Compliance postures

Compliance regimes (HIPAA, PCI-DSS, GDPR, SOC 2, DORA, NIS 2, CRA, etc.) overlap heavily — they share retention floors, encryption floors, audit floors, breach-notification windows. blamejs collapses the overlap into a **union-of-bars** strategy: pick every regime that applies, and the framework computes the strictest setting that satisfies all of them.

Setting a posture #

b.compliance.set({ postures: ["hipaa", "pci-dss", "gdpr", "soc2"] }). The call cascades into every framework primitive that exposes a posture-aware default: retention floors, audit signing requirements, password complexity, session lifetimes, log redaction, mTLS profiles, TLS minimums.

Conflict resolution #

When two postures disagree, the strictest setting wins. SOC 2's 1-year audit-retention floor is shorter than HIPAA's 6-year, so joint posture takes 6 years. Documented exceptions list the specific cases where strictest-wins doesn't apply.

Reading the resolved posture #

b.compliance.current() returns the resolved bundle: { active: ["hipaa","pci-dss"], retentionFloorDays: 2190, auditSigningRequired: true, … }. Every primitive reads this at boot to compute its tightened defaults. Operators inspect the resolved bundle to confirm the cascade matches expectations.

Last updated 2026-08-08T16:39:49.652Z by seeder.