Work / Trunk / Wiki / Synthesis
compliance
Synthesisdraftverified 2026-10-21
SYNTHESIS.COMPLIANCESummary
Where Trunk stands on SOC 2, GDPR and HIPAA, what is already in place, and what is left, in order.
Built from
- tenant-isolation
- access-levels
- plans
- capture-reads-the-product
- 2026-10-21-no-patient-data
- 2026-10-12-stack
Body
The answer
Trunk is not SOC 2, GDPR-ready or HIPAA compliant. Nothing claims it is.
- HIPAA does not apply and is not a goal: Trunk takes no patient data (2026-10-21-no-patient-data).
- SOC 2 is an audit report from an outside firm over controls that ran for a period. Code is part of it; most of it is how the company runs. It is done when a buyer asks for it, with a compliance tool (Vanta, Drata or Secureframe) and a Type I, then a Type II.
- GDPR applies from the first EU customer. It needs true public pages, a DPA, a list of the providers that touch customer data, and deletion that does what it says.
Already in place
| Control | Where |
|---|---|
| One company cannot read another's rows: row-level security, enforced by the database | tenant-isolation |
| Three database roles: the web app cannot read a role's password; only the worker can | ops/setup.md |
| A role's test password sealed with AES-256-GCM, bound to the role, with a key id for rotation | packages/db/src/role-secret.ts |
| The worker refuses private addresses, and its browsers go out only through a proxy that checks them | apps/worker/src/egress/ |
| A captured page shown in a sealed frame: no scripts, forms, cookies or windows | security |
| Access levels and product access, each guard tested once | access-levels, 2026-10-13-product-access |
| Sign-in rate limited per address | ops/setup.md |
| A production build refuses placeholder secrets, plain http and console email | ops/setup.md |
| Secrets never committed; every one backed up offline | ~/git/CLAUDE.md |
| A deleted company restorable for 14 days, then removed with its files; invoices kept for tax | apps/worker/src/plans/purge-companies.ts, legal/data-deletion.md |
| A deleted product removed with its files | apps/web/src/server/products/delete-product.ts |
Left
Each gap is a task in .context/tasks.md, so it is listed once:
- MFA and the access review — T045
- a lawyer, the legal entity and the governing law — T046, T010, T021
- backups of captured files — T047
- alerts — T048
- the audit log — T049,
features/0023-audit-log.md - SOC 2 itself — T050, when a buyer asks
- SSO and SCIM for Enterprise — plans
Last refresh
2026-10-21 — refresh when any "Built from" page changes.