Skip to main content

Security & Compliance Considerations

Logging and Auditability​

Comprehensive logging supports both operational needs and compliance requirements:

  • Event logs — Every detection event is logged with a timestamp, policy identifier, confidence score, action taken, and content hash (not raw content, unless configured).
  • Policy change audit trail — All changes to policy configurations (activation, deactivation, applying/unapplying a policy to applications, threshold adjustments, keyword updates) are logged with the user identity and timestamp. Per-application changes name the specific applications that were toggled on or off.
  • Workflow execution logs — Every workflow trigger is recorded, including conditions matched, actions taken, and delivery status of webhooks.
  • Retention controls — Configure log retention periods to align with your organization's data governance policies and regulatory requirements.

Alignment with Enterprise Compliance Frameworks​

WonderFence's policy catalog and reporting capabilities are designed to support alignment with major AI governance and security frameworks:

  • OWASP LLM Top 10 — Policies map to the OWASP Top 10 for LLM Applications, providing coverage for the most critical risks identified by the security community. Risk indicators on each policy card show the relevant OWASP categories.
  • MITRE ATLAS — Policies map to the MITRE ATLAS framework for adversarial threats to AI systems, supporting organizations that adopt threat-informed defense strategies.
  • SOC 2 — Logging, access controls, and audit trails support SOC 2 compliance requirements for security, availability, and confidentiality.
  • GDPR and data-protection regulations — Data minimization, encryption, data residency controls, and PII redaction capabilities support compliance with GDPR and similar frameworks.
  • Industry-specific regulations — Custom policies allow organizations to enforce compliance with sector-specific requirements (e.g., financial services regulations, healthcare privacy rules, advertising standards).