Compliance Controls Overview
LLM-Shield-Proxy provides technical controls (in-VPC inspection, PII redaction, cryptographic audit logs) that support compliance programs. Deploying this proxy does not automatically make your organization compliant. You must pair these technical controls with appropriate organizational policies, secure infrastructure, and independent audits.
Evidence Capabilities
| Evidence Feature | What It Proves | What It Does Not Prove |
|---|---|---|
| Zero-Egress Conformance | Protected test fixtures are redacted before leaving the proxy. | Universal detection of all possible PII formats. |
| Hash-Chained Audit Logs | Supplied logs have not been reordered, modified, or silently dropped in the middle. | Logs were safely stored (requires external WORM storage). |
| Ed25519 Signatures | Logs were generated by a proxy holding the specific private key. | The key was securely managed or rotated correctly. |
| OSCAL 1.2 Exports | Machine-readable security assessments were generated. | The underlying security controls are actually effective. |
Framework Mappings
- SOC 2: Supports access control, boundary protection, logging, and monitoring criteria.
- HIPAA: Supports technical safeguards for transmission security and integrity controls. Covered entities must still perform their own risk analysis.
- GDPR: Supports Data Minimization and Privacy-by-Design principles. Lawful basis and data subject rights remain organizational responsibilities.
- EU AI Act: Supports human-in-the-loop policy enforcement and risk management logging.
Audit Log Durability
The default best_effort mode logs to stdout. If the internal queue fills, it will drop audit logs to prioritize request latency.
For compliance, you must configure durable or required modes. These modes write logs to a local JSONL file, flush to disk, and guarantee the hash chain survives proxy restarts. You must configure an external log shipper (like Fluentd) to move these local files to immutable (WORM) storage (like AWS S3 Object Lock) to achieve true non-repudiation.
Representation
Accurate: "We use LLM-Shield-Proxy to enforce technical privacy controls and generate verifiable audit evidence for our SOC 2 program."
Inaccurate: "Our LLM deployment is SOC 2 compliant because we use LLM-Shield-Proxy."