# Astra Regulatory Map

How specific obligations under GLBA, SEC 17a-4, FINRA 4511, SOX 404, DORA, the EU AI Act, MAS TRM, and PCI-DSS 4.0 are met by specific Astra features and verifiable endpoints. Use this as the left column of your control-matrix worksheet.

| Regulation               | What it requires                                                                 | How Astra helps you meet it                                                                                                      | Verifiable endpoint                            |
|--------------------------|----------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------|
| GLBA US                  | Safeguards Rule administrative, technical, physical safeguards on customer NPI.  | NPI never exits your VPC unreduced. Tokenization runs at the SDK boundary; raw values stay in the Vault, which lives in your perimeter on the Hybrid and On-Prem tiers. | POST /vault/store GET /onprem/deployments     |
| SEC 17a-4 US            | Books-and-records rule broker-dealers must preserve communications in a non-rewritable, non-erasable format. | Hash-chained, append-only audit log of every prompt, classification, token reveal, and executor action. Each entry contains the SHA-256 of the previous entry; tampering is mathematically detectable. | GET /audit/secure/verify GET /audit/export     |
| FINRA 4511 US           | Books-and-records preservation minimum 6-year retention for relevant records. | 6-year immutable retention default for all AI interactions. Configurable per tenant. Export to JSON or CSV for the firm's WORM archive. | GET /audit/export?format=json                    |
| SOX 404 US              | Internal controls over financial reporting segregation of duties, access trail. | RBAC with 5 roles (viewer, developer, security_admin, compliance_officer, org_admin). Per-user, per-token access trail. Token reveal requires token:execute, separate from token:create. | GET /rbac/roles                                 |
| DORA EU                 | Digital Operational Resilience Act third-party ICT risk management for regulated financial entities.| Aligned with third-party ICT risk requirements. EU-locality option (Vertex EU). On-Prem deployment removes Astra from the customer's third-party ICT register entirely. | GET /onprem/deployments GET /security/overview  |
| EU AI Act EU            | High-risk AI systems Art.10(data governance) and Art.12(automatic logging).  | Designed to support Art.10(classification, K-anonymity, type-aware tokens) and Art.12(hash-chained logs of every model interaction with full provenance). | GET /audit/secure/verify                        |
| MAS TRM SG              | Technology Risk Management Guidelines — Monetary Authority of Singapore.          | Cloud-locality enforcement. Customer-held keys on Hybrid and On-Prem. Full audit trail. Incident-response acknowledgment within 24 hours. | GET /settings/zero-1ogging GET /audit/export    |
| PCI-DSS 4.0 Global      | Cardholder data environment Requirement 3.5(PAN protection).                       | Luhn-validated PAN tokenization. PAN never reaches the LLM. Helps you meet Req 3.5; does not by itself make your merchant program compliant. External QSA engagement on roadmap. | POST /vault/store                                |
| SOX 404(audit) US       | Auditor walkthrough auditor must be able to test that controls operate.            | Every claim in this map is a callable endpoint, demoable on a screen-share. GET /security/overview returns the standard CISO questionnaire response in machine-readable JSON. | GET /security/overview                          |