> ## Documentation Index
> Fetch the complete documentation index at: https://docs.apinizer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance and Data Protection

> Apinizer platform provides comprehensive features to meet data protection and privacy requirements. Apinizer does not store personal data except for Apinizer Manager users. The platform provides infrastructure to store API traffic, and masking, encryption, and deletion operations can be performed on this data. It offers different retention and deletion methods for data retention. This page describes the data protection, audit, logging, security controls, and compliance features that Apinizer provides for preparation for compliance standards such as GDPR (General Data Protection Regulation), KVKK (Personal Data Protection Law), CCPA (California Consumer Privacy Act), ISO 27001, and SOC 2. Data responsibility lies with the organization using Apinizer.

<Warning>
  **Important Note: Data Responsibility**

  Apinizer does not store personal data except for Apinizer Manager users. The platform provides infrastructure to store API traffic, and masking, encryption, and deletion operations can be performed on this data. However, the responsibility for protecting, storing, and deleting personal data found in API traffic lies with the organization using Apinizer. Organizations should configure data retention and deletion policies according to their own data protection policies and legal requirements.
</Warning>

## Apinizer and Data Management

### Apinizer's Data Retention Approach

<CardGroup cols={2}>
  <Card title="Apinizer Manager Users" icon="users">
    Apinizer Manager user information

    * User information required for platform management
    * Authentication and authorization information
    * User role and permission information
  </Card>

  <Card title="API Traffic Data" icon="route">
    Infrastructure provision for API traffic

    * Infrastructure is provided to store API traffic
    * Masking, encryption, and deletion operations can be performed on data
    * Data retention and deletion policies can be configured
  </Card>
</CardGroup>

<Info>
  Apinizer does not store personal data except for Apinizer Manager users. The platform provides infrastructure to store API traffic, and masking, encryption, and deletion operations can be performed on this data. The responsibility for protecting, storing, and deleting personal data found in API traffic lies with the organization using Apinizer.
</Info>

## Data Protection Features

### Data Masking and Privacy

Apinizer provides comprehensive data masking and privacy features to protect sensitive data in API traffic:

<AccordionGroup>
  <Accordion title="API Proxy Traffic Privacy Settings">
    To protect sensitive data in API traffic:

    * **Data Masking**: Masking of sensitive fields (e.g., hiding credit card numbers except the last 4 digits)
    * **Hashing**: One-way hashing for data protection (creating an irreversible value)
    * **Salt Usage**: Salt value for hashing (adding random data to increase hash security)
    * **Field-based Operations**: Element name and operation definitions (applying specific rules to certain JSON/XML fields)

    **Scanned Fields:**

    * Header, query parameter, and body of message from client
    * Header, query parameter, and body of message going to backend
    * Header and body of message returning from backend
    * Header and body of message returning to client

    <Tip>
      For detailed information, see the [API Proxy Traffic Privacy Settings](/en/develop/api-proxy-configuration/api-traffic-log-settings) page.
    </Tip>
  </Accordion>

  <Accordion title="PII (Personally Identifiable Information) Protection">
    To protect personal information:

    * **Automatic Detection**: Automatic detection of personal information (name, surname, email, phone number, etc.)
    * **PII Masking Policies**: Personal information masking rules (automatic masking application to detected PII data)
    * **Data Minimization**: Collection of only necessary data (principle of data collection limited to purpose)
    * **Sensitive Data Filtering**: Filtering of sensitive data (filtering or blocking certain PII types from traffic)
  </Accordion>

  <Accordion title="Data Encryption">
    Encryption features for data security:

    * **Encryption at Rest**: Encryption in database (encryption of stored data)
    * **Encryption in Transit**: Encryption during transmission (communication security with TLS/SSL)
    * **Field-level Encryption**: Field-based encryption (encryption of certain sensitive fields)
    * **Key Management**: Encryption key management (secure creation, storage, and management of keys)
  </Accordion>
</AccordionGroup>

### Hashing and Salt

When hashing method is used in API Proxy Traffic Privacy Settings:

<CardGroup cols={2}>
  <Card title="Hashing Features" icon="lock">
    * One-way hashing (converting data to an irreversible digest)
    * Irreversible (original data cannot be reached from hashed data)
    * Security enhancement with salt (ensures same data produces different hash values)
    * Secure data storage
  </Card>

  <Card title="Salt Usage" icon="key">
    * Automatic salt generation by Apinizer (unique salt value generated for each hash operation)
    * Secret storage (salt values are stored securely)
    * Hashed data verification (used to verify the accuracy of hashed data)
    * Security enhancement
  </Card>
</CardGroup>

<Info>
  **What is Salt?**

  When hashing method is selected, data is hashed with an algorithm to be stored irreversibly. With salt, the output that would normally be created by selecting a hash algorithm is made different, preventing the hashed value from being found through comparison. This provides protection against "rainbow table" attacks by ensuring that users with the same password have different hash values.
</Info>

## Audit and Logging

### Audit Records

Apinizer provides comprehensive audit records for compliance requirements:

<CardGroup cols={2}>
  <Card title="Token Requests" icon="key">
    * Token requests from authentication module (authentication attempts and results)
    * Token request data (request time, client information)
    * Environment and date filtering (filtering records by specific environment and time range)
    * User and API Proxy based filtering (viewing records belonging to specific user or API Proxy)
  </Card>

  <Card title="Login Records" icon="sign-in-alt">
    * Management console login operations (all login attempts to management interface)
    * User login records (which user logged in when)
    * IP address tracking (recording IP addresses from which login was made)
    * Login status (recording successful/unsuccessful login attempts)
  </Card>

  <Card title="Audit Records" icon="file-lines">
    * Changes made on the system (configuration, policy, user changes)
    * Configuration changes (changes in API Proxy, environment, connection settings)
    * User operations (administrative operations such as user creation, editing, deletion)
    * Operation timestamps (recording when each operation was performed)
  </Card>

  <Card title="Test Console Audit Records" icon="flask">
    * Tests performed from test console (API calls made through test console)
    * Test records (tested API, request and response details)
    * Test results (successful/unsuccessful test results)
    * Test user information (tracking which user performed which tests)
  </Card>
</CardGroup>

### Application Logs

Application records include logs of worker, manager, and cache applications:

<AccordionGroup>
  <Accordion title="Log Features">
    * **Start and End Date**: Time range of log records
    * **Message Content**: Detailed content of log message
    * **Logger Name**: Name of logger that created the log record
    * **Log Type**: Log level and type (ERROR, WARN, INFO, DEBUG, TRACE)
    * **Filtering Parameters**: Advanced filtering options
  </Accordion>

  <Accordion title="Log Levels">
    Log levels can be set by class/package and include the following types:

    * **Error**: Application errors and critical issues
    * **Warn**: Potential issues or unexpected situations
    * **Info**: General flow of application and important events
    * **Debug**: Detailed information for development and debugging
    * **Trace**: Lowest level, very detailed tracking information
    * **Off**: Logging disabled (no log records are kept)

    <Tip>
      Log levels can be set by class/package. This allows defining different log levels for different components.
    </Tip>
  </Accordion>

  <Accordion title="Log Storage">
    * **Application Logs**: 60 minutes retention period (by default)
    * **Automatic Log Cleanup**: Automatic deletion of old logs after specified period
    * **Log Rotation**: Rotation of log files by size or time
    * **Configurable Retention Policies**: Customization of log retention periods
  </Accordion>
</AccordionGroup>

### Log Management

<CardGroup cols={2}>
  <Card title="Log Level Management" icon="slider">
    * Class/package based log level setting (changing log level for specific components)
    * Manager, Gateway Engine, Cache log levels (managing log level of each component separately)
    * Bulk update support (updating log levels of multiple components at once)
    * Dynamic log level change (changing log level while system is running)
  </Card>

  <Card title="Log Filtering" icon="filter">
    * Date range filtering (viewing logs in a specific time period)
    * Log type filtering (showing only logs of certain types like ERROR or WARN)
    * Message content filtering (searching for keywords in log message)
    * Logger name filtering (viewing logs belonging to a specific logger)
  </Card>
</CardGroup>

## Data Storage and Retention

### Data Retention Methods

Apinizer provides different retention and deletion methods for data retention:

<AccordionGroup>
  <Accordion title="API Traffic Logs">
    * **Elasticsearch ILM**: Automatic retention with Index Lifecycle Management (hot, warm, cold, delete phases)
    * **Configurable Retention Periods**: Different retention periods for different log types (e.g., error logs can be stored longer)
    * **Automatic Deletion**: Automatic deletion after specified period (with ILM policies)
    * **Manual Deletion**: Manual deletion operations by user (deleting logs in specific date range)
    * **Index Rollover**: Automatic rollover by index size or time
  </Accordion>

  <Accordion title="Application Logs">
    * **Fixed Retention Period**: 60 minutes retention period (default)
    * **Automatic Cleanup**: Automatic cleanup after specified period
    * **Log Rotation**: Rotation of log files by size or time
    * **Configurable Retention**: Setting retention period according to needs
  </Accordion>

  <Accordion title="Audit Logs">
    * **Configurable Retention**: Configurable retention for audit logs (according to compliance requirements)
    * **Automatic Deletion**: Automatic deletion after specified period
    * **Manual Deletion**: Manual deletion by user
    * **Long-term Retention**: Long-term retention support for legal requirements
  </Accordion>

  <Accordion title="Data Storage Policies">
    * **Flexible Policies**: Different storage policies for different data types (API traffic, audit, application logs)
    * **Time-based Deletion**: Automatic deletion after specified date/period
    * **Manual Deletion**: Manual deletion operations by user
    * **GDPR "Right to be Forgotten" Support**: Data deletion mechanism (deletion of personal data upon request)
  </Accordion>
</AccordionGroup>

<Warning>
  **Data Responsibility**

  The responsibility for protecting, storing, and deleting personal data found in API traffic lies with the organization using Apinizer. Organizations should configure data retention and deletion policies according to their own data protection policies and legal requirements.
</Warning>

## Security Controls

### Access Control

<CardGroup cols={2}>
  <Card title="Authentication" icon="key">
    * **OAuth2 / OIDC**: Standard authentication protocols (industry standard authentication)
    * **JWT Tokens**: JSON Web Token support (secure and verifiable token usage)
    * **Multi-factor Authentication**: Multi-factor authentication support
    * **Session Management**: Secure session management (secure management of user sessions)
  </Card>

  <Card title="Authorization" icon="lock">
    * **Role-based Access Control (RBAC)**: Role-based access control (role-based access control)
    * **API Proxy Based Access Control**: Control at API Proxy level (access permissions to specific API Proxies)
    * **Endpoint Based Access Control**: Control at endpoint level (access permissions to specific endpoints within API Proxy)
    * **ACL (Access Control List) Management**: Access control list management (detailed access control lists)
  </Card>

  <Card title="IP Control" icon="network-wired">
    * **IP Whitelist/Blacklist**: IP address based access control (allowing/blocking requests from specific IP addresses)
    * **X-Forwarded-For Support**: Real IP detection behind proxy (detecting real client IP address behind proxy)
    * **Real IP Detection**: Determining real client IP address (securely determining client's real IP address)
  </Card>

  <Card title="Audit Logging" icon="file-lines">
    * **All Access Records**: Keeping access logs (API calls, administrative access)
    * **Change Records**: Recording configuration changes (all configuration changes in the system)
    * **Operation Records**: Audit record of all operations (important operations performed by users)
    * **Detailed Traceability**: Tracking who did what, when
  </Card>
</CardGroup>

### Data Security

<AccordionGroup>
  <Accordion title="Encryption">
    * **TLS/SSL Encryption (in Transit)**: Encryption during transmission (encryption of data during communication)
    * **Database Encryption (at Rest)**: Encryption in database (encryption of stored data)
    * **Field-level Encryption**: Field-based encryption (special encryption of sensitive fields)
    * **Certificate Management**: Certificate management (management of SSL/TLS certificates)
  </Accordion>

  <Accordion title="Data Integrity">
    * **Message Integrity**: Message integrity check (verification that messages have not been altered)
    * **Digital Signatures**: Digital signature support (guaranteeing data has not been altered with digital signatures)
    * **Hash Verification**: Hash verification (verification of data's hash value)
  </Accordion>

  <Accordion title="Security Monitoring">
    * **Anomaly Detection**: Detection of abnormal behavior (automatic detection of unexpected or suspicious behaviors)
    * **Security Events**: Monitoring of security events (tracking security breaches or challenges in the system)
    * **Intrusion Detection**: Attack detection (detection and alerting of system attacks)
    * **Security Monitoring**: Security monitoring (continuous security monitoring and reporting)
  </Accordion>
</AccordionGroup>

## Compliance Standards and Apinizer Support

## GDPR Compliance

### GDPR Requirements and Apinizer Support

GDPR (General Data Protection Regulation) is the European Union's comprehensive regulation for the protection and processing of personal data. Apinizer provides the following features to meet GDPR requirements:

<AccordionGroup>
  <Accordion title="Data Minimization (Article 5.1.c)">
    **GDPR Requirement**: Collection and processing of only necessary data.

    **Apinizer Support**:

    * **API Proxy Traffic Privacy Settings**: Protection of sensitive data with masking or hashing
    * **Data Filtering**: Removal of certain fields from logs
    * **Configurable Logging**: Configuration to log only necessary data
    * **PII Detection**: Automatic detection and protection of personal information

    **How to Use**: Define sensitive fields in API Proxy Traffic Privacy Settings to ensure these fields are protected with masking or hashing in logs.
  </Accordion>

  <Accordion title="Right to be Forgotten (Article 17)">
    **GDPR Requirement**: Deletion of personal data upon request.

    **Apinizer Support**:

    * **Elasticsearch ILM**: Automatic data deletion policies
    * **Manual Data Deletion**: Manual deletion of data in specific date range
    * **Data Storage Policies**: Configurable retention periods
    * **Data Cleanup Tasks**: Automatic data cleanup tasks

    **How to Use**: Configure Elasticsearch ILM policies to automatically delete data after specified period. For manual deletion, you can delete data in specific date range through Analytics Engine.
  </Accordion>

  <Accordion title="Right to Data Portability (Article 20)">
    **GDPR Requirement**: Export of personal data in standard formats.

    **Apinizer Support**:

    * **Data Export**: Export of API traffic logs
    * **Standard Formats**: Export in standard formats like JSON, CSV
    * **Filtering and Querying**: Data export according to specific criteria
    * **Analytics Engine**: Data viewing and export tools

    **How to Use**: Filter according to specific criteria through Analytics Engine and export data. Export operation can be done in JSON or CSV format.
  </Accordion>

  <Accordion title="Data Protection (Article 32)">
    **GDPR Requirement**: Protection of personal data with technical and organizational measures.

    **Apinizer Support**:

    * **Data Encryption**: Encryption at Rest and in Transit
    * **Data Masking**: Protection of sensitive data with masking
    * **PII Protection**: Automatic detection and protection of personal information
    * **Access Control**: Access control with RBAC and ACL

    **How to Use**: Define sensitive fields in API Proxy Traffic Privacy Settings. Protect data transmission using TLS/SSL encryption. Configure access control with RBAC and ACL.
  </Accordion>

  <Accordion title="Accountability (Article 5.2)">
    **GDPR Requirement**: Recording and traceability of data processing activities.

    **Apinizer Support**:

    * **Comprehensive Audit Logging**: Recording of all system changes
    * **Access Records**: Recording of API calls and administrative access
    * **Change Tracking**: Tracking of configuration changes
    * **Timestamped Records**: Recording of each operation with timestamp

    **How to Use**: Regularly review audit records. Track all changes on the system by tracking change records.
  </Accordion>

  <Accordion title="Data Breach Notification (Article 33-34)">
    **GDPR Requirement**: Notification within 72 hours in case of data breach.

    **Apinizer Support**:

    * **Security Event Monitoring**: Automatic detection of security events
    * **Alarms and Notifications**: Automatic alarm and notification for security events
    * **Anomaly Detection**: Detection of abnormal behaviors
    * **Log Analysis**: Detection of security events through log analysis

    **How to Use**: Configure anomaly detection and alarms in Monitoring Component. Configure alarm channels to receive automatic notifications for security events.
  </Accordion>
</AccordionGroup>

## KVKK Compliance

### KVKK Requirements and Apinizer Support

KVKK (Personal Data Protection Law) is Turkey's legal regulation for the processing and protection of personal data. Apinizer provides the following features to meet KVKK requirements:

<AccordionGroup>
  <Accordion title="Explicit Consent (Article 5)">
    **KVKK Requirement**: Obtaining explicit consent for processing personal data and keeping consent records.

    **Apinizer Support**:

    * **Audit Records**: Recording of all user operations
    * **Token Requests**: Recording of authentication and authorization operations
    * **API Traffic Logs**: Recording of API calls (for tracking consent status)
    * **Timestamped Records**: Recording of consent given time

    **How to Use**: Track consent status in API traffic logs. Monitor user operations in audit records. Record authentication operations in token requests.
  </Accordion>

  <Accordion title="Obligation to Inform (Article 10)">
    **KVKK Requirement**: Informing data subject about data processing.

    **Apinizer Support**:

    * **API Documentation**: Information about API usage
    * **Data Processing Records**: Recording of data processing activities
    * **Log Viewing**: Data subject viewing their own data
    * **Data Export**: Data subject exporting their own data

    **How to Use**: Keep API documentation up to date in API Portal. Enable data subjects to view and export their own data through Analytics Engine.
  </Accordion>

  <Accordion title="Data Security (Article 12)">
    **KVKK Requirement**: Protection of personal data with technical and administrative measures.

    **Apinizer Support**:

    * **Technical Measures**: Encryption, masking, access control
    * **Administrative Measures**: RBAC, ACL, audit logging
    * **Security Tests**: Security tests and evaluations
    * **Security Monitoring**: Continuous security monitoring and reporting

    **How to Use**: Protect sensitive data in API Proxy Traffic Privacy Settings. Configure access control with RBAC and ACL. Activate security monitoring and alarm systems.
  </Accordion>

  <Accordion title="Data Subject Rights (Article 11)">
    **KVKK Requirement**: Data subject's rights to access, correct, delete, and object.

    **Apinizer Support**:

    * **Right to Access**: Data subject viewing their own data (Analytics Engine)
    * **Right to Correction**: Correction of incorrect data (manual data correction)
    * **Right to Deletion**: Data deletion mechanism (ILM and manual deletion)
    * **Right to Object**: Right to object to data processing (stopping data processing)

    **How to Use**: Enable data subjects to view their own data through Analytics Engine. Use ILM policies for data deletion requests or perform manual deletion.
  </Accordion>
</AccordionGroup>

## CCPA Compliance

### CCPA Requirements and Apinizer Support

CCPA (California Consumer Privacy Act) is California's consumer privacy law. Apinizer provides the following features to meet CCPA requirements:

<AccordionGroup>
  <Accordion title="Consumer Rights">
    **CCPA Requirement**: Consumers' rights to access, delete, and opt-out of sale.

    **Apinizer Support**:

    * **Right to Access**: Data subject viewing their own data (Analytics Engine)
    * **Right to Deletion**: Data deletion mechanism (ILM and manual deletion)
    * **Right to Opt-out of Sale**: Right to object to data sale (stopping data processing)
    * **Data Export**: Data subject exporting their own data

    **How to Use**: Enable data subjects to view and export their own data through Analytics Engine. Use ILM policies for data deletion requests.
  </Accordion>

  <Accordion title="Transparency">
    **CCPA Requirement**: Transparency about data collection and usage.

    **Apinizer Support**:

    * **Data Collection Descriptions**: API documentation and terms of use
    * **Data Usage Information**: Recording of data processing activities
    * **Third-party Sharing**: Recording of data sharing
    * **Log Viewing**: Data subject viewing their own data

    **How to Use**: Provide descriptions about data collection and usage in API Portal. Enable data subjects to view their own data through Analytics Engine.
  </Accordion>

  <Accordion title="Data Protection">
    **CCPA Requirement**: Secure protection of consumer data.

    **Apinizer Support**:

    * **Secure Data Processing**: Encryption, masking, access control
    * **Data Encryption**: Encryption at Rest and in Transit
    * **Access Control**: Access control with RBAC and ACL
    * **Security Monitoring**: Continuous security monitoring and reporting

    **How to Use**: Protect sensitive data in API Proxy Traffic Privacy Settings. Protect data transmission using TLS/SSL encryption. Configure access control with RBAC and ACL.
  </Accordion>

  <Accordion title="Audit">
    **CCPA Requirement**: Recording of data processing activities.

    **Apinizer Support**:

    * **Data Processing Records**: Recording of all data processing activities
    * **Access Logs**: Keeping access logs
    * **Change Tracking**: Tracking of changes
    * **Timestamped Records**: Recording of each operation with timestamp

    **How to Use**: Regularly review audit records. Track all changes on the system by tracking change records.
  </Accordion>
</AccordionGroup>

## ISO 27001 Preparation

### ISO 27001 Controls and Apinizer Support

ISO 27001 is the information security management system standard. Apinizer provides the following features to meet ISO 27001 controls:

<AccordionGroup>
  <Accordion title="Information Security Policies (A.5.1)">
    **ISO 27001 Requirement**: Creation and documentation of information security policies.

    **Apinizer Support**:

    * **Security Policies**: Security policies at API Proxy level
    * **Access Control Policies**: Access control with RBAC and ACL
    * **Data Protection Policies**: Data masking and encryption policies
    * **Documentation**: Documentation of all policies

    **How to Use**: Define security policies in API Proxies. Configure access control policies with RBAC and ACL. Define data protection policies in API Proxy Traffic Privacy Settings.
  </Accordion>

  <Accordion title="Access Control (A.9)">
    **ISO 27001 Requirement**: Control of access to information and information processing resources.

    **Apinizer Support**:

    * **Authentication**: OAuth2, OIDC, JWT token support
    * **Authorization**: RBAC, API Proxy based, Endpoint based access control
    * **ACL Management**: Detailed access control lists
    * **IP Control**: IP whitelist/blacklist support

    **How to Use**: Configure authentication in Identity Manager. Define authorization policies with RBAC and ACL. Configure whitelist/blacklist for IP control.
  </Accordion>

  <Accordion title="Cryptography (A.10)">
    **ISO 27001 Requirement**: Implementation of cryptographic controls.

    **Apinizer Support**:

    * **Encryption**: Encryption at Rest and in Transit
    * **TLS/SSL**: Encryption during transmission
    * **Field-level Encryption**: Field-based encryption
    * **Key Management**: Encryption key management

    **How to Use**: Configure TLS/SSL certificates. Activate database encryption. Use field-level encryption for sensitive fields.
  </Accordion>

  <Accordion title="Information Security Incident Management (A.16)">
    **ISO 27001 Requirement**: Management and reporting of information security incidents.

    **Apinizer Support**:

    * **Security Event Monitoring**: Automatic detection of security events
    * **Alarms and Notifications**: Automatic alarm and notification for security events
    * **Anomaly Detection**: Detection of abnormal behaviors
    * **Incident Reporting**: Reporting of security events

    **How to Use**: Configure anomaly detection and alarms in Monitoring Component. Configure alarm channels to receive automatic notifications for security events.
  </Accordion>

  <Accordion title="Operations Security (A.12)">
    **ISO 27001 Requirement**: Secure management of operating systems.

    **Apinizer Support**:

    * **Log Management**: Comprehensive log management and storage
    * **Security Monitoring**: Continuous security monitoring
    * **Backup**: Data backup and recovery
    * **Change Management**: Management of configuration changes

    **How to Use**: Configure log management policies. Activate security monitoring systems. Perform regular backups.
  </Accordion>

  <Accordion title="Compliance (A.18)">
    **ISO 27001 Requirement**: Compliance with legal and regulatory requirements.

    **Apinizer Support**:

    * **Audit Records**: Comprehensive audit records
    * **Data Protection**: Data masking and encryption
    * **Data Retention**: Configurable data storage policies
    * **Compliance Reporting**: Creation of compliance reports

    **How to Use**: Regularly review audit records. Configure data protection policies. Set data retention policies according to legal requirements.
  </Accordion>
</AccordionGroup>

## SOC 2 Preparation

### SOC 2 Trust Principles and Apinizer Support

SOC 2 (Service Organization Control 2) is an audit standard based on security, availability, processing integrity, confidentiality, and privacy principles. Apinizer provides the following features to meet SOC 2 requirements:

<AccordionGroup>
  <Accordion title="Security">
    **SOC 2 Requirement**: Protection of system resources against unauthorized access.

    **Apinizer Support**:

    * **Access Control**: Access control with RBAC, ACL, IP control
    * **Authentication**: OAuth2, OIDC, JWT token support
    * **Encryption**: Encryption at Rest and in Transit
    * **Security Monitoring**: Continuous security monitoring and alarms

    **How to Use**: Configure authentication in Identity Manager. Define authorization policies with RBAC and ACL. Activate security monitoring systems.
  </Accordion>

  <Accordion title="Availability">
    **SOC 2 Requirement**: Ensuring system availability.

    **Apinizer Support**:

    * **High Availability**: Horizontal scaling and load balancing
    * **Failover**: Automatic failover mechanism
    * **Monitoring**: System performance monitoring
    * **Backup and Recovery**: Data backup and recovery

    **How to Use**: Configure horizontal scaling. Activate failover mechanisms. Monitor system performance.
  </Accordion>

  <Accordion title="Processing Integrity">
    **SOC 2 Requirement**: System operations being performed correctly and completely.

    **Apinizer Support**:

    * **Data Accuracy**: Message integrity check
    * **Operation Verification**: Verification of operations
    * **Error Management**: Error management mechanisms
    * **Audit Logging**: Recording of all operations

    **How to Use**: Activate message integrity check. Configure error management policies. Activate audit logging.
  </Accordion>

  <Accordion title="Confidentiality">
    **SOC 2 Requirement**: Protection of confidential information.

    **Apinizer Support**:

    * **Data Encryption**: Encryption at Rest and in Transit
    * **Data Masking**: Masking of sensitive data
    * **Access Control**: Access control with RBAC and ACL
    * **Security Monitoring**: Detection of confidentiality breaches

    **How to Use**: Protect sensitive data in API Proxy Traffic Privacy Settings. Use TLS/SSL encryption. Configure access control.
  </Accordion>

  <Accordion title="Privacy">
    **SOC 2 Requirement**: Protection of personal information and respect for privacy rights.

    **Apinizer Support**:

    * **Personal Information Protection**: PII protection and masking
    * **Data Storage Policies**: Configurable data storage
    * **Data Deletion**: Automatic and manual data deletion
    * **Privacy Monitoring**: Detection of privacy breaches

    **How to Use**: Define PII protection policies in API Proxy Traffic Privacy Settings. Configure data retention policies. Activate data deletion mechanisms.
  </Accordion>
</AccordionGroup>

## Compliance Checklist

### GDPR Checklist

<AccordionGroup>
  <Accordion title="Data Protection">
    * [ ] Data encryption active (TLS/SSL, Encryption at Rest)
    * [ ] Data masking configured (API Proxy Traffic Privacy Settings)
    * [ ] PII protection policies defined
    * [ ] Data retention periods determined (Elasticsearch ILM)
  </Accordion>

  <Accordion title="Audit">
    * [ ] Audit logging active
    * [ ] Access records being kept
    * [ ] Change records being kept
    * [ ] Log retention policies defined
  </Accordion>

  <Accordion title="Rights">
    * [ ] Data access mechanism available (Analytics Engine)
    * [ ] Data deletion mechanism available (ILM, manual deletion)
    * [ ] Data correction mechanism available
    * [ ] Data portability support available (Export)
  </Accordion>
</AccordionGroup>

### ISO 27001 Checklist

<CardGroup cols={2}>
  <Card title="Security Controls" icon="check-circle">
    * [ ] Access control configured (RBAC, ACL)
    * [ ] Encryption active (TLS/SSL, Encryption at Rest)
    * [ ] Security monitoring configured (Anomaly detection, Alarms)
    * [ ] Incident management procedures available
  </Card>

  <Card title="Documentation" icon="file-lines">
    * [ ] Security policies documented
    * [ ] Procedures defined
    * [ ] Risk assessment performed
  </Card>
</CardGroup>

## Best Practices

<CardGroup cols={2}>
  <Card title="Data Minimization" icon="compress">
    * Collect only necessary data
    * Limit data retention periods
    * Delete unused data
    * Clarify data collection purpose
  </Card>

  <Card title="Security" icon="shield">
    * Use strong encryption (TLS 1.3, strong algorithms)
    * Perform regular security updates
    * Keep access control strict (RBAC, ACL)
    * Perform security tests regularly
  </Card>

  <Card title="Audit" icon="file-lines">
    * Log all operations
    * Regularly review logs
    * Perform anomaly detection
    * Store audit records
  </Card>

  <Card title="Training" icon="graduation-cap">
    * Train personnel
    * Create security awareness
    * Organize regular training
    * Share compliance requirements
  </Card>
</CardGroup>

## Next Steps

<CardGroup cols={2}>
  <Card title="Audit" icon="file-lines" href="/en/admin/audit-compliance/overview">
    Review audit records
  </Card>

  <Card title="Application Logs" icon="file-lines" href="/en/develop/monitoring-analysis/application-logs">
    Manage application logs
  </Card>

  <Card title="API Proxy Traffic Privacy Settings" icon="eye-slash" href="/en/develop/api-proxy-configuration/api-traffic-log-settings">
    Configure traffic privacy settings
  </Card>

  <Card title="Security Management" icon="shield" href="/en/admin/secrets-management/overview">
    Configure security settings
  </Card>
</CardGroup>