Compliance & Control Register — OracleAppsGuide.com
Version: 2.0 · Effective 2026-10-29 · Published at
https://oracleappsguide.com/docs/COMPLIANCE.md.
1. Position statement
OAG implements security controls aligned with recognised frameworks. OAG does not currently hold a third-party certification for SOC 2, ISO 27001, or HIPAA. Public copy must never describe OAG as "certified", "fully compliant", or "audited" against those frameworks.
| Framework | Status | Meaning |
|---|---|---|
| SOC 2 | Aligned | Controls are designed against SOC 2 trust-service criteria; no attestation report exists |
| ISO 27001 | Aligned | Controls follow the Annex A control families; no certificate exists |
| GDPR | Ready | Data-processing addendum, residency, deletion, and breach-notification paths are in place |
| DPDP Act 2023 (India) | Ready | Consent, deletion, and grievance paths are in place |
| SOX (customer-side) | Supported | Immutable audit trail and human approval boundaries support customer SOX controls |
2. Control register
| # | Control | Implementation |
|---|---|---|
| 1 | Tenant isolation | Every private read filters on the authenticated workspaceId; workspaceId = user_{uid} |
| 2 | Encryption at rest | AES-256-GCM field-level encryption for credentials and sensitive log fields |
| 3 | Encryption in transit | TLS with HSTS preload; strict transport security headers |
| 4 | Identity | Server-side principal resolution; canonical roles user and admin only |
| 5 | Admin access | Single named administrator; role alone never grants admin access |
| 6 | CSRF | Double-submit token with a single canonical cookie name across middleware and validators |
| 7 | Content security | Nonce-based script policy on public surfaces; frame and object restrictions |
| 8 | Rate limiting | Edge rate limiting on all AI routes; never bypassed in production |
| 9 | Write governance | Human-in-the-loop approval with risk scoring before any ERP write |
| 10 | Data redaction | redactSensitiveData() before chunking and embedding |
| 11 | Secret management | Secrets held in a managed secret store; pre-commit scanning blocks commits |
| 12 | Supply chain | Pinned dependency versions; non-root containers; container capability drop |
| 13 | Audit trail | Append-only execution log with hash chaining |
| 14 | Backup & recovery | RPO ≤ 24h, RTO ≤ 4h (see SLA) |
| 15 | Vulnerability intake | Dependency and static analysis gates in the release pipeline |
3. Data handling summary
| Data class | Where it lives | Retention |
|---|---|---|
| Account and workspace metadata | OAG Cloud Backend | Life of account |
| Knowledge documents and chunks | OAG Cloud Backend | Until workspace deletion |
| Execution logs | OAG Cloud Backend | 7 years |
| ERP credentials | Encrypted vault, never in plaintext | Until connection deletion |
| Model provider keys | Encrypted vault (Pure BYOK) | Until key removal |
| Edge rate-limit state | Ephemeral edge store, 1-hour TTL | 1 hour |
4. Billing and data-processing posture
Pure BYOK: the customer supplies their own model provider key and pays that provider directly. OAG does not meter tokens, does not sell credits, and does not apply per-user AI rate limits. Consequently OAG never needs to retain prompt content for billing purposes.
5. Open items (honest disclosure)
- No third-party SOC 2 or ISO 27001 attestation exists.
- Live Oracle EBS certification is environment-dependent; customer instances are certified during onboarding, not in advance.
- Business-continuity drills are scheduled, not yet continuous.
6. Contact
security@oracleappsguide.com or /support.