Meridian Compliance Report

dify

Generated 22 July 2026, 05:24 UTC
Report 5ec0cd2707a8b603c8b6ad40
Meridian provides automated compliance assessments and recommendations, not legal advice. Final compliance determinations should be reviewed by qualified legal, compliance, or security professionals where required.

Executive Summary

Applicable Controls
122
Controls determined to apply to this repository
Implemented
6
Requires Documentation
46
Requires Operational Evidence
12
Code Improvement Recommended
58
Security Maturity
0.07
0.0 - 1.0 scale
Risk Score
0.38
Severity-weighted violations

Repository Intelligence

Technology Stack

10391 files · 2002134 lines · complexity 1.00

languagetsx languagepython languagetypescript languagejavascript languagego frameworkFastAPI frameworkFlask frameworkNext.js frameworkReact authAuthentication encryptionEncryption iacGitHub Actions containerDocker containerDocker Compose databaseSQL (via SQLAlchemy) databaseRedis messagingCelery monitoringOpenTelemetry databasePostgreSQL ai_frameworkPydanticAI ai_infrastructureMLflow vector_databaseQdrant vector_databaseChromaDB vector_databaseMilvus vector_databaseWeaviate databaseMySQL

Business Signals

In productionTrue
Stores personal dataTrue
Uses AITrue
Primary jurisdictionUnited States
Processes paymentsFalse
Regulated financial entityFalse

Compliance Scope

Applicable Regulations

EU AI ActAI Governance & Responsible AI
Your repository deploys AI models or AI-powered systems.
Required: matched on ai_usage.
SOC 2 Trust Services CriteriaTrust & Assurance
Your application is in production and handles customer data requiring independent assurance.
Optional: base condition met, but no additional signal beyond production.

Not Applicable Regulations

DPDPA 2023Privacy & Data Protection
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
DPDPA Rules, 2025Privacy & Data Protection
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
GDPRPrivacy & Data Protection
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
RBI FREE-AI FrameworkAI Governance & Responsible AI
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
SEBI AI/ML GuidelinesAI Governance & Responsible AI
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Digital Payment Security ControlsPayments & Financial Security
Excluded: 'processes_payments' does not match the condition required for this framework.
PCI DSSPayments & Financial Security
Excluded: 'processes_payments' does not match the condition required for this framework.
RBI IT Governance & Risk ControlsCybersecurity & Operational Security
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI NBFC IT FrameworkFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI NBFC Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Payments Banks Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Small Finance Banks Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
SEBI Cybersecurity FrameworkCybersecurity & Operational Security
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
CERT-In DirectionsCybersecurity & Operational Security
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.

Capability Intelligence

Implemented

Authentication Cross Border Transfer Controls Data Classification Data Lifecycle Management

Code Improvement Recommended

Access Control Audit Logging Consent Management Data Retention Encryption At Rest Encryption In Transit Key Management

Requires Documentation

Asset Inventory Backup And Recovery Business Impact Analysis Configuration Management Data Deletion Data Masking Data Protection Impact Assessment Data Subject Request Handling Grievance Redressal Incident Response Plan Information Security Policy Log Retention Policy Management Privacy Impact Assessment Records Of Processing

Requires Operational Evidence

AI Risk Assessment Access Review BCP And DR Testing Bias Detection Change Management Data Loss Prevention Data Quality Management Governance Framework Incident Detection Maker Checker Model Monitoring Model Testing Patch Management Penetration Testing Physical Access Control Privileged Access Management Regulatory Change Monitoring Regulatory Reporting SOC Operations Security Awareness Training Third Party Risk Assessment Vendor Contract Management Vulnerability Scanning

Enterprise Readiness

Ready

  • Authentication

Missing

  • Access Control
  • Privileged Access Management
  • Audit Logging
  • Encryption At Rest
  • Encryption In Transit
  • Key Management
  • Incident Response Plan
  • Information Security Policy
  • Data Retention
  • BCP And DR Testing
  • Penetration Testing
  • Third Party Risk Assessment
  • Vendor Contract Management
  • Security Awareness Training

AI Governance

Critical AI Findings
23
AI frameworksPydanticAI
AI infrastructureMLflow
Vector databasesQdrant, ChromaDB, Milvus, Weaviate
Notebooks0
AI regulations evaluatedEU Artificial Intelligence Act

Not mapped (no real control data available): ISO_42001, NIST_AI_RMF, OECD_AI_PRINCIPLES

Top Priorities

  1. Access Control (CRITICAL) — Can the organization (as a third-country provider) demonstrate that it has appointed an authorised representative in the Union and that the representative fulfils all required tasks?
  2. Encryption At Rest (CRITICAL) — Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
  3. Encryption In Transit (CRITICAL) — Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
  4. Key Management (CRITICAL) — Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
  5. Data Subject Request Handling (HIGH) — Can the organization demonstrate that it has implemented appropriate data governance and management practices for training, validation, and testing data sets of high-risk AI systems?

Full breakdown by effort below.

Recommended Actions

Quick Wins

  • Access Control (CRITICAL)
    Can the organization (as a third-country provider) demonstrate that it has appointed an authorised representative in the Union and that the representative fulfils all required tasks?
  • Encryption At Rest (CRITICAL)
    Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
  • Encryption In Transit (CRITICAL)
    Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?

Medium Effort

  • Key Management (CRITICAL)
    Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
  • Data Subject Request Handling (HIGH)
    Can the organization demonstrate that it has implemented appropriate data governance and management practices for training, validation, and testing data sets of high-risk AI systems?
  • Consent Management (HIGH)
    Can the organization demonstrate that it has implemented appropriate safeguards when processing special categories of personal data for bias detection and correction?
  • Audit Logging (HIGH)
    Can the organization demonstrate that high-risk AI systems have logging capabilities for automatic event recording throughout their lifetime?
  • Privileged Access Management (HIGH)
    Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?
  • Backup And Recovery (HIGH)
    Can the organization demonstrate that high-risk AI systems are resilient to errors and have measures to address feedback loops?
  • Data Retention (HIGH)
    Can the organization demonstrate that it retains automatically generated logs for at least six months (or as otherwise required) for high-risk AI systems?
  • Incident Response Plan (HIGH)
    Can the organization demonstrate that it authorizes, designs, implements, maintains, and monitors environmental protections, backup processes, and recovery infrastructure?
  • Records Of Processing (MEDIUM)
    Can the organization demonstrate that it has drawn up and maintains up-to-date technical documentation for high-risk AI systems as required by Annex IV?
  • Maker Checker (MEDIUM)
    Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?
  • Model Testing (MEDIUM)
    Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?
  • Business Impact Analysis (MEDIUM)
    Can the organization demonstrate that high-risk AI systems are resilient to errors and have measures to address feedback loops?
  • Data Lifecycle Management (MEDIUM)
    Can the organization demonstrate that it retains all required documentation for 10 years after placing a high-risk AI system on the market?
  • Grievance Redressal (MEDIUM)
    Can the organization demonstrate that it has procedures to handle complaints regarding infringement of the AI Act?
  • Data Masking (MEDIUM)
    Can the organization demonstrate that it selects and develops general control activities over technology to support the achievement of objectives?
  • Data Classification (MEDIUM)
    Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
  • Policy Management (LOW)
    Can the organization demonstrate that it has implemented appropriate data governance and management practices for training, validation, and testing data sets of high-risk AI systems?
  • Security Awareness Training (LOW)
    Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?
  • Data Quality Management (INFORMATIONAL)
    Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?

Strategic Initiatives

  • AI Risk Assessment (HIGH)
    Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?
  • Bias Detection (HIGH)
    Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?
  • Data Loss Prevention (HIGH)
    Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?
  • Data Protection Impact Assessment (HIGH)
    Can the organization demonstrate that it has established, implemented, documented, and maintained a risk management system for high-risk AI systems throughout their lifecycle?
  • Privacy Impact Assessment (HIGH)
    Can the organization demonstrate that it has established, implemented, documented, and maintained a risk management system for high-risk AI systems throughout their lifecycle?
  • Physical Access Control (MEDIUM)
    Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?
  • Model Monitoring (MEDIUM)
    Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?

Compliance Roadmap

Now · Quick Wins

  • Access Control
  • Encryption At Rest
  • Encryption In Transit

Next · Medium Effort

  • Key Management
  • Data Subject Request Handling
  • Consent Management
  • Audit Logging
  • Privileged Access Management
  • Backup And Recovery
  • Data Retention
  • Incident Response Plan
  • Records Of Processing
  • Maker Checker
  • Model Testing
  • Business Impact Analysis
  • Data Lifecycle Management
  • Grievance Redressal
  • Data Masking
  • Data Classification
  • Policy Management
  • Security Awareness Training
  • Data Quality Management

Later · Strategic Initiatives

  • AI Risk Assessment
  • Bias Detection
  • Data Loss Prevention
  • Data Protection Impact Assessment
  • Privacy Impact Assessment
  • Physical Access Control
  • Model Monitoring

Next Steps

Start with Top Priorities above, then work through the full Quick Wins/Medium Effort/Strategic Initiatives breakdown. Technical Findings below show exactly where each gap was detected in your repository; export to PDF/HTML for a shareable version, or JSON/SARIF to feed a CI pipeline.

Technical Findings (54)

Showing top 50 of 54, ranked by severity then confidence. Export to JSON or SARIF for the complete list.

Critical SOC2_CC6_6 — External Threat Protection Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Audit Logging, Encryption At Rest, Encryption In Transit, Key Management
api/models/dataset.py:1404-1404 (data_classification)
api/models/account.py:97-97 (data_classification)
api/controllers/console/setup.py:20-20 (data_classification)
api/controllers/console/workspace/members.py:83-83 (data_classification)
api/fields/conversation_fields.py:199-199 (data_classification)
api/providers/vdb/vdb-couchbase/src/dify_vdb_couchbase/couchbase_vector.py:33-33 (data_classification)
api/providers/vdb/vdb-milvus/src/dify_vdb_milvus/milvus_vector.py:27-27 (data_classification)
api/libs/oauth.py:50-50 (data_classification)
api/providers/vdb/vdb-pgvecto-rs/src/dify_vdb_pgvecto_rs/pgvecto_rs.py:31-31 (data_classification)
api/fields/member_fields.py:47-47 (data_classification)
api/fields/member_fields.py:14-14 (data_classification)
api/controllers/console/auth/forgot_password.py:39-39 (data_classification)
cli/src/commands/get/member/handlers.ts:19-19 (data_classification)
api/controllers/console/explore/trial.py:354-354 (data_classification)
api/controllers/console/auth/email_register.py:33-33 (data_classification)
api/controllers/console/workspace/account.py:139-139 (data_classification)
api/providers/vdb/vdb-oracle/src/dify_vdb_oracle/oraclevector.py:42-42 (data_classification)
api/providers/vdb/vdb-myscale/src/dify_vdb_myscale/myscale_vector.py:28-28 (data_classification)
api/services/entities/auth_entities.py:85-85 (data_classification)
api/controllers/console/auth/activate.py:22-22 (data_classification)
api/providers/vdb/vdb-oracle/src/dify_vdb_oracle/oraclevector.py:30-30 (data_classification)
api/libs/oauth.py:41-41 (data_classification)
api/controllers/console/workspace/members.py:77-77 (data_classification)
api/controllers/console/workspace/account.py:156-156 (data_classification)
api/providers/vdb/vdb-matrixone/src/dify_vdb_matrixone/matrixone_vector.py:40-40 (data_classification)
api/fields/member_fields.py:29-29 (data_classification)
api/providers/vdb/vdb-alibabacloud-mysql/src/dify_vdb_alibabacloud_mysql/alibabacloud_mysql_vector.py:29-29 (data_classification)
api/providers/vdb/vdb-opengauss/src/dify_vdb_opengauss/opengauss.py:24-24 (data_classification)
api/controllers/web/login.py:57-57 (data_classification)
api/controllers/openapi/_models.py:156-156 (data_classification)
api/services/enterprise/rbac_service.py:176-176 (data_classification)
api/controllers/openapi/_models.py:420-420 (data_classification)
api/providers/vdb/vdb-opensearch/src/dify_vdb_opensearch/opensearch_vector.py:46-46 (data_classification)
api/extensions/ext_redis.py:254-254 (data_classification)
api/libs/oauth.py:55-55 (data_classification)
api/extensions/storage/clickzetta_volume/clickzetta_volume_storage.py:29-29 (data_classification)
api/providers/trace/trace-mlflow/src/dify_trace_mlflow/config.py:15-15 (data_classification)
api/controllers/console/auth/activate.py:28-28 (data_classification)
api/controllers/console/auth/oauth_server.py:60-60 (data_classification)
api/providers/vdb/vdb-clickzetta/src/dify_vdb_clickzetta/clickzetta_vector.py:39-39 (data_classification)
api/controllers/openapi/_models.py:394-394 (data_classification)
api/extensions/ext_celery.py:18-18 (data_classification)
api/providers/vdb/vdb-elasticsearch/src/dify_vdb_elasticsearch/elasticsearch_vector.py:30-30 (data_classification)
api/controllers/openapi/_models.py:432-432 (data_classification)
api/controllers/openapi/auth/data.py:39-39 (data_classification)
api/providers/vdb/vdb-vastbase/src/dify_vdb_vastbase/vastbase_vector.py:24-24 (data_classification)
api/providers/vdb/vdb-oceanbase/src/dify_vdb_oceanbase/oceanbase_vector.py:38-38 (data_classification)
api/services/entities/auth_entities.py:43-43 (data_classification)
api/providers/vdb/vdb-tidb-vector/src/dify_vdb_tidb_vector/tidb_vector.py:28-28 (data_classification)
api/providers/vdb/vdb-milvus/src/dify_vdb_milvus/milvus_vector.py:40-40 (data_classification)
api/controllers/console/auth/login.py:79-79 (data_classification)
scripts/stress-test/common/config_helper.py:11-11 (data_classification)
api/controllers/console/auth/activate.py:56-56 (data_classification)
api/services/entities/auth_entities.py:53-53 (data_classification)
api/controllers/console/workspace/account.py:163-163 (data_classification)
api/controllers/console/workspace/account.py:174-174 (data_classification)
api/controllers/console/workspace/account.py:122-122 (data_classification)
api/controllers/console/auth/email_register.py:38-38 (data_classification)
api/models/agent_config_entities.py:489-489 (data_classification)
api/providers/vdb/vdb-relyt/src/dify_vdb_relyt/relyt_vector.py:36-36 (data_classification)
api/controllers/web/login.py:62-62 (data_classification)
api/controllers/console/auth/login.py:84-84 (data_classification)
api/services/enterprise/rbac_service.py:96-96 (data_classification)
api/core/workflow/human_input_adapter.py:52-52 (data_classification)
api/controllers/openapi/_models.py:371-371 (data_classification)
api/controllers/common/fields.py:99-99 (data_classification)
api/controllers/console/app/workflow_comment.py:58-58 (data_classification)
api/providers/vdb/vdb-huawei-cloud/src/dify_vdb_huawei_cloud/huawei_cloud_vector.py:43-43 (data_classification)
api/controllers/console/workspace/members.py:89-89 (data_classification)
api/providers/vdb/vdb-lindorm/src/dify_vdb_lindorm/lindorm_vector.py:41-41 (data_classification)
api/services/entities/auth_entities.py:48-48 (data_classification)
api/services/account_service.py:100-100 (data_classification)
api/core/app/apps/common/workflow_response_converter.py:100-100 (data_classification)
api/providers/vdb/vdb-pgvector/src/dify_vdb_pgvector/pgvector.py:29-29 (data_classification)
api/controllers/console/init_validate.py:20-20 (data_classification)
Critical SOC2_CC6_8 — Unauthorized and Malicious Software Control Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Audit Logging, Encryption At Rest, Encryption In Transit, Key Management
api/models/dataset.py:1404-1404 (data_classification)
api/models/account.py:97-97 (data_classification)
api/controllers/console/setup.py:20-20 (data_classification)
api/controllers/console/workspace/members.py:83-83 (data_classification)
api/fields/conversation_fields.py:199-199 (data_classification)
api/providers/vdb/vdb-couchbase/src/dify_vdb_couchbase/couchbase_vector.py:33-33 (data_classification)
api/providers/vdb/vdb-milvus/src/dify_vdb_milvus/milvus_vector.py:27-27 (data_classification)
api/libs/oauth.py:50-50 (data_classification)
api/providers/vdb/vdb-pgvecto-rs/src/dify_vdb_pgvecto_rs/pgvecto_rs.py:31-31 (data_classification)
api/fields/member_fields.py:47-47 (data_classification)
api/fields/member_fields.py:14-14 (data_classification)
api/controllers/console/auth/forgot_password.py:39-39 (data_classification)
cli/src/commands/get/member/handlers.ts:19-19 (data_classification)
api/controllers/console/explore/trial.py:354-354 (data_classification)
api/controllers/console/auth/email_register.py:33-33 (data_classification)
api/controllers/console/workspace/account.py:139-139 (data_classification)
api/providers/vdb/vdb-oracle/src/dify_vdb_oracle/oraclevector.py:42-42 (data_classification)
api/providers/vdb/vdb-myscale/src/dify_vdb_myscale/myscale_vector.py:28-28 (data_classification)
api/services/entities/auth_entities.py:85-85 (data_classification)
api/controllers/console/auth/activate.py:22-22 (data_classification)
api/providers/vdb/vdb-oracle/src/dify_vdb_oracle/oraclevector.py:30-30 (data_classification)
api/libs/oauth.py:41-41 (data_classification)
api/controllers/console/workspace/members.py:77-77 (data_classification)
api/controllers/console/workspace/account.py:156-156 (data_classification)
api/providers/vdb/vdb-matrixone/src/dify_vdb_matrixone/matrixone_vector.py:40-40 (data_classification)
api/fields/member_fields.py:29-29 (data_classification)
api/providers/vdb/vdb-alibabacloud-mysql/src/dify_vdb_alibabacloud_mysql/alibabacloud_mysql_vector.py:29-29 (data_classification)
api/providers/vdb/vdb-opengauss/src/dify_vdb_opengauss/opengauss.py:24-24 (data_classification)
api/controllers/web/login.py:57-57 (data_classification)
api/controllers/openapi/_models.py:156-156 (data_classification)
api/services/enterprise/rbac_service.py:176-176 (data_classification)
api/controllers/openapi/_models.py:420-420 (data_classification)
api/providers/vdb/vdb-opensearch/src/dify_vdb_opensearch/opensearch_vector.py:46-46 (data_classification)
api/extensions/ext_redis.py:254-254 (data_classification)
api/libs/oauth.py:55-55 (data_classification)
api/extensions/storage/clickzetta_volume/clickzetta_volume_storage.py:29-29 (data_classification)
api/providers/trace/trace-mlflow/src/dify_trace_mlflow/config.py:15-15 (data_classification)
api/controllers/console/auth/activate.py:28-28 (data_classification)
api/controllers/console/auth/oauth_server.py:60-60 (data_classification)
api/providers/vdb/vdb-clickzetta/src/dify_vdb_clickzetta/clickzetta_vector.py:39-39 (data_classification)
api/controllers/openapi/_models.py:394-394 (data_classification)
api/extensions/ext_celery.py:18-18 (data_classification)
api/providers/vdb/vdb-elasticsearch/src/dify_vdb_elasticsearch/elasticsearch_vector.py:30-30 (data_classification)
api/controllers/openapi/_models.py:432-432 (data_classification)
api/controllers/openapi/auth/data.py:39-39 (data_classification)
api/providers/vdb/vdb-vastbase/src/dify_vdb_vastbase/vastbase_vector.py:24-24 (data_classification)
api/providers/vdb/vdb-oceanbase/src/dify_vdb_oceanbase/oceanbase_vector.py:38-38 (data_classification)
api/services/entities/auth_entities.py:43-43 (data_classification)
api/providers/vdb/vdb-tidb-vector/src/dify_vdb_tidb_vector/tidb_vector.py:28-28 (data_classification)
api/providers/vdb/vdb-milvus/src/dify_vdb_milvus/milvus_vector.py:40-40 (data_classification)
api/controllers/console/auth/login.py:79-79 (data_classification)
scripts/stress-test/common/config_helper.py:11-11 (data_classification)
api/controllers/console/auth/activate.py:56-56 (data_classification)
api/services/entities/auth_entities.py:53-53 (data_classification)
api/controllers/console/workspace/account.py:163-163 (data_classification)
api/controllers/console/workspace/account.py:174-174 (data_classification)
api/controllers/console/workspace/account.py:122-122 (data_classification)
api/controllers/console/auth/email_register.py:38-38 (data_classification)
api/models/agent_config_entities.py:489-489 (data_classification)
api/providers/vdb/vdb-relyt/src/dify_vdb_relyt/relyt_vector.py:36-36 (data_classification)
api/controllers/web/login.py:62-62 (data_classification)
api/controllers/console/auth/login.py:84-84 (data_classification)
api/services/enterprise/rbac_service.py:96-96 (data_classification)
api/core/workflow/human_input_adapter.py:52-52 (data_classification)
api/controllers/openapi/_models.py:371-371 (data_classification)
api/controllers/common/fields.py:99-99 (data_classification)
api/controllers/console/app/workflow_comment.py:58-58 (data_classification)
api/providers/vdb/vdb-huawei-cloud/src/dify_vdb_huawei_cloud/huawei_cloud_vector.py:43-43 (data_classification)
api/controllers/console/workspace/members.py:89-89 (data_classification)
api/providers/vdb/vdb-lindorm/src/dify_vdb_lindorm/lindorm_vector.py:41-41 (data_classification)
api/services/entities/auth_entities.py:48-48 (data_classification)
api/services/account_service.py:100-100 (data_classification)
api/core/app/apps/common/workflow_response_converter.py:100-100 (data_classification)
api/providers/vdb/vdb-pgvector/src/dify_vdb_pgvector/pgvector.py:29-29 (data_classification)
api/controllers/console/init_validate.py:20-20 (data_classification)
Critical EU_AI_ART_20_001 — Corrective Actions and Duty of Information Code Improvement Recommended
Missing: Audit Logging
Critical EU_AI_ART_27_001 — Fundamental Rights Impact Assessment Code Improvement Recommended
Missing: Consent Management
Critical EU_AI_ART_5_001 — Prohibition of Subliminal Manipulative Techniques Code Improvement Recommended
Missing: Consent Management
Critical EU_AI_ART_5_002 — Prohibition of Exploiting Vulnerabilities Code Improvement Recommended
Missing: Consent Management
Critical EU_AI_ART_5_003 — Prohibition of Social Scoring Code Improvement Recommended
Missing: Consent Management
Critical EU_AI_ART_5_004 — Prohibition of Predictive Policing Risk Assessments Based Solely on Profiling Code Improvement Recommended
Missing: Consent Management
Critical EU_AI_ART_5_006 — Prohibition of Emotion Recognition in Workplace and Education Code Improvement Recommended
Missing: Consent Management
Critical EU_AI_ART_5_007 — Prohibition of Biometric Categorisation for Sensitive Characteristics Code Improvement Recommended
Missing: Consent Management
Critical EU_AI_ART_5_008 — Restrictions on Real-Time Remote Biometric Identification for Law Enforcement Code Improvement Recommended
Missing: Consent Management
Critical EU_AI_ART_73_001 — Reporting of Serious Incidents Code Improvement Recommended
Missing: Audit Logging
Critical SOC2_CC7_3 — Security Event Evaluation Code Improvement Recommended
Missing: Audit Logging
Critical SOC2_CC7_4 — Incident Response Program Execution Code Improvement Recommended
Missing: Audit Logging
Critical SOC2_P6_6 — Notification of Breaches and Incidents Code Improvement Recommended
Missing: Audit Logging, Consent Management
High SOC2_P3_1 — Collection of Personal Information Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Consent Management, Encryption At Rest, Encryption In Transit, Key Management
api/models/dataset.py:1404-1404 (data_classification)
api/models/account.py:97-97 (data_classification)
api/controllers/console/setup.py:20-20 (data_classification)
api/controllers/console/workspace/members.py:83-83 (data_classification)
api/fields/conversation_fields.py:199-199 (data_classification)
api/providers/vdb/vdb-couchbase/src/dify_vdb_couchbase/couchbase_vector.py:33-33 (data_classification)
api/providers/vdb/vdb-milvus/src/dify_vdb_milvus/milvus_vector.py:27-27 (data_classification)
api/libs/oauth.py:50-50 (data_classification)
api/providers/vdb/vdb-pgvecto-rs/src/dify_vdb_pgvecto_rs/pgvecto_rs.py:31-31 (data_classification)
api/fields/member_fields.py:47-47 (data_classification)
api/fields/member_fields.py:14-14 (data_classification)
api/controllers/console/auth/forgot_password.py:39-39 (data_classification)
cli/src/commands/get/member/handlers.ts:19-19 (data_classification)
api/controllers/console/explore/trial.py:354-354 (data_classification)
api/controllers/console/auth/email_register.py:33-33 (data_classification)
api/controllers/console/workspace/account.py:139-139 (data_classification)
api/providers/vdb/vdb-oracle/src/dify_vdb_oracle/oraclevector.py:42-42 (data_classification)
api/providers/vdb/vdb-myscale/src/dify_vdb_myscale/myscale_vector.py:28-28 (data_classification)
api/services/entities/auth_entities.py:85-85 (data_classification)
api/controllers/console/auth/activate.py:22-22 (data_classification)
api/providers/vdb/vdb-oracle/src/dify_vdb_oracle/oraclevector.py:30-30 (data_classification)
api/libs/oauth.py:41-41 (data_classification)
api/controllers/console/workspace/members.py:77-77 (data_classification)
api/controllers/console/workspace/account.py:156-156 (data_classification)
api/providers/vdb/vdb-matrixone/src/dify_vdb_matrixone/matrixone_vector.py:40-40 (data_classification)
api/fields/member_fields.py:29-29 (data_classification)
api/providers/vdb/vdb-alibabacloud-mysql/src/dify_vdb_alibabacloud_mysql/alibabacloud_mysql_vector.py:29-29 (data_classification)
api/providers/vdb/vdb-opengauss/src/dify_vdb_opengauss/opengauss.py:24-24 (data_classification)
api/controllers/web/login.py:57-57 (data_classification)
api/controllers/openapi/_models.py:156-156 (data_classification)
api/services/enterprise/rbac_service.py:176-176 (data_classification)
api/controllers/openapi/_models.py:420-420 (data_classification)
api/providers/vdb/vdb-opensearch/src/dify_vdb_opensearch/opensearch_vector.py:46-46 (data_classification)
api/extensions/ext_redis.py:254-254 (data_classification)
api/libs/oauth.py:55-55 (data_classification)
api/extensions/storage/clickzetta_volume/clickzetta_volume_storage.py:29-29 (data_classification)
api/providers/trace/trace-mlflow/src/dify_trace_mlflow/config.py:15-15 (data_classification)
api/controllers/console/auth/activate.py:28-28 (data_classification)
api/controllers/console/auth/oauth_server.py:60-60 (data_classification)
api/providers/vdb/vdb-clickzetta/src/dify_vdb_clickzetta/clickzetta_vector.py:39-39 (data_classification)
api/controllers/openapi/_models.py:394-394 (data_classification)
api/extensions/ext_celery.py:18-18 (data_classification)
api/providers/vdb/vdb-elasticsearch/src/dify_vdb_elasticsearch/elasticsearch_vector.py:30-30 (data_classification)
api/controllers/openapi/_models.py:432-432 (data_classification)
api/controllers/openapi/auth/data.py:39-39 (data_classification)
api/providers/vdb/vdb-vastbase/src/dify_vdb_vastbase/vastbase_vector.py:24-24 (data_classification)
api/providers/vdb/vdb-oceanbase/src/dify_vdb_oceanbase/oceanbase_vector.py:38-38 (data_classification)
api/services/entities/auth_entities.py:43-43 (data_classification)
api/providers/vdb/vdb-tidb-vector/src/dify_vdb_tidb_vector/tidb_vector.py:28-28 (data_classification)
api/providers/vdb/vdb-milvus/src/dify_vdb_milvus/milvus_vector.py:40-40 (data_classification)
api/controllers/console/auth/login.py:79-79 (data_classification)
scripts/stress-test/common/config_helper.py:11-11 (data_classification)
api/controllers/console/auth/activate.py:56-56 (data_classification)
api/services/entities/auth_entities.py:53-53 (data_classification)
api/controllers/console/workspace/account.py:163-163 (data_classification)
api/controllers/console/workspace/account.py:174-174 (data_classification)
api/controllers/console/workspace/account.py:122-122 (data_classification)
api/controllers/console/auth/email_register.py:38-38 (data_classification)
api/models/agent_config_entities.py:489-489 (data_classification)
api/providers/vdb/vdb-relyt/src/dify_vdb_relyt/relyt_vector.py:36-36 (data_classification)
api/controllers/web/login.py:62-62 (data_classification)
api/controllers/console/auth/login.py:84-84 (data_classification)
api/services/enterprise/rbac_service.py:96-96 (data_classification)
api/core/workflow/human_input_adapter.py:52-52 (data_classification)
api/controllers/openapi/_models.py:371-371 (data_classification)
api/controllers/common/fields.py:99-99 (data_classification)
api/controllers/console/app/workflow_comment.py:58-58 (data_classification)
api/providers/vdb/vdb-huawei-cloud/src/dify_vdb_huawei_cloud/huawei_cloud_vector.py:43-43 (data_classification)
api/controllers/console/workspace/members.py:89-89 (data_classification)
api/providers/vdb/vdb-lindorm/src/dify_vdb_lindorm/lindorm_vector.py:41-41 (data_classification)
api/services/entities/auth_entities.py:48-48 (data_classification)
api/services/account_service.py:100-100 (data_classification)
api/core/app/apps/common/workflow_response_converter.py:100-100 (data_classification)
api/providers/vdb/vdb-pgvector/src/dify_vdb_pgvector/pgvector.py:29-29 (data_classification)
api/controllers/console/init_validate.py:20-20 (data_classification)
High SOC2_P4_1 — Limitation of Personal Information Use Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Consent Management, Encryption At Rest, Encryption In Transit, Key Management
api/models/dataset.py:1404-1404 (data_classification)
api/models/account.py:97-97 (data_classification)
api/controllers/console/setup.py:20-20 (data_classification)
api/controllers/console/workspace/members.py:83-83 (data_classification)
api/fields/conversation_fields.py:199-199 (data_classification)
api/providers/vdb/vdb-couchbase/src/dify_vdb_couchbase/couchbase_vector.py:33-33 (data_classification)
api/providers/vdb/vdb-milvus/src/dify_vdb_milvus/milvus_vector.py:27-27 (data_classification)
api/libs/oauth.py:50-50 (data_classification)
api/providers/vdb/vdb-pgvecto-rs/src/dify_vdb_pgvecto_rs/pgvecto_rs.py:31-31 (data_classification)
api/fields/member_fields.py:47-47 (data_classification)
api/fields/member_fields.py:14-14 (data_classification)
api/controllers/console/auth/forgot_password.py:39-39 (data_classification)
cli/src/commands/get/member/handlers.ts:19-19 (data_classification)
api/controllers/console/explore/trial.py:354-354 (data_classification)
api/controllers/console/auth/email_register.py:33-33 (data_classification)
api/controllers/console/workspace/account.py:139-139 (data_classification)
api/providers/vdb/vdb-oracle/src/dify_vdb_oracle/oraclevector.py:42-42 (data_classification)
api/providers/vdb/vdb-myscale/src/dify_vdb_myscale/myscale_vector.py:28-28 (data_classification)
api/services/entities/auth_entities.py:85-85 (data_classification)
api/controllers/console/auth/activate.py:22-22 (data_classification)
api/providers/vdb/vdb-oracle/src/dify_vdb_oracle/oraclevector.py:30-30 (data_classification)
api/libs/oauth.py:41-41 (data_classification)
api/controllers/console/workspace/members.py:77-77 (data_classification)
api/controllers/console/workspace/account.py:156-156 (data_classification)
api/providers/vdb/vdb-matrixone/src/dify_vdb_matrixone/matrixone_vector.py:40-40 (data_classification)
api/fields/member_fields.py:29-29 (data_classification)
api/providers/vdb/vdb-alibabacloud-mysql/src/dify_vdb_alibabacloud_mysql/alibabacloud_mysql_vector.py:29-29 (data_classification)
api/providers/vdb/vdb-opengauss/src/dify_vdb_opengauss/opengauss.py:24-24 (data_classification)
api/controllers/web/login.py:57-57 (data_classification)
api/controllers/openapi/_models.py:156-156 (data_classification)
api/services/enterprise/rbac_service.py:176-176 (data_classification)
api/controllers/openapi/_models.py:420-420 (data_classification)
api/providers/vdb/vdb-opensearch/src/dify_vdb_opensearch/opensearch_vector.py:46-46 (data_classification)
api/extensions/ext_redis.py:254-254 (data_classification)
api/libs/oauth.py:55-55 (data_classification)
api/extensions/storage/clickzetta_volume/clickzetta_volume_storage.py:29-29 (data_classification)
api/providers/trace/trace-mlflow/src/dify_trace_mlflow/config.py:15-15 (data_classification)
api/controllers/console/auth/activate.py:28-28 (data_classification)
api/controllers/console/auth/oauth_server.py:60-60 (data_classification)
api/providers/vdb/vdb-clickzetta/src/dify_vdb_clickzetta/clickzetta_vector.py:39-39 (data_classification)
api/controllers/openapi/_models.py:394-394 (data_classification)
api/extensions/ext_celery.py:18-18 (data_classification)
api/providers/vdb/vdb-elasticsearch/src/dify_vdb_elasticsearch/elasticsearch_vector.py:30-30 (data_classification)
api/controllers/openapi/_models.py:432-432 (data_classification)
api/controllers/openapi/auth/data.py:39-39 (data_classification)
api/providers/vdb/vdb-vastbase/src/dify_vdb_vastbase/vastbase_vector.py:24-24 (data_classification)
api/providers/vdb/vdb-oceanbase/src/dify_vdb_oceanbase/oceanbase_vector.py:38-38 (data_classification)
api/services/entities/auth_entities.py:43-43 (data_classification)
api/providers/vdb/vdb-tidb-vector/src/dify_vdb_tidb_vector/tidb_vector.py:28-28 (data_classification)
api/providers/vdb/vdb-milvus/src/dify_vdb_milvus/milvus_vector.py:40-40 (data_classification)
api/controllers/console/auth/login.py:79-79 (data_classification)
scripts/stress-test/common/config_helper.py:11-11 (data_classification)
api/controllers/console/auth/activate.py:56-56 (data_classification)
api/services/entities/auth_entities.py:53-53 (data_classification)
api/controllers/console/workspace/account.py:163-163 (data_classification)
api/controllers/console/workspace/account.py:174-174 (data_classification)
api/controllers/console/workspace/account.py:122-122 (data_classification)
api/controllers/console/auth/email_register.py:38-38 (data_classification)
api/models/agent_config_entities.py:489-489 (data_classification)
api/providers/vdb/vdb-relyt/src/dify_vdb_relyt/relyt_vector.py:36-36 (data_classification)
api/controllers/web/login.py:62-62 (data_classification)
api/controllers/console/auth/login.py:84-84 (data_classification)
api/services/enterprise/rbac_service.py:96-96 (data_classification)
api/core/workflow/human_input_adapter.py:52-52 (data_classification)
api/controllers/openapi/_models.py:371-371 (data_classification)
api/controllers/common/fields.py:99-99 (data_classification)
api/controllers/console/app/workflow_comment.py:58-58 (data_classification)
api/providers/vdb/vdb-huawei-cloud/src/dify_vdb_huawei_cloud/huawei_cloud_vector.py:43-43 (data_classification)
api/controllers/console/workspace/members.py:89-89 (data_classification)
api/providers/vdb/vdb-lindorm/src/dify_vdb_lindorm/lindorm_vector.py:41-41 (data_classification)
api/services/entities/auth_entities.py:48-48 (data_classification)
api/services/account_service.py:100-100 (data_classification)
api/core/app/apps/common/workflow_response_converter.py:100-100 (data_classification)
api/providers/vdb/vdb-pgvector/src/dify_vdb_pgvector/pgvector.py:29-29 (data_classification)
api/controllers/console/init_validate.py:20-20 (data_classification)
High SOC2_P5_1 — Data Subject Access to Personal Information Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Consent Management, Encryption At Rest, Encryption In Transit, Key Management
api/models/dataset.py:1404-1404 (data_classification)
api/models/account.py:97-97 (data_classification)
api/controllers/console/setup.py:20-20 (data_classification)
api/controllers/console/workspace/members.py:83-83 (data_classification)
api/fields/conversation_fields.py:199-199 (data_classification)
api/providers/vdb/vdb-couchbase/src/dify_vdb_couchbase/couchbase_vector.py:33-33 (data_classification)
api/providers/vdb/vdb-milvus/src/dify_vdb_milvus/milvus_vector.py:27-27 (data_classification)
api/libs/oauth.py:50-50 (data_classification)
api/providers/vdb/vdb-pgvecto-rs/src/dify_vdb_pgvecto_rs/pgvecto_rs.py:31-31 (data_classification)
api/fields/member_fields.py:47-47 (data_classification)
api/fields/member_fields.py:14-14 (data_classification)
api/controllers/console/auth/forgot_password.py:39-39 (data_classification)
cli/src/commands/get/member/handlers.ts:19-19 (data_classification)
api/controllers/console/explore/trial.py:354-354 (data_classification)
api/controllers/console/auth/email_register.py:33-33 (data_classification)
api/controllers/console/workspace/account.py:139-139 (data_classification)
api/providers/vdb/vdb-oracle/src/dify_vdb_oracle/oraclevector.py:42-42 (data_classification)
api/providers/vdb/vdb-myscale/src/dify_vdb_myscale/myscale_vector.py:28-28 (data_classification)
api/services/entities/auth_entities.py:85-85 (data_classification)
api/controllers/console/auth/activate.py:22-22 (data_classification)
api/providers/vdb/vdb-oracle/src/dify_vdb_oracle/oraclevector.py:30-30 (data_classification)
api/libs/oauth.py:41-41 (data_classification)
api/controllers/console/workspace/members.py:77-77 (data_classification)
api/controllers/console/workspace/account.py:156-156 (data_classification)
api/providers/vdb/vdb-matrixone/src/dify_vdb_matrixone/matrixone_vector.py:40-40 (data_classification)
api/fields/member_fields.py:29-29 (data_classification)
api/providers/vdb/vdb-alibabacloud-mysql/src/dify_vdb_alibabacloud_mysql/alibabacloud_mysql_vector.py:29-29 (data_classification)
api/providers/vdb/vdb-opengauss/src/dify_vdb_opengauss/opengauss.py:24-24 (data_classification)
api/controllers/web/login.py:57-57 (data_classification)
api/controllers/openapi/_models.py:156-156 (data_classification)
api/services/enterprise/rbac_service.py:176-176 (data_classification)
api/controllers/openapi/_models.py:420-420 (data_classification)
api/providers/vdb/vdb-opensearch/src/dify_vdb_opensearch/opensearch_vector.py:46-46 (data_classification)
api/extensions/ext_redis.py:254-254 (data_classification)
api/libs/oauth.py:55-55 (data_classification)
api/extensions/storage/clickzetta_volume/clickzetta_volume_storage.py:29-29 (data_classification)
api/providers/trace/trace-mlflow/src/dify_trace_mlflow/config.py:15-15 (data_classification)
api/controllers/console/auth/activate.py:28-28 (data_classification)
api/controllers/console/auth/oauth_server.py:60-60 (data_classification)
api/providers/vdb/vdb-clickzetta/src/dify_vdb_clickzetta/clickzetta_vector.py:39-39 (data_classification)
api/controllers/openapi/_models.py:394-394 (data_classification)
api/extensions/ext_celery.py:18-18 (data_classification)
api/providers/vdb/vdb-elasticsearch/src/dify_vdb_elasticsearch/elasticsearch_vector.py:30-30 (data_classification)
api/controllers/openapi/_models.py:432-432 (data_classification)
api/controllers/openapi/auth/data.py:39-39 (data_classification)
api/providers/vdb/vdb-vastbase/src/dify_vdb_vastbase/vastbase_vector.py:24-24 (data_classification)
api/providers/vdb/vdb-oceanbase/src/dify_vdb_oceanbase/oceanbase_vector.py:38-38 (data_classification)
api/services/entities/auth_entities.py:43-43 (data_classification)
api/providers/vdb/vdb-tidb-vector/src/dify_vdb_tidb_vector/tidb_vector.py:28-28 (data_classification)
api/providers/vdb/vdb-milvus/src/dify_vdb_milvus/milvus_vector.py:40-40 (data_classification)
api/controllers/console/auth/login.py:79-79 (data_classification)
scripts/stress-test/common/config_helper.py:11-11 (data_classification)
api/controllers/console/auth/activate.py:56-56 (data_classification)
api/services/entities/auth_entities.py:53-53 (data_classification)
api/controllers/console/workspace/account.py:163-163 (data_classification)
api/controllers/console/workspace/account.py:174-174 (data_classification)
api/controllers/console/workspace/account.py:122-122 (data_classification)
api/controllers/console/auth/email_register.py:38-38 (data_classification)
api/models/agent_config_entities.py:489-489 (data_classification)
api/providers/vdb/vdb-relyt/src/dify_vdb_relyt/relyt_vector.py:36-36 (data_classification)
api/controllers/web/login.py:62-62 (data_classification)
api/controllers/console/auth/login.py:84-84 (data_classification)
api/services/enterprise/rbac_service.py:96-96 (data_classification)
api/core/workflow/human_input_adapter.py:52-52 (data_classification)
api/controllers/openapi/_models.py:371-371 (data_classification)
api/controllers/common/fields.py:99-99 (data_classification)
api/controllers/console/app/workflow_comment.py:58-58 (data_classification)
api/providers/vdb/vdb-huawei-cloud/src/dify_vdb_huawei_cloud/huawei_cloud_vector.py:43-43 (data_classification)
api/controllers/console/workspace/members.py:89-89 (data_classification)
api/providers/vdb/vdb-lindorm/src/dify_vdb_lindorm/lindorm_vector.py:41-41 (data_classification)
api/services/entities/auth_entities.py:48-48 (data_classification)
api/services/account_service.py:100-100 (data_classification)
api/core/app/apps/common/workflow_response_converter.py:100-100 (data_classification)
api/providers/vdb/vdb-pgvector/src/dify_vdb_pgvector/pgvector.py:29-29 (data_classification)
api/controllers/console/init_validate.py:20-20 (data_classification)
High SOC2_CC6_5 — Discontinuation of Protections Code Improvement Recommended
Satisfied: Data Classification, Data Lifecycle Management
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
api/models/dataset.py:1404-1404 (data_classification)
api/models/account.py:97-97 (data_classification)
api/controllers/console/setup.py:20-20 (data_classification)
api/controllers/console/workspace/members.py:83-83 (data_classification)
api/controllers/web/login.py:57-57 (data_minimization_module_fanin)
api/fields/conversation_fields.py:199-199 (data_classification)
api/providers/vdb/vdb-alibabacloud-mysql/src/dify_vdb_alibabacloud_mysql/alibabacloud_mysql_vector.py:29-29 (data_minimization_module_fanin)
api/providers/vdb/vdb-couchbase/src/dify_vdb_couchbase/couchbase_vector.py:33-33 (data_classification)
api/providers/vdb/vdb-milvus/src/dify_vdb_milvus/milvus_vector.py:27-27 (data_classification)
api/libs/oauth.py:50-50 (data_classification)
api/providers/vdb/vdb-pgvecto-rs/src/dify_vdb_pgvecto_rs/pgvecto_rs.py:31-31 (data_classification)
api/fields/member_fields.py:47-47 (data_classification)
api/extensions/ext_celery.py:18-18 (data_minimization_module_fanin)
api/fields/member_fields.py:14-14 (data_classification)
api/controllers/console/explore/trial.py:354-354 (data_minimization_module_fanin)
api/controllers/console/auth/forgot_password.py:39-39 (data_classification)
cli/src/commands/get/member/handlers.ts:19-19 (data_classification)
api/providers/vdb/vdb-lindorm/src/dify_vdb_lindorm/lindorm_vector.py:41-41 (data_minimization_module_fanin)
api/controllers/console/explore/trial.py:354-354 (data_classification)
api/controllers/console/auth/email_register.py:33-33 (data_classification)
api/controllers/console/workspace/account.py:139-139 (data_classification)
api/providers/vdb/vdb-oracle/src/dify_vdb_oracle/oraclevector.py:42-42 (data_classification)
api/controllers/console/auth/forgot_password.py:39-39 (data_minimization_module_fanin)
api/providers/vdb/vdb-myscale/src/dify_vdb_myscale/myscale_vector.py:28-28 (data_classification)
api/services/entities/auth_entities.py:85-85 (data_classification)
api/providers/vdb/vdb-opengauss/src/dify_vdb_opengauss/opengauss.py:24-24 (data_minimization_module_fanin)
api/controllers/console/auth/activate.py:22-22 (data_classification)
api/providers/vdb/vdb-oracle/src/dify_vdb_oracle/oraclevector.py:30-30 (data_classification)
api/libs/oauth.py:41-41 (data_classification)
api/controllers/console/workspace/members.py:77-77 (data_classification)
api/controllers/console/workspace/account.py:156-156 (data_classification)
api/extensions/storage/clickzetta_volume/clickzetta_volume_storage.py:29-29 (data_minimization_module_fanin)
api/providers/vdb/vdb-pgvecto-rs/src/dify_vdb_pgvecto_rs/pgvecto_rs.py:31-31 (data_minimization_module_fanin)
api/providers/vdb/vdb-matrixone/src/dify_vdb_matrixone/matrixone_vector.py:40-40 (data_classification)
api/providers/vdb/vdb-milvus/src/dify_vdb_milvus/milvus_vector.py:27-27 (data_minimization_module_fanin)
api/fields/member_fields.py:29-29 (data_classification)
api/providers/vdb/vdb-alibabacloud-mysql/src/dify_vdb_alibabacloud_mysql/alibabacloud_mysql_vector.py:29-29 (data_classification)
api/controllers/console/workspace/members.py:77-77 (data_minimization_module_fanin)
api/providers/vdb/vdb-vastbase/src/dify_vdb_vastbase/vastbase_vector.py:24-24 (data_minimization_module_fanin)
api/providers/vdb/vdb-opengauss/src/dify_vdb_opengauss/opengauss.py:24-24 (data_classification)
api/providers/trace/trace-mlflow/src/dify_trace_mlflow/config.py:15-15 (data_minimization_module_fanin)
api/controllers/web/login.py:57-57 (data_classification)
api/controllers/console/auth/email_register.py:33-33 (data_minimization_module_fanin)
api/controllers/openapi/_models.py:156-156 (data_classification)
api/providers/vdb/vdb-elasticsearch/src/dify_vdb_elasticsearch/elasticsearch_vector.py:30-30 (data_minimization_module_fanin)
api/providers/vdb/vdb-myscale/src/dify_vdb_myscale/myscale_vector.py:28-28 (data_minimization_module_fanin)
api/services/enterprise/rbac_service.py:176-176 (data_classification)
api/controllers/openapi/_models.py:420-420 (data_classification)
api/providers/vdb/vdb-oracle/src/dify_vdb_oracle/oraclevector.py:30-30 (data_minimization_module_fanin)
api/providers/vdb/vdb-opensearch/src/dify_vdb_opensearch/opensearch_vector.py:46-46 (data_classification)
api/extensions/ext_redis.py:254-254 (data_classification)
api/libs/oauth.py:55-55 (data_classification)
api/extensions/storage/clickzetta_volume/clickzetta_volume_storage.py:29-29 (data_classification)
api/providers/trace/trace-mlflow/src/dify_trace_mlflow/config.py:15-15 (data_classification)
api/controllers/console/auth/activate.py:28-28 (data_classification)
api/controllers/console/auth/oauth_server.py:60-60 (data_classification)
api/providers/vdb/vdb-clickzetta/src/dify_vdb_clickzetta/clickzetta_vector.py:39-39 (data_classification)
api/providers/vdb/vdb-huawei-cloud/src/dify_vdb_huawei_cloud/huawei_cloud_vector.py:43-43 (data_minimization_module_fanin)
scripts/stress-test/common/config_helper.py:11-11 (data_minimization_module_fanin)
api/controllers/openapi/_models.py:394-394 (data_classification)
api/extensions/ext_celery.py:18-18 (data_classification)
api/providers/vdb/vdb-elasticsearch/src/dify_vdb_elasticsearch/elasticsearch_vector.py:30-30 (data_classification)
api/controllers/openapi/_models.py:432-432 (data_classification)
api/controllers/openapi/auth/data.py:39-39 (data_classification)
api/providers/vdb/vdb-vastbase/src/dify_vdb_vastbase/vastbase_vector.py:24-24 (data_classification)
api/providers/vdb/vdb-oceanbase/src/dify_vdb_oceanbase/oceanbase_vector.py:38-38 (data_classification)
api/services/entities/auth_entities.py:43-43 (data_classification)
api/providers/vdb/vdb-tidb-vector/src/dify_vdb_tidb_vector/tidb_vector.py:28-28 (data_classification)
api/providers/vdb/vdb-milvus/src/dify_vdb_milvus/milvus_vector.py:40-40 (data_classification)
api/controllers/console/auth/login.py:79-79 (data_classification)
api/providers/vdb/vdb-tidb-vector/src/dify_vdb_tidb_vector/tidb_vector.py:28-28 (data_minimization_module_fanin)
scripts/stress-test/common/config_helper.py:11-11 (data_classification)
api/controllers/console/auth/activate.py:56-56 (data_classification)
api/services/entities/auth_entities.py:53-53 (data_classification)
api/controllers/console/workspace/account.py:163-163 (data_classification)
api/providers/vdb/vdb-matrixone/src/dify_vdb_matrixone/matrixone_vector.py:40-40 (data_minimization_module_fanin)
api/controllers/console/workspace/account.py:174-174 (data_classification)
api/controllers/console/workspace/account.py:122-122 (data_classification)
api/controllers/console/auth/email_register.py:38-38 (data_classification)
api/models/agent_config_entities.py:489-489 (data_classification)
api/providers/vdb/vdb-relyt/src/dify_vdb_relyt/relyt_vector.py:36-36 (data_classification)
api/controllers/web/login.py:62-62 (data_classification)
api/controllers/console/auth/login.py:84-84 (data_classification)
api/providers/vdb/vdb-clickzetta/src/dify_vdb_clickzetta/clickzetta_vector.py:39-39 (data_minimization_module_fanin)
api/services/enterprise/rbac_service.py:96-96 (data_classification)
api/controllers/console/init_validate.py:20-20 (data_minimization_module_fanin)
api/core/workflow/human_input_adapter.py:52-52 (data_classification)
api/controllers/console/auth/oauth_server.py:60-60 (data_minimization_module_fanin)
api/controllers/openapi/_models.py:371-371 (data_classification)
api/controllers/common/fields.py:99-99 (data_classification)
api/providers/vdb/vdb-couchbase/src/dify_vdb_couchbase/couchbase_vector.py:33-33 (data_minimization_module_fanin)
api/controllers/console/app/workflow_comment.py:58-58 (data_classification)
api/providers/vdb/vdb-oceanbase/src/dify_vdb_oceanbase/oceanbase_vector.py:38-38 (data_minimization_module_fanin)
api/providers/vdb/vdb-huawei-cloud/src/dify_vdb_huawei_cloud/huawei_cloud_vector.py:43-43 (data_classification)
api/providers/vdb/vdb-pgvector/src/dify_vdb_pgvector/pgvector.py:29-29 (data_minimization_module_fanin)
api/controllers/console/workspace/members.py:89-89 (data_classification)
api/providers/vdb/vdb-lindorm/src/dify_vdb_lindorm/lindorm_vector.py:41-41 (data_classification)
api/services/entities/auth_entities.py:48-48 (data_classification)
api/services/account_service.py:100-100 (data_classification)
api/controllers/console/auth/activate.py:22-22 (data_minimization_module_fanin)
api/core/app/apps/common/workflow_response_converter.py:100-100 (data_classification)
api/providers/vdb/vdb-pgvector/src/dify_vdb_pgvector/pgvector.py:29-29 (data_classification)
api/controllers/console/workspace/account.py:122-122 (data_minimization_module_fanin)
api/controllers/console/init_validate.py:20-20 (data_classification)
High EU_AI_ART_18_001 — Documentation Keeping Code Improvement Recommended
Satisfied: Data Lifecycle Management
api/controllers/web/login.py:57-57 (data_minimization_module_fanin)
api/providers/vdb/vdb-alibabacloud-mysql/src/dify_vdb_alibabacloud_mysql/alibabacloud_mysql_vector.py:29-29 (data_minimization_module_fanin)
api/extensions/ext_celery.py:18-18 (data_minimization_module_fanin)
api/controllers/console/explore/trial.py:354-354 (data_minimization_module_fanin)
api/providers/vdb/vdb-lindorm/src/dify_vdb_lindorm/lindorm_vector.py:41-41 (data_minimization_module_fanin)
api/controllers/console/auth/forgot_password.py:39-39 (data_minimization_module_fanin)
api/providers/vdb/vdb-opengauss/src/dify_vdb_opengauss/opengauss.py:24-24 (data_minimization_module_fanin)
api/extensions/storage/clickzetta_volume/clickzetta_volume_storage.py:29-29 (data_minimization_module_fanin)
api/providers/vdb/vdb-pgvecto-rs/src/dify_vdb_pgvecto_rs/pgvecto_rs.py:31-31 (data_minimization_module_fanin)
api/providers/vdb/vdb-milvus/src/dify_vdb_milvus/milvus_vector.py:27-27 (data_minimization_module_fanin)
api/controllers/console/workspace/members.py:77-77 (data_minimization_module_fanin)
api/providers/vdb/vdb-vastbase/src/dify_vdb_vastbase/vastbase_vector.py:24-24 (data_minimization_module_fanin)
api/providers/trace/trace-mlflow/src/dify_trace_mlflow/config.py:15-15 (data_minimization_module_fanin)
api/controllers/console/auth/email_register.py:33-33 (data_minimization_module_fanin)
api/providers/vdb/vdb-elasticsearch/src/dify_vdb_elasticsearch/elasticsearch_vector.py:30-30 (data_minimization_module_fanin)
api/providers/vdb/vdb-myscale/src/dify_vdb_myscale/myscale_vector.py:28-28 (data_minimization_module_fanin)
api/providers/vdb/vdb-oracle/src/dify_vdb_oracle/oraclevector.py:30-30 (data_minimization_module_fanin)
api/providers/vdb/vdb-huawei-cloud/src/dify_vdb_huawei_cloud/huawei_cloud_vector.py:43-43 (data_minimization_module_fanin)
scripts/stress-test/common/config_helper.py:11-11 (data_minimization_module_fanin)
api/providers/vdb/vdb-tidb-vector/src/dify_vdb_tidb_vector/tidb_vector.py:28-28 (data_minimization_module_fanin)
api/providers/vdb/vdb-matrixone/src/dify_vdb_matrixone/matrixone_vector.py:40-40 (data_minimization_module_fanin)
api/providers/vdb/vdb-clickzetta/src/dify_vdb_clickzetta/clickzetta_vector.py:39-39 (data_minimization_module_fanin)
api/controllers/console/init_validate.py:20-20 (data_minimization_module_fanin)
api/controllers/console/auth/oauth_server.py:60-60 (data_minimization_module_fanin)
api/providers/vdb/vdb-couchbase/src/dify_vdb_couchbase/couchbase_vector.py:33-33 (data_minimization_module_fanin)
api/providers/vdb/vdb-oceanbase/src/dify_vdb_oceanbase/oceanbase_vector.py:38-38 (data_minimization_module_fanin)
api/providers/vdb/vdb-pgvector/src/dify_vdb_pgvector/pgvector.py:29-29 (data_minimization_module_fanin)
api/controllers/console/auth/activate.py:22-22 (data_minimization_module_fanin)
api/controllers/console/workspace/account.py:122-122 (data_minimization_module_fanin)
High EU_AI_ART_19_001 — Retention of Automatically Generated Logs Code Improvement Recommended
Satisfied: Data Lifecycle Management
Missing: Audit Logging, Data Retention
api/controllers/web/login.py:57-57 (data_minimization_module_fanin)
api/providers/vdb/vdb-alibabacloud-mysql/src/dify_vdb_alibabacloud_mysql/alibabacloud_mysql_vector.py:29-29 (data_minimization_module_fanin)
api/extensions/ext_celery.py:18-18 (data_minimization_module_fanin)
api/controllers/console/explore/trial.py:354-354 (data_minimization_module_fanin)
api/providers/vdb/vdb-lindorm/src/dify_vdb_lindorm/lindorm_vector.py:41-41 (data_minimization_module_fanin)
api/controllers/console/auth/forgot_password.py:39-39 (data_minimization_module_fanin)
api/providers/vdb/vdb-opengauss/src/dify_vdb_opengauss/opengauss.py:24-24 (data_minimization_module_fanin)
api/extensions/storage/clickzetta_volume/clickzetta_volume_storage.py:29-29 (data_minimization_module_fanin)
api/providers/vdb/vdb-pgvecto-rs/src/dify_vdb_pgvecto_rs/pgvecto_rs.py:31-31 (data_minimization_module_fanin)
api/providers/vdb/vdb-milvus/src/dify_vdb_milvus/milvus_vector.py:27-27 (data_minimization_module_fanin)
api/controllers/console/workspace/members.py:77-77 (data_minimization_module_fanin)
api/providers/vdb/vdb-vastbase/src/dify_vdb_vastbase/vastbase_vector.py:24-24 (data_minimization_module_fanin)
api/providers/trace/trace-mlflow/src/dify_trace_mlflow/config.py:15-15 (data_minimization_module_fanin)
api/controllers/console/auth/email_register.py:33-33 (data_minimization_module_fanin)
api/providers/vdb/vdb-elasticsearch/src/dify_vdb_elasticsearch/elasticsearch_vector.py:30-30 (data_minimization_module_fanin)
api/providers/vdb/vdb-myscale/src/dify_vdb_myscale/myscale_vector.py:28-28 (data_minimization_module_fanin)
api/providers/vdb/vdb-oracle/src/dify_vdb_oracle/oraclevector.py:30-30 (data_minimization_module_fanin)
api/providers/vdb/vdb-huawei-cloud/src/dify_vdb_huawei_cloud/huawei_cloud_vector.py:43-43 (data_minimization_module_fanin)
scripts/stress-test/common/config_helper.py:11-11 (data_minimization_module_fanin)
api/providers/vdb/vdb-tidb-vector/src/dify_vdb_tidb_vector/tidb_vector.py:28-28 (data_minimization_module_fanin)
api/providers/vdb/vdb-matrixone/src/dify_vdb_matrixone/matrixone_vector.py:40-40 (data_minimization_module_fanin)
api/providers/vdb/vdb-clickzetta/src/dify_vdb_clickzetta/clickzetta_vector.py:39-39 (data_minimization_module_fanin)
api/controllers/console/init_validate.py:20-20 (data_minimization_module_fanin)
api/controllers/console/auth/oauth_server.py:60-60 (data_minimization_module_fanin)
api/providers/vdb/vdb-couchbase/src/dify_vdb_couchbase/couchbase_vector.py:33-33 (data_minimization_module_fanin)
api/providers/vdb/vdb-oceanbase/src/dify_vdb_oceanbase/oceanbase_vector.py:38-38 (data_minimization_module_fanin)
api/providers/vdb/vdb-pgvector/src/dify_vdb_pgvector/pgvector.py:29-29 (data_minimization_module_fanin)
api/controllers/console/auth/activate.py:22-22 (data_minimization_module_fanin)
api/controllers/console/workspace/account.py:122-122 (data_minimization_module_fanin)
High SOC2_C1_2 — Disposal of Confidential Information Code Improvement Recommended
Satisfied: Data Lifecycle Management
api/controllers/web/login.py:57-57 (data_minimization_module_fanin)
api/providers/vdb/vdb-alibabacloud-mysql/src/dify_vdb_alibabacloud_mysql/alibabacloud_mysql_vector.py:29-29 (data_minimization_module_fanin)
api/extensions/ext_celery.py:18-18 (data_minimization_module_fanin)
api/controllers/console/explore/trial.py:354-354 (data_minimization_module_fanin)
api/providers/vdb/vdb-lindorm/src/dify_vdb_lindorm/lindorm_vector.py:41-41 (data_minimization_module_fanin)
api/controllers/console/auth/forgot_password.py:39-39 (data_minimization_module_fanin)
api/providers/vdb/vdb-opengauss/src/dify_vdb_opengauss/opengauss.py:24-24 (data_minimization_module_fanin)
api/extensions/storage/clickzetta_volume/clickzetta_volume_storage.py:29-29 (data_minimization_module_fanin)
api/providers/vdb/vdb-pgvecto-rs/src/dify_vdb_pgvecto_rs/pgvecto_rs.py:31-31 (data_minimization_module_fanin)
api/providers/vdb/vdb-milvus/src/dify_vdb_milvus/milvus_vector.py:27-27 (data_minimization_module_fanin)
api/controllers/console/workspace/members.py:77-77 (data_minimization_module_fanin)
api/providers/vdb/vdb-vastbase/src/dify_vdb_vastbase/vastbase_vector.py:24-24 (data_minimization_module_fanin)
api/providers/trace/trace-mlflow/src/dify_trace_mlflow/config.py:15-15 (data_minimization_module_fanin)
api/controllers/console/auth/email_register.py:33-33 (data_minimization_module_fanin)
api/providers/vdb/vdb-elasticsearch/src/dify_vdb_elasticsearch/elasticsearch_vector.py:30-30 (data_minimization_module_fanin)
api/providers/vdb/vdb-myscale/src/dify_vdb_myscale/myscale_vector.py:28-28 (data_minimization_module_fanin)
api/providers/vdb/vdb-oracle/src/dify_vdb_oracle/oraclevector.py:30-30 (data_minimization_module_fanin)
api/providers/vdb/vdb-huawei-cloud/src/dify_vdb_huawei_cloud/huawei_cloud_vector.py:43-43 (data_minimization_module_fanin)
scripts/stress-test/common/config_helper.py:11-11 (data_minimization_module_fanin)
api/providers/vdb/vdb-tidb-vector/src/dify_vdb_tidb_vector/tidb_vector.py:28-28 (data_minimization_module_fanin)
api/providers/vdb/vdb-matrixone/src/dify_vdb_matrixone/matrixone_vector.py:40-40 (data_minimization_module_fanin)
api/providers/vdb/vdb-clickzetta/src/dify_vdb_clickzetta/clickzetta_vector.py:39-39 (data_minimization_module_fanin)
api/controllers/console/init_validate.py:20-20 (data_minimization_module_fanin)
api/controllers/console/auth/oauth_server.py:60-60 (data_minimization_module_fanin)
api/providers/vdb/vdb-couchbase/src/dify_vdb_couchbase/couchbase_vector.py:33-33 (data_minimization_module_fanin)
api/providers/vdb/vdb-oceanbase/src/dify_vdb_oceanbase/oceanbase_vector.py:38-38 (data_minimization_module_fanin)
api/providers/vdb/vdb-pgvector/src/dify_vdb_pgvector/pgvector.py:29-29 (data_minimization_module_fanin)
api/controllers/console/auth/activate.py:22-22 (data_minimization_module_fanin)
api/controllers/console/workspace/account.py:122-122 (data_minimization_module_fanin)
High SOC2_P4_2 — Retention of Personal Information Code Improvement Recommended
Satisfied: Data Lifecycle Management
Missing: Data Retention
api/controllers/web/login.py:57-57 (data_minimization_module_fanin)
api/providers/vdb/vdb-alibabacloud-mysql/src/dify_vdb_alibabacloud_mysql/alibabacloud_mysql_vector.py:29-29 (data_minimization_module_fanin)
api/extensions/ext_celery.py:18-18 (data_minimization_module_fanin)
api/controllers/console/explore/trial.py:354-354 (data_minimization_module_fanin)
api/providers/vdb/vdb-lindorm/src/dify_vdb_lindorm/lindorm_vector.py:41-41 (data_minimization_module_fanin)
api/controllers/console/auth/forgot_password.py:39-39 (data_minimization_module_fanin)
api/providers/vdb/vdb-opengauss/src/dify_vdb_opengauss/opengauss.py:24-24 (data_minimization_module_fanin)
api/extensions/storage/clickzetta_volume/clickzetta_volume_storage.py:29-29 (data_minimization_module_fanin)
api/providers/vdb/vdb-pgvecto-rs/src/dify_vdb_pgvecto_rs/pgvecto_rs.py:31-31 (data_minimization_module_fanin)
api/providers/vdb/vdb-milvus/src/dify_vdb_milvus/milvus_vector.py:27-27 (data_minimization_module_fanin)
api/controllers/console/workspace/members.py:77-77 (data_minimization_module_fanin)
api/providers/vdb/vdb-vastbase/src/dify_vdb_vastbase/vastbase_vector.py:24-24 (data_minimization_module_fanin)
api/providers/trace/trace-mlflow/src/dify_trace_mlflow/config.py:15-15 (data_minimization_module_fanin)
api/controllers/console/auth/email_register.py:33-33 (data_minimization_module_fanin)
api/providers/vdb/vdb-elasticsearch/src/dify_vdb_elasticsearch/elasticsearch_vector.py:30-30 (data_minimization_module_fanin)
api/providers/vdb/vdb-myscale/src/dify_vdb_myscale/myscale_vector.py:28-28 (data_minimization_module_fanin)
api/providers/vdb/vdb-oracle/src/dify_vdb_oracle/oraclevector.py:30-30 (data_minimization_module_fanin)
api/providers/vdb/vdb-huawei-cloud/src/dify_vdb_huawei_cloud/huawei_cloud_vector.py:43-43 (data_minimization_module_fanin)
scripts/stress-test/common/config_helper.py:11-11 (data_minimization_module_fanin)
api/providers/vdb/vdb-tidb-vector/src/dify_vdb_tidb_vector/tidb_vector.py:28-28 (data_minimization_module_fanin)
api/providers/vdb/vdb-matrixone/src/dify_vdb_matrixone/matrixone_vector.py:40-40 (data_minimization_module_fanin)
api/providers/vdb/vdb-clickzetta/src/dify_vdb_clickzetta/clickzetta_vector.py:39-39 (data_minimization_module_fanin)
api/controllers/console/init_validate.py:20-20 (data_minimization_module_fanin)
api/controllers/console/auth/oauth_server.py:60-60 (data_minimization_module_fanin)
api/providers/vdb/vdb-couchbase/src/dify_vdb_couchbase/couchbase_vector.py:33-33 (data_minimization_module_fanin)
api/providers/vdb/vdb-oceanbase/src/dify_vdb_oceanbase/oceanbase_vector.py:38-38 (data_minimization_module_fanin)
api/providers/vdb/vdb-pgvector/src/dify_vdb_pgvector/pgvector.py:29-29 (data_minimization_module_fanin)
api/controllers/console/auth/activate.py:22-22 (data_minimization_module_fanin)
api/controllers/console/workspace/account.py:122-122 (data_minimization_module_fanin)
High SOC2_P4_3 — Disposal of Personal Information Code Improvement Recommended
Satisfied: Data Lifecycle Management
api/controllers/web/login.py:57-57 (data_minimization_module_fanin)
api/providers/vdb/vdb-alibabacloud-mysql/src/dify_vdb_alibabacloud_mysql/alibabacloud_mysql_vector.py:29-29 (data_minimization_module_fanin)
api/extensions/ext_celery.py:18-18 (data_minimization_module_fanin)
api/controllers/console/explore/trial.py:354-354 (data_minimization_module_fanin)
api/providers/vdb/vdb-lindorm/src/dify_vdb_lindorm/lindorm_vector.py:41-41 (data_minimization_module_fanin)
api/controllers/console/auth/forgot_password.py:39-39 (data_minimization_module_fanin)
api/providers/vdb/vdb-opengauss/src/dify_vdb_opengauss/opengauss.py:24-24 (data_minimization_module_fanin)
api/extensions/storage/clickzetta_volume/clickzetta_volume_storage.py:29-29 (data_minimization_module_fanin)
api/providers/vdb/vdb-pgvecto-rs/src/dify_vdb_pgvecto_rs/pgvecto_rs.py:31-31 (data_minimization_module_fanin)
api/providers/vdb/vdb-milvus/src/dify_vdb_milvus/milvus_vector.py:27-27 (data_minimization_module_fanin)
api/controllers/console/workspace/members.py:77-77 (data_minimization_module_fanin)
api/providers/vdb/vdb-vastbase/src/dify_vdb_vastbase/vastbase_vector.py:24-24 (data_minimization_module_fanin)
api/providers/trace/trace-mlflow/src/dify_trace_mlflow/config.py:15-15 (data_minimization_module_fanin)
api/controllers/console/auth/email_register.py:33-33 (data_minimization_module_fanin)
api/providers/vdb/vdb-elasticsearch/src/dify_vdb_elasticsearch/elasticsearch_vector.py:30-30 (data_minimization_module_fanin)
api/providers/vdb/vdb-myscale/src/dify_vdb_myscale/myscale_vector.py:28-28 (data_minimization_module_fanin)
api/providers/vdb/vdb-oracle/src/dify_vdb_oracle/oraclevector.py:30-30 (data_minimization_module_fanin)
api/providers/vdb/vdb-huawei-cloud/src/dify_vdb_huawei_cloud/huawei_cloud_vector.py:43-43 (data_minimization_module_fanin)
scripts/stress-test/common/config_helper.py:11-11 (data_minimization_module_fanin)
api/providers/vdb/vdb-tidb-vector/src/dify_vdb_tidb_vector/tidb_vector.py:28-28 (data_minimization_module_fanin)
api/providers/vdb/vdb-matrixone/src/dify_vdb_matrixone/matrixone_vector.py:40-40 (data_minimization_module_fanin)
api/providers/vdb/vdb-clickzetta/src/dify_vdb_clickzetta/clickzetta_vector.py:39-39 (data_minimization_module_fanin)
api/controllers/console/init_validate.py:20-20 (data_minimization_module_fanin)
api/controllers/console/auth/oauth_server.py:60-60 (data_minimization_module_fanin)
api/providers/vdb/vdb-couchbase/src/dify_vdb_couchbase/couchbase_vector.py:33-33 (data_minimization_module_fanin)
api/providers/vdb/vdb-oceanbase/src/dify_vdb_oceanbase/oceanbase_vector.py:38-38 (data_minimization_module_fanin)
api/providers/vdb/vdb-pgvector/src/dify_vdb_pgvector/pgvector.py:29-29 (data_minimization_module_fanin)
api/controllers/console/auth/activate.py:22-22 (data_minimization_module_fanin)
api/controllers/console/workspace/account.py:122-122 (data_minimization_module_fanin)
High EU_AI_ART_10_003 — Processing of Special Categories of Personal Data for Bias Detection Code Improvement Recommended
Missing: Consent Management
High EU_AI_ART_12_001 — Logging Capabilities Code Improvement Recommended
Missing: Audit Logging
High EU_AI_ART_13_001 — Transparency and Instructions for Use Code Improvement Recommended
Missing: Consent Management
High EU_AI_ART_22_001 — Authorised Representative of Providers Established in Third Countries Code Improvement Recommended
Missing: Access Control
High EU_AI_ART_27_002 — Notification of Fundamental Rights Impact Assessment Code Improvement Recommended
Missing: Audit Logging
High EU_AI_ART_50_001 — Transparency - Interaction with AI Systems Code Improvement Recommended
Missing: Consent Management
High EU_AI_ART_50_003 — Transparency - Emotion Recognition and Biometric Categorisation Code Improvement Recommended
Missing: Consent Management
High EU_AI_ART_50_004 — Disclosure of Deep Fakes and AI-Generated Text Code Improvement Recommended
Missing: Consent Management
High EU_AI_ART_54_001 — Authorised Representatives of Providers of General-Purpose AI Models Code Improvement Recommended
Missing: Access Control
High EU_AI_ART_72_001 — Post-Market Monitoring System Code Improvement Recommended
Missing: Audit Logging
High EU_AI_ART_86_001 — Right to Explanation of Individual Decision-Making Code Improvement Recommended
Missing: Consent Management
High SOC2_A1_3 — Recovery Plan Testing Code Improvement Recommended
Missing: Audit Logging
High SOC2_CC4_1 — Ongoing and Separate Evaluations Code Improvement Recommended
Missing: Audit Logging
High SOC2_CC4_2 — Evaluation and Communication of Deficiencies Code Improvement Recommended
Missing: Audit Logging
High SOC2_CC7_1 — Detection and Monitoring of Vulnerabilities Code Improvement Recommended
Missing: Audit Logging
High SOC2_CC7_2 — Anomaly Monitoring and Analysis Code Improvement Recommended
Missing: Audit Logging
High SOC2_CC7_5 — Recovery from Security Incidents Code Improvement Recommended
Missing: Audit Logging
High SOC2_CC8_1 — Change Management Code Improvement Recommended
Missing: Audit Logging
High SOC2_CC9_2 — Vendor and Business Partner Risk Management Code Improvement Recommended
Missing: Access Control
High SOC2_P1_1 — Privacy Notice to Data Subjects Code Improvement Recommended
Missing: Consent Management
High SOC2_P1_2 — Privacy Notice Maintenance Code Improvement Recommended
Missing: Consent Management
High SOC2_P2_1 — Choice and Consent Communication Code Improvement Recommended
Missing: Consent Management
High SOC2_P3_2 — Explicit Consent for Collection Code Improvement Recommended
Missing: Consent Management
High SOC2_P5_2 — Correction of Personal Information Code Improvement Recommended
Missing: Consent Management
High SOC2_P6_1 — Disclosure of Personal Information to Third Parties Code Improvement Recommended
Missing: Access Control, Consent Management
High SOC2_P6_2 — Record of Authorized Disclosures Code Improvement Recommended
Missing: Audit Logging

Control Mapping Appendix

Raw control-level mapping (control IDs, clause text) is intentionally not inlined here — export to JSON or SARIF for the complete, machine-readable control mapping.