Compliance — bRRAIn Docs

Compliance frameworks bRRAIn supports — what we attest to, what you tag, what's automated.

Compliance

bRRAIn supports a wide range of compliance frameworks. This page covers what we attest to as a vendor, what you can tag at the organization level, and what's automated for you.

Frameworks we hold

bRRAIn maintains current attestations for:

  • SOC 2 Type II — annual audit covering Security, Availability, Confidentiality.
  • ISO 27001:2022 — Information Security Management System.
  • HIPAA — covered-entity-ready posture; BAAs available.
  • GDPR — EU data-protection compliance; DPAs available.
  • HITRUST CSF — for healthcare-facing customers.

In progress or available on Enterprise and Sovereign-Cloud:

  • FedRAMP Moderate — for US Federal customers.
  • PCI DSS 4.0 — for payment-handling customers.
  • CMMC Level 2 — for US Defense supply chain.
  • EU AI Act — risk-tier-appropriate posture.

Audit reports and DPAs are available to qualifying customers under NDA. Request via trust.brrain.io or contact your CSM.

Compliance tagging

You tag your organization or individual zones with compliance flags. Tagging:

  • Enforces appropriate retention minimums automatically.
  • Forces relevant approval gates on sensitive actions.
  • Restricts integration availability (e.g., HIPAA-tagged orgs can't use non-BAA-covered integrations by default).
  • Triggers compliance-evidence flows in Robo-Compliance when installed.

Tags include:

  • hipaa — Protected Health Information.
  • pci — Cardholder Data.
  • gdpr-strict — EU personal data with strict processing limits.
  • sox — financial reporting data.
  • glba — non-public personal information (US financial).
  • ferpa — student records (US education).
  • cjis — criminal-justice information (US law enforcement).
  • Plus custom tags you define for internal compliance regimes.

What we attest to

For each framework we hold, we publish:

  • Scope — which bRRAIn services are in scope and which are not.
  • Boundary — the geographic and organizational boundary of the certification.
  • Audit period — when the most recent audit covered.
  • Auditor — the firm that performed the audit.
  • Available reports — specific deliverables (SOC 2 Type II report, ISO 27001 certificate, HIPAA risk assessment, etc.).

What you're responsible for

Compliance is shared. bRRAIn provides the platform; you operate it. Your responsibilities include:

  • Member access controls — invite the right people, give them the right roles, remove them when they leave.
  • Data handling — classify data correctly, place in appropriate zones, set appropriate retention.
  • Integration choices — only use integrations that are covered by your applicable frameworks.
  • MFA enforcement — where your framework requires it.
  • Audit log review — periodic access reviews and incident review.
  • Compliance-bound configurations — using compliance tagging to force the right defaults.
  • Customer notifications — for incidents affecting your data subjects.
  • Subprocessor management — review and approve our subprocessor changes.

Continuous compliance evidence

The Robo-Compliance marketplace extension automates evidence collection across the major frameworks. With Robo-Compliance installed:

  • Pre-built control mappings for SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS 4.0, NIST 800-53/171, CMMC, FDA QSR, and more.
  • Continuous evidence pulled from your audit log, pod telemetry, integrations, and Document Portal.
  • Drift detection when controls stop producing evidence.
  • Audit-package assembly when your annual audit comes due.
  • Policy enforcement to gate actions that would violate controls.

Without Robo-Compliance, you can still meet compliance — you'll do more manual evidence collection. We provide guidance and templates.

Audit support

For your annual audits, we support:

  • Provision of our audit reports under NDA.
  • Joint workpapers for shared controls (e.g., infrastructure-level controls we own).
  • Direct auditor access (read-only) to your audit log under contract.
  • Customer-introduced subprocessors disclosed and tracked.

Incident notification

In the event of an incident affecting your data:

  • We notify you within 24 hours of detection (per most framework requirements).
  • We provide an initial assessment within 72 hours.
  • We provide a full post-incident report within 30 days.
  • We support regulator notifications you may be required to make.

Notification thresholds and timelines may be tighter under specific contracts (e.g., HIPAA, GDPR) — those contractual terms govern.

Where to next