Security Shield & compliance

How the Security Shield supports GDPR, SOC 2, and enterprise audit requirements.

Immutable audit trail

The security_events table is write-once by design. A database trigger raises an exception on any UPDATE or DELETE attempt, even from superuser queries. This produces a tamper-proof log of every security event, including the threat type, score, action, hashed prompt, model used, and client IP.

Prompt hashing

The shield stores a SHA-256 hash of the prompt, not the prompt itself. This lets you verify an event is associated with a specific request without storing the raw prompt content, reducing your GDPR data retention footprint.

GDPR

- PII detection: The shield flags emails, phone numbers, IBANs, and tax identifiers before they reach the LLM. In block mode, this prevents personal data from being sent to third-party model providers. - Retention: Each workspace can configure a retention_days field in its security config. A scheduled job automatically purges events older than that window. Default: 90 days. - Data minimization: Only the SHA-256 prompt hash is stored, not the full prompt text.

SOC 2 Type II

The Security Shield maps to multiple SOC 2 controls: - CC6.1 (Logical Access Controls), IP allowlist enforcement - CC6.6 (Logical Access Boundaries), prompt injection blocking prevents unauthorized instruction override - CC7.2 (System Monitoring), SIEM webhook integration for continuous monitoring - CC7.4 (Incident Response), security_events provides the evidence trail for incident reconstruction

Event export

Export security events for any date range as JSON or CSV from Dashboard → Guardian → Security Shield → Export, or via the API:

curl "https://app.hiway2llm.com/api/v1/workspaces/WS_ID/security/export?fmt=csv&days=30" \
  -H "Authorization: Bearer hw_live_YOUR_KEY" \
  -o security_events_30d.csv

Retention configuration

curl -X POST https://app.hiway2llm.com/api/v1/workspaces/WS_ID/security/config \
  -H "Authorization: Bearer hw_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"mode": "block", "threshold": 0.85, "retention_days": 30}'