Database

PostgreSQL / Supabase SQL Server Oracle + EDB

Account

Available for PostgreSQL

Compliance evidence, produced on your own infrastructure.

Standard pgTAP tests and dated, reproducible reports. Evidence you can hand an auditor, produced inside your perimeter.

HIPAA Access Control, 45 CFR 164.312(a)(1), with per-routine evidence
HIPAA Audit controls and Integrity, 164.312(b) and (c)(1), per table
HIPAA Evaluation, 164.308(a)(8), run continuously
SOC 2 CC6.1 and CC6.3, logical and role-based access
SOC 2 C1 where the data is confidential

How to do it

Enterprise. Each run produces dated, reproducible reports you keep as evidence.

Connect with DATABASE_URL or the PG* variables, licence in place.
Run the security-coverage pass:

unitautogen seccover --schema public --out sec_out --sec-html sec.html --sec-json sec.json

Add --pii to also audit personal data leaked through error and RAISE messages.
For HIPAA, run the evidence report. It adds the audit-log check and maps every result to the Security Rule.

export DATABASE_URL=postgresql://user:pass@host:5432/mydb
unitautogen hipaa --schema public

Archive the dated reports from each run; together they show the controls operating across the audit period.

What it is, and is not

Reports dated per run, so controls are shown operating across the audit period
No telemetry, so schema and data never leave your machine
Supporting evidence for your auditors, framed as a tool
Not a certification, not an audit service

See seccover See HIPAA evidence See the engine Get in touch

What platforms suggest

Enforcing access controls and testing them is what the platforms document.

Supabase documents Row Level Security as the access control for your data. UnitAutogen turns proof of it into dated evidence. Supabase, Row Level Security →
Supabase encourages automated pgTAP tests of your policies. UnitAutogen emits standard pgTAP with dated reports. Supabase, Testing your database →
PostgreSQL documents RLS policies per command and role. seccover proves they hold through the code. PostgreSQL, Row Security Policies →