Compliance
Audit-ready from day one.
Every Flowtriq feature is built with regulatory compliance in mind. Tamper-evident audit logs, forensic PCAP capture, role-based access control, and automated incident documentation give your compliance team the evidence trail they need — without additional tools or manual work.
Framework Mapping
How Flowtriq maps to your compliance framework
| Requirement | Framework | Flowtriq Feature |
|---|---|---|
| Audit trail for security events | SOC 2 CC6.1 CC7.2 | Tamper-Evident Audit Log |
| Incident response documentation | SOC 2 CC7.3 PCI-DSS 12.10 | Automatic incident reports with PCAP |
| Network monitoring | PCI-DSS 11.4 | 1-second PPS monitoring + flow ingestion |
| Access control logging | SOC 2 CC6.1 HIPAA 164.312(b) | Login, API key, PCAP access audit trail |
| Encryption in transit | PCI-DSS 4.1 HIPAA 164.312(e) | TLS 1.3 for all agent-dashboard comms |
| Change management | SOC 2 CC8.1 ISO 27001 A.12.1.2 | Node config, threshold, integration changes logged |
| Vulnerability management | PCI-DSS 6.5 | Threat intelligence feeds, IOC matching |
| Business continuity | SOC 2 CC9.1 ISO 27001 A.17 | Auto-mitigation, escalation policies, runbooks |
Compliance Features
Built for auditors, not just engineers
Every compliance-relevant feature in Flowtriq is designed to produce auditor-ready evidence automatically. No manual log gathering, no spreadsheet exports, no scrambling before an audit. The evidence trail builds itself as you operate.
Tamper-evident audit trail
SHA-256 hash-chained log where each entry references the previous hash. Any modification, deletion, or insertion breaks the chain and is immediately detectable.
Role-based access control
Readonly, analyst, admin, and owner hierarchy. Each role scoped to specific actions with full audit trail.
IP allowlist for dashboard access
Restrict dashboard and API access to approved IP ranges. Blocked attempts logged with source IP.
PCAP evidence chain
Full chain of custody: capture trigger, file hash, upload timestamp, every download with actor and IP.
Automated incident reports
PDF and HTML reports generated automatically with timeline, peak metrics, PCAP references, and resolution steps.
Data retention controls
Configurable retention periods by plan (90 days standard, 365 enterprise). S3 export for indefinite archival.
Evidence Output
Compliance reports, generated automatically.
When an incident occurs, Flowtriq automatically assembles the evidence auditors need: timeline, metrics, PCAP references, actor history, and resolution documentation. Export as PDF for your compliance team or share directly with auditors.
Node: nyc-edge-01
Detected: 2026-03-09 09:44:19 UTC
Resolved: 2026-03-09 09:48:03 UTC
Duration: 3m 44s
Peak PPS: 2.4M (baseline: 180K)
Evidence chain:
✓ Audit log entries (7)
✓ PCAP capture (sha256: a3f7c2...)
✓ Mitigation actions (2)
✓ Notification log (Slack, PagerDuty)
[Export PDF] [Export HTML] [Share with auditor]
Industries
Compliance by industry
FAQ
Common questions about compliance
Can Flowtriq generate compliance reports for auditors?
Yes. Flowtriq automatically generates incident reports with full timeline, peak metrics, mitigation actions, and PCAP references. Reports are available in PDF and HTML format, ready to share directly with auditors or attach to your compliance documentation.
Does Flowtriq support SOC 2 Type II requirements?
Yes. The tamper-evident audit log, role-based access controls, and change management logging directly support SOC 2 Type II criteria including CC6.1 (access control), CC7.2 (security monitoring), CC7.3 (incident response), CC8.1 (change management), and CC9.1 (business continuity).
How does Flowtriq handle data retention for compliance?
Audit log and incident data are retained for 90 days on the standard plan and up to 365 days on the enterprise plan. Automatic nightly export to S3-compatible storage allows indefinite retention under your own data governance policy. Retention periods are configurable per workspace.
How is audit log integrity guaranteed?
Every audit log entry is hash-chained to the previous entry using SHA-256. Each entry's hash is computed from its contents plus the hash of the preceding entry, forming a cryptographic chain. If any entry is modified, deleted, or inserted out of order, the chain breaks and the tampering is immediately detectable. There is no API endpoint or dashboard action that modifies log entries. Chain integrity can be verified at any time from the dashboard.