Vord

Enhancement Proposal

Proposal: Compliance enablement and data residency

When a customer's SOC 2 / ISO 27001 / GDPR auditors arrive, they ask for evidence: who did what, how long data is kept, where it physically lives. The substrate exists — the event stream (ADR-0022), crypto-shredding retention (ADR-0034), tenant residency (ADR-0012 / ADR-0024), the LINDDUN model (ADR-0041). This productizes those records into the surfaces auditors actually consume — projections and configuration over existing records, no new architecture.

Motivation

Enterprises cannot adopt an identity system their auditors cannot audit. For self-hosted open source the operator carries the audit, so Vord must hand them evidence, not a shrug: exportable audit trails with integrity proofs, demonstrable retention enforcement, and a provable answer to "where does this tenant's data live?".

Design

  • Audit-evidence exports: immutable, replayable extracts of the identity event stream (ADR-0022) carrying an integrity proof — the stream's ordering offsets plus signatures — so an auditor can verify an extract is complete and untampered. Consumable as SOC 2 / ISO evidence.
  • Retention controls as first-class per-tenant/realm configuration: ADR-0034's retention windows productized — configurable per event class, with a legal-hold override that suspends deletion and is itself an audited action.
  • The residency surface: tenant residency pinning (tenant as the isolation/residency boundary, ADR-0012; residency pins the core, ADR-0024) exposed as auditable configuration with residency-violation alarms. Placement is mechanics and stays ADR-0024's; this is the product surface an auditor reads.
  • DPA / records-of-processing support: a per-tenant data inventory — what personal data, where, why, for how long — generated from the schema plus the LINDDUN privacy model (ADR-0041), not hand-maintained, so it cannot drift from what the code actually does.
  • Explicitly not certifications. Vord ships evidence surfaces; the operator pursues SOC 2 / ISO. This mirrors ADR-0027's no-commissioned-audit stance — the honest posture for self-hosted software.

Alternatives considered

  • Compliance dashboard, UI-first — rejected: auditors consume artifacts, so the evidence-export API comes first; presentation belongs to the admin console (proposal 0018).
  • Baked-in certification claims — rejected as dishonest: certification attaches to an operation of the software, never to the software itself.

Graduation criteria

An evidence export replays from the stream and its integrity proof verifies independently; retention windows demonstrably enforce deletion — and legal hold suspends it — per tenant; a residency-pinned tenant's data provably stays in-region and a violation raises an alarm; and the per-tenant data inventory is generated, not written.

Backward compatibility

Projections and configuration over ADR-0022 / ADR-0034 / ADR-0012 — no architecture change. Retention defaults are non-destructive on upgrade: existing deployments default to retain until an operator configures windows.

Open questions

  • Evidence export format: plain JSON/CSV extracts versus a standardized frame such as OSCAL.
  • Whether residency-violation alarms join proposal 0012's SLO/alerting set or remain a compliance-only surface.