> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usedino.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance

> Dino's compliance posture — SOC 2, GDPR, and enterprise readiness.

<Note>
  Dino is building toward full SOC 2 and GDPR compliance. This page is transparent about what we've implemented and what's on our roadmap.
</Note>

## SOC 2 Type II

| Requirement            | Status         | Details                                                                    |
| ---------------------- | -------------- | -------------------------------------------------------------------------- |
| Access controls        | Implemented    | CODEOWNERS, branch protection, PR review requirements                      |
| Change management      | Implemented    | 13 CI checks, enforcement checksums (HMAC-SHA256), protected file gate     |
| Code review            | Implemented    | Mandatory PR reviews, adversarial spec review process                      |
| Vulnerability scanning | Implemented    | SonarQube (custom quality gate), Aikido, npm audit, eslint-plugin-security |
| Incident response      | Implemented    | Documented runbook, severity classification, response timeline             |
| Audit logs             | Planned (M1.5) | Activity tracking, scan history, and configuration change logs             |
| Evidence collection    | Planned        | Automated compliance evidence for auditors                                 |
| Third-party audit      | Planned        | SOC 2 Type II engagement post-launch                                       |

## GDPR

| Requirement                 | Status      | Details                                                      |
| --------------------------- | ----------- | ------------------------------------------------------------ |
| Data minimization           | Implemented | Only scan metadata stored, not API payloads                  |
| No personal data in reports | Implemented | Reports contain schema structure and findings, not user data |
| Tenant data isolation       | Implemented | Strict tenant boundaries, no cross-tenant access             |
| LLM redaction               | Implemented | Secrets stripped before any data reaches AI providers        |
| Data retention policies     | Implemented | Configurable retention periods per tenant                    |
| Right-to-deletion           | Implemented | Tenant data deletion workflow                                |
| DPA template                | Implemented | Data Processing Agreement for enterprise customers           |

<CardGroup cols={2} />

## Our Approach

We don't claim compliance we haven't earned. Instead:

1. **Build the controls first**: access management, change control, and vulnerability scanning are in place today
2. **Document honestly**: this page tells you exactly what's ready and what's not
3. **Ship incrementally**: audit logs, SSO, and formal evidence collection are the next priorities

<Info>
  Questions about Dino's security posture? Email [security@usedino.dev](mailto:security@usedino.dev) or file a [security advisory](https://github.com/Dino-HQ/dino/security/advisories) on GitHub.
</Info>