Home / Product / Audit & compliance
Memory your auditor can trust.
Each regulatory obligation maps to a technical control you can inspect in the open-source code.
Regulation → control
Every claim has evidence.
| Requirement | Lians control |
|---|---|
| SEC Rule 17a-4 | Append-only event log; SHA-256 hash chain; non-rewriteable WORM mode; examinable export. |
| FINRA 4511 | Immutable event_log with verifiable hash links. |
| GDPR Art. 17 (erasure) | Per-subject AES-256-GCM crypto-shred; signed erasure certificate; audit rows survive. |
| MiFID II (Art. 16, 25) | Bitemporal event_time + valid_from/valid_to; 5-year retention; as-of reconstruction. |
| HIPAA §164.312 | Per-subject encryption, audit controls, transmission security; BAA before PHI. |
| Information barriers | PostgreSQL row-level security on a barrier_group column, enforced below the app. |
| DORA | Self-hosting makes you the ICT provider; snapshot export for exit/portability; KMS-held keys. |
| EU AI Act (Art. 9–13) | Automatic event recording, tamper-evident logs, decision reproducibility via recall_at. |
| Basel III / SR 11-7 | Backtest contamination check flags lookahead bias for model-validation evidence. |
Tamper-evident audit chain
Verify the record, don't just trust it.
Every write, recall, supersession, and erasure appends a row to a SHA-256 hash chain. Each row commits to the prior hash, so altering any record breaks verification.
One call verifies every row, or pinpoints exactly where verification breaks. Full examinable export and offline-verifiable memory statements included; the algorithm is open source.
Crypto-shred erasure
Erase data without erasing evidence.
Content is encrypted under a per-subject key; erasing destroys the key, and everything under it becomes permanently unrecoverable, including in backups.
The audit chain stores only hashes, so it survives intact, with a signed erasure certificate to show for it.
Data residency
The data never leaves your perimeter.
Self-host on your Postgres and Redis. Keep the master key in your KMS. Air-gap mode blocks external data paths.