AuditRails supports 18 active compliance frameworks out of the box. For each framework, specific event types, storage guarantees, and dashboard features map directly to regulatory controls — so you can demonstrate compliance without manual evidence collection. This guide covers the 10 broadest frameworks in detail, plus a summary of the remaining 8.
Getting Started
Before mapping events to controls, make sure you’re set up correctly.
Enable a Compliance Framework
Navigate to Settings → Compliance Frameworks and toggle on the frameworks relevant to your organization. Compliance features require a Framework or Compliance Trail — they are not available on Starter Trails.
Review the Compliance Checklist
Open Dashboard → Compliance and select your framework. Each checklist item maps to a specific control and shows its current status.
Start Logging Required Events
Instrument your application to emit the event types listed for your framework in the sections below. Use the AuditRails SDK or REST API.
Run Auto-Verification
Use the auto-verification feature in the compliance dashboard to confirm your hash chain is intact and required event coverage is met.
Track Progress
Monitor the checklist over time. Each control turns green once AuditRails detects the required events and configuration.
Framework Reference
SOC 2
HIPAA
ISO 27001
GDPR
PCI DSS v4.0
NIS2
DORA
CCPA / CPRA
FedRAMP
SOX
SOC 2 Trust Services Criteria require you to log access events, authentication activity, permission changes, and configuration changes — and to demonstrate that those logs cannot be tampered with.Key capabilities: Immutable audit trail, WORM storage, RBAC auditor role (read-only access for auditors), CSV export for evidence packages.The RBAC auditor role lets you grant your external auditor read-only access to the compliance dashboard without exposing sensitive configuration settings.
HIPAA Security Rule requirements focus on PHI access logging, integrity controls, and authentication. Retention must be 6 years, which AuditRails enforces automatically on Framework and Compliance Trails.Retention: 6 years on Framework/Compliance Trails (automatic when HIPAA is enabled).S3 WORM retention is set at write time and cannot be shortened retroactively. If a DSAR deletion request is received, hot-storage records are soft-deleted immediately, but WORM copies are logically excluded from reads and exports under GDPR Art.17(3)(e) until the retention period expires.
ISO 27001:2022 Annex A controls map closely to AuditRails’ logging, monitoring, and integrity capabilities.Tenant isolation means each customer’s hash chain is independent. A breach in one tenant’s chain cannot affect another’s, satisfying A.5.23 multi-tenancy controls.
GDPR obligations span data processing accountability, consent management, subject rights, and breach notification. See the GDPR Compliance guide for full configuration steps. PCI DSS v4.0 Requirement 10 mandates detailed audit logs for all access to cardholder data environments, with tamper protection and time-range search.Retention: Up to 7 years (Compliance Trails). PCI DSS requires a minimum of 12 months with 3 months immediately available.Every event in AuditRails includes actor_id, resource, action, timestamp, IP address, and outcome fields by default — satisfying Requirement 10.3’s “complete record” mandate without extra configuration.
The EU NIS2 Directive (2022/2555) applies to essential and important entities. It mandates security event logging, access controls, supply chain monitoring, and incident reporting.Retention: 5 years (set automatically when NIS2 is enabled). The EU Digital Operational Resilience Act (2022/2554) applies to financial entities and their ICT providers. It emphasises operational continuity, incident timelines, and third-party risk.Reporting deadlines: 4 hours (initial notification), 72 hours (intermediate report), 1 month (final report). Log incident.detected and incident.notified events to create a timestamped paper trail for each deadline.Retention: 5 years (set automatically when DORA is enabled).DORA’s Art.6 requirement for hash-chained logging is natively satisfied — every event is chained with SHA-256, and you can verify the chain at any time via the dashboard or API.
California’s CCPA and CPRA grant consumers rights over their personal information. AuditRails helps you log data access and deletion events and meet deletion deadlines.Deletion deadline: 45 days. Use the DSAR workflow to trigger and document deletion within this window.Retention: 3 years (set automatically when CCPA/CPRA is enabled). FedRAMP (based on NIST 800-53) imposes strict audit logging controls for cloud services used by US federal agencies.AU-3 requires that every log record contain sufficient information to identify what happened, when, who did it, where, and what the outcome was. AuditRails populates all these fields automatically from the event payload and server-side enrichment.
The Sarbanes-Oxley Act requires publicly traded companies to maintain tamper-proof audit trails supporting ICFR certification and IT General Controls (ITGC).Retention: Enabling SOX automatically sets your trail retention to 7 years.SOX §802 mandates a 7-year retention period. Once records are written to S3 WORM storage, they cannot be deleted or shortened before the retention period expires — this is a legal requirement, not a platform limitation.
Additional Frameworks
Beyond the 10 detailed above, AuditRails also supports:
Enable any of these from Settings → Compliance Frameworks.
Multi-Framework Coverage
If your organization must satisfy multiple frameworks simultaneously, AuditRails merges their requirements. A single auth.login event, for example, satisfies SOC 2 CC6.2, HIPAA §164.312(d), PCI DSS 10.2.1, NIS2 Art.21(2)(i), and FedRAMP AC-2 at the same time.
Enable all applicable frameworks before you start logging. This ensures the compliance dashboard tracks coverage across all of them from day one and that the correct retention period (the longest of all enabled frameworks) is applied.