Available for PostgreSQL
Compliance evidence, produced on your own infrastructure.
Standard pgTAP tests and dated, reproducible reports. Evidence you can hand an auditor, produced inside your perimeter.
- HIPAA Access Control, 45 CFR 164.312(a)(1), with per-routine evidence
- HIPAA Evaluation, 164.308(a)(8), run continuously
- SOC 2 CC6.1 and CC6.3, logical and role-based access
- SOC 2 C1 where the data is confidential
How to do it
Enterprise. Each run produces dated, reproducible reports you keep as evidence.
- Connect with
UNITAUTOGEN_DSN or the PG* variables, licence in place.
- Run the security-coverage pass:
unitautogen seccover --schema public --out sec_out --sec-html sec.html --sec-json sec.json
- Add
--pii to also audit personal data leaked through error and RAISE messages.
- Archive the dated
sec.html and sec.json from each run; together they show the controls operating across the audit period.
What it is, and is not
- Reports dated per run, so controls are shown operating across the audit period
- No telemetry, so schema and data never leave your machine
- Supporting evidence for your auditors, framed as a tool
- Not a certification, not an audit service
What platforms suggest
Enforcing access controls and testing them is what the platforms document.
