Compliance, traced end to end
Every obligation has an enforcement point.
One platform, every country. The frameworks in scope, the four places each is enforced, and the matrix that connects them.
Global security & compliance mandates
The target is the strictest common denominator across every applicable framework, implemented once. Compliance is not a review at the end. It is enforced at four points.
The frameworks in scope
| Framework | Jurisdiction | Core obligations for this platform |
|---|---|---|
| GDPR (incl. Art. 8, "GDPR-K") | EU / EEA | Lawful basis and consent for children's data (member-state ages 13–16); data minimization; purpose limitation; rights to access, rectification, erasure, portability; DPIAs for high-risk processing; 72-hour breach notification; DPO oversight. |
| COPPA | United States | Verifiable parental consent before collecting data from or about children under 13; plain-language notice; data minimization; retention limits; parental review and deletion rights; no conditioning participation on excess data. |
| CCPA / CPRA | California, US | Consumer rights to know, delete, correct, and opt out of sale/sharing; limits on use of sensitive personal information; heightened rules for minors' data (opt-in for under-16); no dark patterns in consent. |
| PIPEDA | Canada | Meaningful consent for collection, use, and disclosure; safeguards appropriate to sensitivity (children's data = highly sensitive); access and correction rights; breach reporting to the OPC with real-risk-of-significant-harm test. |
| LGPD | Brazil | Specific, highlighted parental consent for children's data; best-interest-of-the-child principle; rights of access, correction, deletion, portability; DPO (encarregado) appointment; ANPD breach notification. |
| POPIA | South Africa | Prohibition on processing children's data without competent-person consent (with narrow exceptions); lawful processing conditions; data-subject rights; Information Regulator notification duties. |
| PDPA | Singapore / Thailand | Consent and purpose limitation; protection of minors' data (Thailand: parental consent under 10, assent frameworks 10–17); breach notification; data-protection officer and localization considerations. |
| APPs (Privacy Act) | Australia | Australian Privacy Principles: open and transparent management, consent for sensitive handling, security safeguards, access/correction rights; Notifiable Data Breaches scheme; Children's Online Privacy Code reforms tracked. |
| PCI-DSS | Global (card networks) | Not in scope at launch — the platform processes no payments. Architecture must not preclude future donation/merchandise flows; any future card data enters via a PCI-validated tokenizing provider, never platform storage. |
| SOC 2 Type II | Assurance (global) | Independent attestation of security, availability, and confidentiality trust criteria over an observation period; target within 18 months of launch, then annual. |
| ISO/IEC 27001 | Assurance (global) | Certified information-security management system; the single control set is cross-walked to Annex A; certification targeted in years 2–3. |
| WCAG 2.1 AA | Accessibility (global) | Perceivable, operable, understandable, robust experiences; automated CI checks plus assistive-technology testing and annual external audit; treated as a launch requirement, not a phase two. |
| OWASP Top 10 / ASVS | Application security (global) | Baseline verification standard for the secure SDLC: injection, broken auth, XSS, CSRF, misconfiguration, vulnerable components, logging/monitoring — enforced as code in every pipeline. |
Baked in, not bolted on: the four enforcement points
1 · Requirements & Stories
Obligations become acceptance criteria: consent-before-persistence, consent age, rights SLAs, retention, accessible notices. A child-data story cannot reach "Ready" without its constraint set attached.
2 · Development Practices
OWASP ASVS standards, golden-path templates, secrets scanning, and AI review of every diff against the story's constraints. AI-generated code is reviewed to the same standard as human code.
3 · Testing Frameworks
Validation is executable: consent-flow E2E tests, rights-request drills each release, axe-core checks in CI, retention audits. Negative security tests on every state-changing endpoint.
4 · Deployment & Promotion Gates
No promotion without green scans, DAST, policy-as-code, signed artifacts with SBOMs, and current DPIAs. In the December freeze, CAB approval with canary and rollback.
The Compliance Traceability Matrix
Every obligation has an enforcement point; every enforcement point traces back to an obligation. Maintained as code, re-verified at each release gate, demonstrated at audit.
| Compliance requirement | Source | In requirements / stories | In code | In tests | Deployment gate |
|---|---|---|---|---|---|
| Verifiable parental consent before child data processing | COPPA GDPR Art. 8 LGPD POPIA | NP-121 AC: consent flow completes before any child-linked persistence, incl. drafts | Consent-gated profile service; immutable hash-chained consent ledger; step-up MFA | E2E: profile creation blocked pre-consent; ledger integrity checks; withdrawal propagation test | DPIA currency check; DPO sign-off for consent-flow changes |
| Data minimization for child profiles | GDPR COPPA PIPEDA PDPA | NP-137 AC: only nickname, age bracket, coarse region collected; UI offers no further fields | Schema-level field allowlist; API contract rejects non-allowlisted fields; no third-party analytics on child flows | Contract tests reject over-collection; UI tests assert absence of prohibited fields | Schema review in CI; data-catalog classification check |
| Right to erasure / deletion | GDPR CCPA/CPRA LGPD PIPEDA | NP-137 AC: export/erasure via self-service rights portal within 30-day SLA | Retention engine with per-record lineage; erasure propagates to backups on aging schedule; deletion verified and logged | Synthetic-identity erasure drill every release, end-to-end incl. backups aging | Rights-flow E2E must pass pre-promotion; retention-engine audit report |
| Encryption in transit & at rest | GDPR Art. 32 ISO 27001 SOC 2 | Global constraint set attached to every story | TLS 1.3 everywhere; AES-256 at rest; field-level encryption of child identifiers with dedicated KMS keys; mTLS service-to-service | Config tests assert encryption policies; CSPM continuous verification | Policy-as-code (OPA) blocks unencrypted resources; SCPs deny non-compliant regions/services |
| Authentication strength (passwords, MFA, sessions) | OWASP ISO 27001 SOC 2 | NP-114 AC: 16-char minimum (AUTH-PASS-016), 90-day rotation, breached-password rejection, enumeration resistance | Argon2id hashing; k-anonymity breach screening; TOTP/passkey MFA; server-side sessions with rotation; rate limiting + credential-stuffing detection | Negative auth tests; brute-force simulation; session-fixation and CSRF tests | SAST/DAST auth-path coverage required; pen-test findings closed pre-peak |
| Injection, XSS & CSRF prevention | OWASP Top 10 | Global constraints: parameterized queries, output encoding, CSRF tokens on state changes | ORM/parameterized data access only; framework-level output encoding; SameSite cookies + CSRF tokens; CSP headers | Negative security tests per endpoint; ZAP DAST on staging; mutation testing on input-handling modules | SAST + DAST green gate; WAF rules verified pre-promotion |
| Upload safety & content moderation (CSAE) | Trust & Safety Legal | NP-137 AC: type/size validation, malware scan, CSAE hash-matching, EXIF stripping | Quarantine-then-scan pipeline; hash-match service integration; metadata stripping; encrypted object storage | Adversarial upload suite (malformed, oversized, polyglot files); moderation recall sampling | Moderation-pipeline health check in promotion; incident runbook verified |
| Accessibility WCAG 2.1 AA | WCAG Legal (multi-jurisdiction) | AC on every UI story: error identification, live regions, keyboard operability, plain-language notices | Semantic HTML standards; design-system components with AA baked in; focus management patterns | axe-core in CI per PR; screen-reader scripts (NVDA/VoiceOver) on critical journeys; annual external audit | Accessibility check suite green; major releases require audit sign-off |
| Breach notification (72-hour GDPR; NDB; LGPD/POPIA/PDPA duties) | GDPR APPs LGPD PIPEDA | Incident-response requirements in ops backlog; Sev-1 definition includes child-data exposure | Centralized security telemetry; SIEM correlation; immutable audit logging; IR playbooks with regulator-clock tracking | Annual breach-simulation game day incl. notification drafting within the clock | IR playbook and escalation tree verified in operational readiness review |
| Regional consent-age & residency rules | GDPR-K PDPA (TH) CCPA/CPRA | NP-121 AC: strictest applicable rule auto-applied by family region | Region-aware consent rules engine; region-pinned writes for residency; rules versioned with effective dates | Parameterized tests across region/age matrix; rules-engine regression on every change | Rules-engine change requires DPO review; legal-change watch feeds backlog |
| No sale/sharing of minors' data; no dark patterns | CCPA/CPRA GDPR | Epic 101/102 scope statements: no advertising identifiers, no behavioral tracking, no third-party analytics on child flows | Architectural absence of ad-tech; consent UX reviewed against dark-pattern checklist; data-sharing requires council approval + aggregation thresholds | Consent-UX pattern tests; network-call allowlist tests on child-facing flows | Third-party script inventory gate; vendor DPA verification |
| Assurance: SOC 2 / ISO 27001 control operation | SOC 2 ISO 27001 NIST CSF | Control requirements expressed as backlog items with owners | Single control set as code, cross-walked to SOC 2 criteria and ISO Annex A; evidence auto-collected from CI, cloud config, IAM reports | Control tests run continuously (policy-as-code); access reviews quarterly | Audit = demonstration of live evidence; exceptions tracked to closure |
✦ How the matrix stays alive. The matrix is structured data beside the policy-as-code libraries. When a regulation changes, the AI assistant drafts the delta, finds every affected story, test, and gate, and opens it for DPO ratification. Compliance drift becomes a pull request, not a project.
See it applied in the Requirements Lab → Open the Development Lab → Back to the Blueprint