Meridian provides automated compliance assessments and recommendations, not legal advice. Final compliance determinations should be reviewed by qualified legal, compliance, or security professionals where required.
Executive Summary
Applicable Controls
401
Controls determined to apply to this repository
Implemented
6
Requires Documentation
132
Requires Operational Evidence
12
Code Improvement Recommended
251
Repository Overview
In ProductionTrue
Technology Stack
1051 files · 197808 lines
Languagesjavascript, python, tsx, typescript
FrameworksFastAPI, Next.js, React, Starlette
Data & InfrastructureRedis, SQL (via SQLAlchemy)
CI/CD & IaCDocker, Docker Compose, GitHub Actions
Business Signals
Stores personal dataTrue
Uses AITrue
Primary jurisdictionUnited States
Processes paymentsTrue
Regulated financial entityFalse
What Meridian Understood
This repository primarily focuses on AI capabilities using both language models and vector databases, integrated into a web application or service. The backend is primarily implemented using FastAPI and Starlette, with a front-end utilizing React and Next.js technologies. The application uses Docker for containerization and GitHub Actions for continuous integration and deployment.
Architecture: AI-driven web application
Compliance Scope
Applicable Regulations
EU AI ActAI Governance & Responsible AI
Your repository deploys AI models or AI-powered systems.
Required: matched on ai_usage.
PCI DSSPayments & Financial Security
Your application processes payments or handles cardholder data.
Required: matched on processes_payments.
SOC 2 Trust Services CriteriaTrust & Assurance
Your application is in production and handles customer data requiring independent assurance.
Optional: base condition met, but no additional signal beyond production.
Not Applicable Regulations
DPDPA 2023Privacy & Data Protection
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
DPDPA Rules, 2025Privacy & Data Protection
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
GDPRPrivacy & Data Protection
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
RBI FREE-AI FrameworkAI Governance & Responsible AI
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
SEBI AI/ML GuidelinesAI Governance & Responsible AI
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Digital Payment Security ControlsPayments & Financial Security
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI IT Governance & Risk ControlsCybersecurity & Operational Security
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI NBFC IT FrameworkFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI NBFC Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Payments Banks Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Small Finance Banks Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
SEBI Cybersecurity FrameworkCybersecurity & Operational Security
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
CERT-In DirectionsCybersecurity & Operational Security
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
Compliance Readiness
Implemented
Authentication
Cross Border Transfer Controls
Data Classification
Data Lifecycle Management
Code Improvement Recommended
Access Control
Audit Logging
Consent Management
Data Retention
Encryption At Rest
Encryption In Transit
Key Management
Requires Documentation
Asset Inventory
Backup And Recovery
Business Impact Analysis
Configuration Management
Data Deletion
Data Masking
Data Protection Impact Assessment
Data Subject Request Handling
Grievance Redressal
Incident Response Plan
Information Security Policy
Log Retention
Policy Management
Privacy Impact Assessment
Records Of Processing
Requires Operational Evidence
AI Risk Assessment
Access Review
BCP And DR Testing
Bias Detection
Change Management
Data Loss Prevention
Data Quality Management
Governance Framework
Incident Detection
Maker Checker
Model Monitoring
Model Testing
Patch Management
Penetration Testing
Physical Access Control
Privileged Access Management
Regulatory Change Monitoring
Regulatory Reporting
SOC Operations
Security Awareness Training
Third Party Risk Assessment
Vendor Contract Management
Vulnerability Scanning
Enterprise Readiness
Detected
Authentication
Recommended Improvements
Access Control
Audit Logging
Encryption At Rest
Encryption In Transit
Key Management
Data Retention
Operational Requirements
Privileged Access Management
BCP And DR Testing
Penetration Testing
Third Party Risk Assessment
Vendor Contract Management
Security Awareness Training
Documentation Required
Incident Response Plan
Information Security Policy
SOC 2 Scope
The subset of the capabilities above that SOC 2's own controls actually reach.
Detected
Authentication
Recommended Improvements
Access Control
Audit Logging
Encryption At Rest
Encryption In Transit
Key Management
Data Retention
Operational Requirements
Privileged Access Management
BCP And DR Testing
Penetration Testing
Third Party Risk Assessment
Vendor Contract Management
Security Awareness Training
Documentation Required
Incident Response Plan
AI Governance
Critical AI Findings
23
AI frameworksOpenAI SDK, LiteLLM, LangChain, CrewAI, LlamaIndex, AutoGen
AI infrastructureOllama
Vector databasesChromaDB, Weaviate, Milvus, Qdrant, FAISS
Notebooks7
AI regulations evaluatedEU Artificial Intelligence Act
Not mapped (no real control data available): ISO_42001, NIST_AI_RMF, OECD_AI_PRINCIPLES
Deployment Profile
Agentic / multi-agent workflowsHosted LLM usageLocal/self-hosted model servingVector database
AI Governance Posture
Replaces a bare AI maturity score with the actual capabilities checked.
Requires Operational Processes
Governance Framework
AI Risk Assessment
Model Monitoring
Model Testing
Bias Detection
Maker Checker
Penetration Testing
Code Improvement Recommended
Audit Logging
Top Priorities
- Access Control (CRITICAL) — Can the organization (as a third-country provider) demonstrate that it has appointed an authorised representative in the Union and that the representative fulfils all required tasks?
Improves compliance posture for: EU AI Act, PCI DSS, SOC 2 Trust Services Criteria.
- Authentication (CRITICAL) — Can the multi-tenant service provider demonstrate logical separation between provider and customer environments with authorization controls?
Improves compliance posture for: PCI DSS, SOC 2 Trust Services Criteria.
- Encryption In Transit (CRITICAL) — Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?
Improves compliance posture for: PCI DSS, SOC 2 Trust Services Criteria.
- Encryption At Rest (CRITICAL) — Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?
Improves compliance posture for: PCI DSS, SOC 2 Trust Services Criteria.
- Key Management (CRITICAL) — Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?
Improves compliance posture for: PCI DSS, SOC 2 Trust Services Criteria.
Full breakdown by effort below.
Recommended Actions
Quick Wins
- Access Control (CRITICAL)Can the organization (as a third-country provider) demonstrate that it has appointed an authorised representative in the Union and that the representative fulfils all required tasks?Improves compliance posture for: EU AI Act, PCI DSS, SOC 2 Trust Services Criteria.
- Authentication (CRITICAL)Can the multi-tenant service provider demonstrate logical separation between provider and customer environments with authorization controls?Improves compliance posture for: PCI DSS, SOC 2 Trust Services Criteria.
- Encryption In Transit (CRITICAL)Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?Improves compliance posture for: PCI DSS, SOC 2 Trust Services Criteria.
- Encryption At Rest (CRITICAL)Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?Improves compliance posture for: PCI DSS, SOC 2 Trust Services Criteria.
Medium Effort
- Key Management (CRITICAL)Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?Improves compliance posture for: PCI DSS, SOC 2 Trust Services Criteria.
- Data Subject Request Handling (HIGH)Can the organization demonstrate that it has implemented appropriate data governance and management practices for training, validation, and testing data sets of high-risk AI systems?Improves compliance posture for: EU AI Act.
- Consent Management (HIGH)Can the organization demonstrate that it has implemented appropriate safeguards when processing special categories of personal data for bias detection and correction?Improves compliance posture for: EU AI Act, SOC 2 Trust Services Criteria.
- Audit Logging (HIGH)Can the organization demonstrate that high-risk AI systems have logging capabilities for automatic event recording throughout their lifetime?Improves compliance posture for: EU AI Act, PCI DSS, SOC 2 Trust Services Criteria.
- Privileged Access Management (HIGH)Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?Improves compliance posture for: EU AI Act, SOC 2 Trust Services Criteria.
- Backup And Recovery (HIGH)Can the organization demonstrate that high-risk AI systems are resilient to errors and have measures to address feedback loops?Improves compliance posture for: EU AI Act, SOC 2 Trust Services Criteria.
- Data Retention (HIGH)Can the organization demonstrate that it retains automatically generated logs for at least six months (or as otherwise required) for high-risk AI systems?Improves compliance posture for: EU AI Act, PCI DSS, SOC 2 Trust Services Criteria.
- Incident Response Plan (HIGH)Can the organization demonstrate that it authorizes, designs, implements, maintains, and monitors environmental protections, backup processes, and recovery infrastructure?Improves compliance posture for: SOC 2 Trust Services Criteria.
- Records Of Processing (MEDIUM)Can the organization demonstrate that it has drawn up and maintains up-to-date technical documentation for high-risk AI systems as required by Annex IV?Improves compliance posture for: EU AI Act, PCI DSS, SOC 2 Trust Services Criteria.
- Maker Checker (MEDIUM)Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?Improves compliance posture for: EU AI Act, SOC 2 Trust Services Criteria.
- Model Testing (MEDIUM)Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?Improves compliance posture for: EU AI Act.
- Business Impact Analysis (MEDIUM)Can the organization demonstrate that high-risk AI systems are resilient to errors and have measures to address feedback loops?Improves compliance posture for: EU AI Act, PCI DSS, SOC 2 Trust Services Criteria.
- Data Lifecycle Management (MEDIUM)Can the organization demonstrate that it retains all required documentation for 10 years after placing a high-risk AI system on the market?Improves compliance posture for: EU AI Act, PCI DSS, SOC 2 Trust Services Criteria.
- Grievance Redressal (MEDIUM)Can the organization demonstrate that it has procedures to handle complaints regarding infringement of the AI Act?Improves compliance posture for: EU AI Act.
- Data Masking (MEDIUM)Can the entity demonstrate that POS POI terminals using SSL/early TLS are not susceptible to known exploits?Improves compliance posture for: PCI DSS, SOC 2 Trust Services Criteria.
- Data Classification (MEDIUM)Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?Improves compliance posture for: PCI DSS, SOC 2 Trust Services Criteria.
- Policy Management (LOW)Can the organization demonstrate that it has implemented appropriate data governance and management practices for training, validation, and testing data sets of high-risk AI systems?Improves compliance posture for: EU AI Act, PCI DSS, SOC 2 Trust Services Criteria.
- Security Awareness Training (LOW)Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?Improves compliance posture for: EU AI Act, SOC 2 Trust Services Criteria.
- Data Quality Management (INFORMATIONAL)Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?Improves compliance posture for: EU AI Act.
Strategic Initiatives
- AI Risk Assessment (HIGH)Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?Improves compliance posture for: EU AI Act, SOC 2 Trust Services Criteria.
- Bias Detection (HIGH)Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?Improves compliance posture for: EU AI Act.
- Data Loss Prevention (HIGH)Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?Improves compliance posture for: EU AI Act.
- Privacy Impact Assessment (HIGH)Can the organization demonstrate that it has established, implemented, documented, and maintained a risk management system for high-risk AI systems throughout their lifecycle?Improves compliance posture for: EU AI Act, PCI DSS, SOC 2 Trust Services Criteria.
- Data Protection Impact Assessment (HIGH)Can the organization demonstrate that it has established, implemented, documented, and maintained a risk management system for high-risk AI systems throughout their lifecycle?Improves compliance posture for: EU AI Act, PCI DSS, SOC 2 Trust Services Criteria.
- Physical Access Control (MEDIUM)Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?Improves compliance posture for: EU AI Act.
- Model Monitoring (MEDIUM)Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?Improves compliance posture for: EU AI Act.
Compliance Roadmap
Now · Quick Wins
- Access Control
- Authentication
- Encryption In Transit
- Encryption At Rest
Next · Medium Effort
- Key Management
- Data Subject Request Handling
- Consent Management
- Audit Logging
- Privileged Access Management
- Backup And Recovery
- Data Retention
- Incident Response Plan
- Records Of Processing
- Maker Checker
- Model Testing
- Business Impact Analysis
- Data Lifecycle Management
- Grievance Redressal
- Data Masking
- Data Classification
- Policy Management
- Security Awareness Training
- Data Quality Management
Later · Strategic Initiatives
- AI Risk Assessment
- Bias Detection
- Data Loss Prevention
- Privacy Impact Assessment
- Data Protection Impact Assessment
- Physical Access Control
- Model Monitoring
Next Steps
Technical Findings (235)
Showing top 50 of 235, ranked by severity then confidence. Export to JSON or SARIF for the complete list.
Critical
PCI_REQ_3_6_1 — Define and Implement Procedures to Protect Cryptographic Keys
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
server/routers/auth.py:77-77 (data_classification)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
PCI_REQ_3_6_1_2 — Store Secret and Private Keys in Secure Forms
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
server/routers/auth.py:77-77 (data_classification)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
PCI_REQ_3_7_1 — Implement Key Management for Strong Key Generation
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
server/routers/auth.py:77-77 (data_classification)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
PCI_REQ_3_7_2 — Implement Key Management for Secure Distribution
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
server/routers/auth.py:77-77 (data_classification)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
PCI_REQ_3_7_3 — Implement Key Management for Secure Storage
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
server/routers/auth.py:77-77 (data_classification)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
PCI_REQ_4_2_1 — Implement Strong Cryptography and Security Protocols for PAN Transmission
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
server/routers/auth.py:77-77 (data_classification)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
SOC2_CC6_6 — External Threat Protection
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Audit Logging, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
server/routers/auth.py:77-77 (data_classification)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
SOC2_CC6_8 — Unauthorized and Malicious Software Control
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Audit Logging, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
server/routers/auth.py:77-77 (data_classification)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
PCI_REQ_1_3_1 — Restrict Inbound Traffic to the CDE
Code Improvement Recommended
Satisfied: Authentication, Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
server/routers/auth.py:132-132 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:77-77 (data_classification)
server/routers/auth.py:127-141 (authentication)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
server/auth.py:117-117 (authentication)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
server/routers/auth.py:206-206 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
server/routers/auth.py:198-213 (authentication)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/auth.py:99-99 (authentication)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
server/routers/auth.py:147-147 (authentication)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
PCI_REQ_1_3_2 — Restrict Outbound Traffic from the CDE
Code Improvement Recommended
Satisfied: Authentication, Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
server/routers/auth.py:132-132 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:77-77 (data_classification)
server/routers/auth.py:127-141 (authentication)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
server/auth.py:117-117 (authentication)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
server/routers/auth.py:206-206 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
server/routers/auth.py:198-213 (authentication)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/auth.py:99-99 (authentication)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
server/routers/auth.py:147-147 (authentication)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
PCI_REQ_1_3_3 — Install NSCs Between Wireless Networks and the CDE
Code Improvement Recommended
Satisfied: Authentication, Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
server/routers/auth.py:132-132 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:77-77 (data_classification)
server/routers/auth.py:127-141 (authentication)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
server/auth.py:117-117 (authentication)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
server/routers/auth.py:206-206 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
server/routers/auth.py:198-213 (authentication)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/auth.py:99-99 (authentication)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
server/routers/auth.py:147-147 (authentication)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
PCI_REQ_1_4_1 — Implement NSCs Between Trusted and Untrusted Networks
Code Improvement Recommended
Satisfied: Authentication, Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
server/routers/auth.py:132-132 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:77-77 (data_classification)
server/routers/auth.py:127-141 (authentication)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
server/auth.py:117-117 (authentication)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
server/routers/auth.py:206-206 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
server/routers/auth.py:198-213 (authentication)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/auth.py:99-99 (authentication)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
server/routers/auth.py:147-147 (authentication)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
PCI_REQ_1_4_2 — Restrict Inbound Traffic from Untrusted to Trusted Networks
Code Improvement Recommended
Satisfied: Authentication, Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
server/routers/auth.py:132-132 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:77-77 (data_classification)
server/routers/auth.py:127-141 (authentication)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
server/auth.py:117-117 (authentication)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
server/routers/auth.py:206-206 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
server/routers/auth.py:198-213 (authentication)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/auth.py:99-99 (authentication)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
server/routers/auth.py:147-147 (authentication)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
PCI_REQ_1_4_4 — Prevent Direct Accessibility of Cardholder Data Storage from Untrusted Networks
Code Improvement Recommended
Satisfied: Authentication, Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
server/routers/auth.py:132-132 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:77-77 (data_classification)
server/routers/auth.py:127-141 (authentication)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
server/auth.py:117-117 (authentication)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
server/routers/auth.py:206-206 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
server/routers/auth.py:198-213 (authentication)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/auth.py:99-99 (authentication)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
server/routers/auth.py:147-147 (authentication)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
PCI_REQ_2_2_2 — Manage Vendor Default Accounts
Code Improvement Recommended
Satisfied: Authentication, Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
server/routers/auth.py:132-132 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:77-77 (data_classification)
server/routers/auth.py:127-141 (authentication)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
server/auth.py:117-117 (authentication)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
server/routers/auth.py:206-206 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
server/routers/auth.py:198-213 (authentication)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/auth.py:99-99 (authentication)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
server/routers/auth.py:147-147 (authentication)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
PCI_REQ_2_2_7 — Encrypt All Non-Console Administrative Access
Code Improvement Recommended
Satisfied: Authentication, Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
server/routers/auth.py:132-132 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:77-77 (data_classification)
server/routers/auth.py:127-141 (authentication)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
server/auth.py:117-117 (authentication)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
server/routers/auth.py:206-206 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
server/routers/auth.py:198-213 (authentication)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/auth.py:99-99 (authentication)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
server/routers/auth.py:147-147 (authentication)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
PCI_REQ_8_3_2 — Render Authentication Factors Unreadable with Strong Cryptography
Code Improvement Recommended
Satisfied: Authentication, Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
server/routers/auth.py:132-132 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:77-77 (data_classification)
server/routers/auth.py:127-141 (authentication)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
server/auth.py:117-117 (authentication)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
server/routers/auth.py:206-206 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
server/routers/auth.py:198-213 (authentication)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/auth.py:99-99 (authentication)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
server/routers/auth.py:147-147 (authentication)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
SOC2_CC6_1 — Logical Access Security Implementation
Code Improvement Recommended
Satisfied: Authentication, Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
server/routers/auth.py:132-132 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:77-77 (data_classification)
server/routers/auth.py:127-141 (authentication)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
server/auth.py:117-117 (authentication)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
server/routers/auth.py:206-206 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
server/routers/auth.py:198-213 (authentication)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/auth.py:99-99 (authentication)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
server/routers/auth.py:147-147 (authentication)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
SOC2_CC6_4 — Physical Access Restriction
Code Improvement Recommended
Satisfied: Authentication, Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
server/routers/auth.py:132-132 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:77-77 (data_classification)
server/routers/auth.py:127-141 (authentication)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
server/auth.py:117-117 (authentication)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
server/routers/auth.py:206-206 (authentication)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
server/routers/auth.py:198-213 (authentication)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/auth.py:99-99 (authentication)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
server/routers/auth.py:147-147 (authentication)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
PCI_REQ_10_2_1_2 — Audit Logs Capture All Actions by Individuals with Administrative Access
Code Improvement Recommended
Satisfied: Authentication
Missing: Access Control, Audit Logging
server/routers/auth.py:132-132 (authentication)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:127-141 (authentication)
server/auth.py:117-117 (authentication)
server/routers/auth.py:206-206 (authentication)
server/routers/auth.py:198-213 (authentication)
server/auth.py:99-99 (authentication)
server/routers/auth.py:147-147 (authentication)
Critical
PCI_REQ_10_2_1_3 — Audit Logs Capture All Access to Audit Logs
Code Improvement Recommended
Satisfied: Authentication
Missing: Access Control, Audit Logging
server/routers/auth.py:132-132 (authentication)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:127-141 (authentication)
server/auth.py:117-117 (authentication)
server/routers/auth.py:206-206 (authentication)
server/routers/auth.py:198-213 (authentication)
server/auth.py:99-99 (authentication)
server/routers/auth.py:147-147 (authentication)
Critical
PCI_REQ_10_2_1_5 — Audit Logs Capture All Changes to Identification and Authentication Credentials
Code Improvement Recommended
Satisfied: Authentication
Missing: Access Control, Audit Logging
server/routers/auth.py:132-132 (authentication)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:127-141 (authentication)
server/auth.py:117-117 (authentication)
server/routers/auth.py:206-206 (authentication)
server/routers/auth.py:198-213 (authentication)
server/auth.py:99-99 (authentication)
server/routers/auth.py:147-147 (authentication)
Critical
PCI_REQ_6_2_4 — Use Software Engineering Techniques to Prevent Common Software Attacks
Code Improvement Recommended
Satisfied: Authentication
Missing: Access Control
server/routers/auth.py:132-132 (authentication)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:127-141 (authentication)
server/auth.py:117-117 (authentication)
server/routers/auth.py:206-206 (authentication)
server/routers/auth.py:198-213 (authentication)
server/auth.py:99-99 (authentication)
server/routers/auth.py:147-147 (authentication)
Critical
PCI_REQ_8_2_1 — Assign Unique ID to All Users
Code Improvement Recommended
Satisfied: Authentication
Missing: Access Control
server/routers/auth.py:132-132 (authentication)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:127-141 (authentication)
server/auth.py:117-117 (authentication)
server/routers/auth.py:206-206 (authentication)
server/routers/auth.py:198-213 (authentication)
server/auth.py:99-99 (authentication)
server/routers/auth.py:147-147 (authentication)
Critical
PCI_REQ_8_2_5 — Immediately Revoke Access for Terminated Users
Code Improvement Recommended
Satisfied: Authentication
Missing: Access Control
server/routers/auth.py:132-132 (authentication)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:127-141 (authentication)
server/auth.py:117-117 (authentication)
server/routers/auth.py:206-206 (authentication)
server/routers/auth.py:198-213 (authentication)
server/auth.py:99-99 (authentication)
server/routers/auth.py:147-147 (authentication)
Critical
PCI_REQ_8_3_1 — Authenticate User Access with at Least One Authentication Factor
Code Improvement Recommended
Satisfied: Authentication
Missing: Access Control
server/routers/auth.py:132-132 (authentication)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:127-141 (authentication)
server/auth.py:117-117 (authentication)
server/routers/auth.py:206-206 (authentication)
server/routers/auth.py:198-213 (authentication)
server/auth.py:99-99 (authentication)
server/routers/auth.py:147-147 (authentication)
Critical
PCI_REQ_8_4_1 — Implement MFA for Non-Console Administrative Access into CDE
Code Improvement Recommended
Satisfied: Authentication
Missing: Access Control
server/routers/auth.py:132-132 (authentication)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:127-141 (authentication)
server/auth.py:117-117 (authentication)
server/routers/auth.py:206-206 (authentication)
server/routers/auth.py:198-213 (authentication)
server/auth.py:99-99 (authentication)
server/routers/auth.py:147-147 (authentication)
Critical
PCI_REQ_8_4_2 — Implement MFA for All Non-Console Access into CDE
Code Improvement Recommended
Satisfied: Authentication
Missing: Access Control
server/routers/auth.py:132-132 (authentication)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:127-141 (authentication)
server/auth.py:117-117 (authentication)
server/routers/auth.py:206-206 (authentication)
server/routers/auth.py:198-213 (authentication)
server/auth.py:99-99 (authentication)
server/routers/auth.py:147-147 (authentication)
Critical
PCI_REQ_8_4_3 — Implement MFA for Remote Access from Outside the Network
Code Improvement Recommended
Satisfied: Authentication
Missing: Access Control
server/routers/auth.py:132-132 (authentication)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:127-141 (authentication)
server/auth.py:117-117 (authentication)
server/routers/auth.py:206-206 (authentication)
server/routers/auth.py:198-213 (authentication)
server/auth.py:99-99 (authentication)
server/routers/auth.py:147-147 (authentication)
Critical
PCI_REQ_8_5_1 — Configure MFA Systems to Prevent Misuse (Resistant to Replay, Not Bypassable, Two Factors Required)
Code Improvement Recommended
Satisfied: Authentication
Missing: Access Control
server/routers/auth.py:132-132 (authentication)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:127-141 (authentication)
server/auth.py:117-117 (authentication)
server/routers/auth.py:206-206 (authentication)
server/routers/auth.py:198-213 (authentication)
server/auth.py:99-99 (authentication)
server/routers/auth.py:147-147 (authentication)
Critical
SOC2_CC6_2 — User Registration and Authorization
Code Improvement Recommended
Satisfied: Authentication
Missing: Access Control
server/routers/auth.py:132-132 (authentication)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:127-141 (authentication)
server/auth.py:117-117 (authentication)
server/routers/auth.py:206-206 (authentication)
server/routers/auth.py:198-213 (authentication)
server/auth.py:99-99 (authentication)
server/routers/auth.py:147-147 (authentication)
Critical
SOC2_CC6_3 — Access Authorization, Modification, and Removal
Code Improvement Recommended
Satisfied: Authentication
Missing: Access Control
server/routers/auth.py:132-132 (authentication)
server/routers/auth.py:146-164 (authentication)
server/routers/auth.py:127-141 (authentication)
server/auth.py:117-117 (authentication)
server/routers/auth.py:206-206 (authentication)
server/routers/auth.py:198-213 (authentication)
server/auth.py:99-99 (authentication)
server/routers/auth.py:147-147 (authentication)
Critical
PCI_REQ_3_2_1 — Implement Data Retention and Disposal Policies to Minimize Account Data Storage
Code Improvement Recommended
Satisfied: Data Classification, Data Lifecycle Management
Missing: Access Control, Data Retention, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_minimization_module_fanin)
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/opensearch.py:11-11 (data_minimization_module_fanin)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_minimization_module_fanin)
server/routers/auth.py:77-77 (data_classification)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_minimization_module_fanin)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_minimization_module_fanin)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
PCI_REQ_3_3_1 — Do Not Store Sensitive Authentication Data After Authorization
Code Improvement Recommended
Satisfied: Data Classification, Data Lifecycle Management
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_minimization_module_fanin)
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/opensearch.py:11-11 (data_minimization_module_fanin)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_minimization_module_fanin)
server/routers/auth.py:77-77 (data_classification)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_minimization_module_fanin)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_minimization_module_fanin)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
PCI_REQ_3_3_1_1 — Do Not Store Full Track Data After Authorization
Code Improvement Recommended
Satisfied: Data Classification, Data Lifecycle Management
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_minimization_module_fanin)
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/opensearch.py:11-11 (data_minimization_module_fanin)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_minimization_module_fanin)
server/routers/auth.py:77-77 (data_classification)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_minimization_module_fanin)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_minimization_module_fanin)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
PCI_REQ_3_3_1_2 — Do Not Store Card Verification Code After Authorization
Code Improvement Recommended
Satisfied: Data Classification, Data Lifecycle Management
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_minimization_module_fanin)
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/opensearch.py:11-11 (data_minimization_module_fanin)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_minimization_module_fanin)
server/routers/auth.py:77-77 (data_classification)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_minimization_module_fanin)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_minimization_module_fanin)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
PCI_REQ_3_3_1_3 — Do Not Store PIN or PIN Block After Authorization
Code Improvement Recommended
Satisfied: Data Classification, Data Lifecycle Management
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_minimization_module_fanin)
mem0/configs/vector_stores/pgvector.py:11-11 (data_classification)
mem0/configs/vector_stores/opensearch.py:11-11 (data_minimization_module_fanin)
mem0/configs/vector_stores/cassandra.py:15-15 (data_classification)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:12-12 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_classification)
mem0-ts/src/oss/src/vector_stores/opensearch.ts:25-25 (data_minimization_module_fanin)
server/routers/auth.py:77-77 (data_classification)
mem0/configs/vector_stores/opensearch.py:11-11 (data_classification)
mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:38-38 (data_minimization_module_fanin)
server/models.py:23-23 (data_classification)
server/routers/auth.py:60-60 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:30-30 (data_classification)
mem0-ts/src/oss/src/vector_stores/elasticsearch.ts:15-15 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_classification)
mem0/configs/vector_stores/azure_mysql.py:17-17 (data_classification)
mem0-ts/src/oss/src/vector_stores/cassandra.ts:47-47 (data_minimization_module_fanin)
server/routers/auth.py:50-50 (data_classification)
mem0/configs/vector_stores/elasticsearch.py:12-12 (data_classification)
server/routers/auth.py:41-41 (data_classification)
mem0-ts/src/oss/src/vector_stores/pgvector.ts:161-161 (data_classification)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_minimization_module_fanin)
mem0-ts/src/oss/src/vector_stores/redis.ts:154-154 (data_classification)
Critical
EU_AI_ART_20_001 — Corrective Actions and Duty of Information
Code Improvement Recommended
Missing: Audit Logging
Critical
EU_AI_ART_27_001 — Fundamental Rights Impact Assessment
Code Improvement Recommended
Missing: Consent Management
Critical
EU_AI_ART_5_001 — Prohibition of Subliminal Manipulative Techniques
Code Improvement Recommended
Missing: Consent Management
Critical
EU_AI_ART_5_002 — Prohibition of Exploiting Vulnerabilities
Code Improvement Recommended
Missing: Consent Management
Critical
EU_AI_ART_5_003 — Prohibition of Social Scoring
Code Improvement Recommended
Missing: Consent Management
Critical
EU_AI_ART_5_004 — Prohibition of Predictive Policing Risk Assessments Based Solely on Profiling
Code Improvement Recommended
Missing: Consent Management
Critical
EU_AI_ART_5_006 — Prohibition of Emotion Recognition in Workplace and Education
Code Improvement Recommended
Missing: Consent Management
Critical
EU_AI_ART_5_007 — Prohibition of Biometric Categorisation for Sensitive Characteristics
Code Improvement Recommended
Missing: Consent Management
Critical
EU_AI_ART_5_008 — Restrictions on Real-Time Remote Biometric Identification for Law Enforcement
Code Improvement Recommended
Missing: Consent Management
Critical
EU_AI_ART_73_001 — Reporting of Serious Incidents
Code Improvement Recommended
Missing: Audit Logging
Critical
PCI_REQ_10_2_1 — Enable and Activate Audit Logs for All System Components
Code Improvement Recommended
Missing: Audit Logging
Critical
PCI_REQ_10_2_1_1 — Audit Logs Capture All Individual User Access to Cardholder Data
Code Improvement Recommended
Missing: Audit Logging
Critical
PCI_REQ_10_2_1_6 — Audit Logs Capture Initialization, Starting, Stopping, or Pausing of Audit Logs
Code Improvement Recommended
Missing: Audit Logging
Control Mapping Appendix
Raw control-level mapping (control IDs, clause text) is intentionally not inlined here — export to JSON or SARIF for the complete, machine-readable control mapping.