Security & Privacy Architecture Whitepaper
Technical blueprint explaining how ComplyPulse integrates with customer cloud infrastructure (AWS, GCP, Azure) with Zero Write/Delete Permissions and mathematically verifiable cryptographic evidence seals.
1
Zero-Risk, Read-Only Cloud Access (STS AssumeRole)
ComplyPulse requires zero long-lived credentials and zero write or delete permissions on your infrastructure.
AWS STS AssumeRole with ExternalId: Ephemeral 1-hour credentials generated on-demand. Role strictly limited to AWS-managed SecurityAudit and ViewOnlyAccess.
Google Cloud Service Accounts: Bound strictly to roles/viewer and roles/iam.securityReviewer.
Microsoft Azure Service Principal: Assigned Reader and Security Reader subscription roles.
2
SHA-256 Cryptographic Evidence Vault
Raw telemetry findings are hashed at the exact second of collection using SHA-256 digital seals to ensure mathematical tamper-proofing for CPA and ISO auditors.
// SHA-256 Evidence Hashing Pipeline
const rawTelemetry = await awsConnector.collectTelemetry();
const sha256Seal = crypto.createHash('sha256').update(JSON.stringify(rawTelemetry)).digest('hex');
// Checksum permanently stamped on official PDF & JSON Audit Packs
3
AES-256-GCM Zero-Knowledge Secret Storage
All connector configuration metadata is protected using AES-256-GCM encryption with unique initialization vectors (IVs) per organization.
SOC 2 Type II
CC6.1, CC6.2, CC6.6 Aligned
HIPAA Security Rule
§ 164.312 Technical Safeguards
Questions? Contact security@complypulse.com
Launch Console