Astra Regulatory Map
How specific obligations under GLBA, SEC 17a-4, FINRA 4511, SOX 404, DORA, the EU AI Act, MAS TRM, and PCI-DSS 4.0 are met by specific Astra features and verifiable endpoints. Use this as the left column of your control-matrix worksheet.
| Regulation | What it requires | How Astra helps you meet it | Verifiable endpoint |
|---|---|---|---|
| GLBA US | Safeguards Rule administrative, technical, physical safeguards on customer NPI. | NPI never exits your VPC unreduced. Tokenization runs at the SDK boundary; raw values stay in the Vault, which lives in your perimeter on the Hybrid and On-Prem tiers. | POST /vault/store GET /onprem/deployments |
| SEC 17a-4 US | Books-and-records rule broker-dealers must preserve communications in a non-rewritable, non-erasable format. | Hash-chained, append-only audit log of every prompt, classification, token reveal, and executor action. Each entry contains the SHA-256 of the previous entry; tampering is mathematically detectable. | GET /audit/secure/verify GET /audit/export |
| FINRA 4511 US | Books-and-records preservation minimum 6-year retention for relevant records. | 6-year immutable retention default for all AI interactions. Configurable per tenant. Export to JSON or CSV for the firm's WORM archive. | GET /audit/export?format=json |
| SOX 404 US | Internal controls over financial reporting segregation of duties, access trail. | RBAC with 5 roles (viewer, developer, security_admin, compliance_officer, org_admin). Per-user, per-token access trail. Token reveal requires token:execute, separate from token:create. | GET /rbac/roles |
| DORA EU | Digital Operational Resilience Act third-party ICT risk management for regulated financial entities. | Aligned with third-party ICT risk requirements. EU-locality option (Vertex EU). On-Prem deployment removes Astra from the customer's third-party ICT register entirely. | GET /onprem/deployments GET /security/overview |
| EU AI Act EU | High-risk AI systems Art.10(data governance) and Art.12(automatic logging). | Designed to support Art.10(classification, K-anonymity, type-aware tokens) and Art.12(hash-chained logs of every model interaction with full provenance). | GET /audit/secure/verify |
| MAS TRM SG | Technology Risk Management Guidelines — Monetary Authority of Singapore. | Cloud-locality enforcement. Customer-held keys on Hybrid and On-Prem. Full audit trail. Incident-response acknowledgment within 24 hours. | GET /settings/zero-1ogging GET /audit/export |
| PCI-DSS 4.0 Global | Cardholder data environment Requirement 3.5(PAN protection). | Luhn-validated PAN tokenization. PAN never reaches the LLM. Helps you meet Req 3.5; does not by itself make your merchant program compliant. External QSA engagement on roadmap. | POST /vault/store |
| SOX 404(audit) US | Auditor walkthrough auditor must be able to test that controls operate. | Every claim in this map is a callable endpoint, demoable on a screen-share. GET /security/overview returns the standard CISO questionnaire response in machine-readable JSON. | GET /security/overview |