section of its own. Start at
Compliance.

Compliance — The section: declare, enforce, prove, and where each control stops.

The security toolkit — prorm audit: scan the code, probe the database, evaluate checklists.

Audit logging — Who changed which row, when, from where.

Audit levels and escalation — Page someone when the audit log records something that matters.

It is organised in three layers — declare, enforce, prove — and every control
is documented with the line it does not cross:

You want to	Read
know what a country lets you hold, from what age, where	Jurisdictions
hold a model to those rules with a decorator	Declaring personal data
switch on the controls GDPR, HIPAA, PCI DSS or SOC 2 want	Frameworks
encrypt, mask, pseudonymise, isolate tenants, firewall queries	Protecting data
answer an access, erasure or portability request; record consent	Subject rights
drop data on schedule, or make sure it can never change	Retention & integrity
keep data in-country and log what leaves	Residency
print the sheet an auditor asks for	Evidence
walk one regulation end to end	Checklists
scan the code and probe the database for what weakens security	The security toolkit
hand a reviewer a directory whose contents can be verified later	Evidence bundles
page someone when the audit log records something that matters	Audit levels and escalation
let the platform rotate credentials when a database is being guessed at	Platform policies
know what is production-grade and what is a scaffold	Status

Choosing what to use

Requirement	Reach for
Column must be unreadable at rest	`FieldEncryption`
Column must be hidden from some readers	`DataMasker`
Delete a subject's data on request	`RightToErasure`
Export a subject's data on request	`DataPortabilityExporter`
Prove who changed a row	`AuditLogger` / `ComplianceAuditTrail`
Drop data past its retention window	`DataRetentionPolicy` + your scheduler
Enforce tenant isolation	database row-level security first; `RowLevelSecurity` second
Track lawful basis for processing	`ConsentRecord`
Refuse a schema a regime would not allow	`@Jurisdiction` + `@Personal`
Gate rows by the subject's age	`@DataSubjectAge` + `@ParentalConsent`

Where the database itself offers the control — RLS policies, GRANTs, TLS —
prefer it. A database-enforced rule holds for every client; an
application-enforced rule holds only for code that goes through this ORM.

Compliance & data protection

Choosing what to use#

Choosing what to use