Compliance
In-depth guides and analysis on compliance from the Safeguard engineering team.
100 articles
Is Your AI Model Personal Data? The EDPB's Anonymity Test and What to Document
When is an AI model anonymous under GDPR? The EDPB's two-part test, the evidence it expects, the draft 2026 anonymization guidelines, and a gap checker.
FDA Predetermined Change Control Plans for AI Devices: What Section 515C, the Guidance and 21 CFR 892.2055 Require
How an FDA PCCP lets an AI medical device ship model updates without a new 510(k): the statute, the guidance status, the first PCCP device rule and a gate.
CERT-In SBOM Guidelines v2.0: The 21 Data Fields, Mapped to CycloneDX
CERT-In's Technical Guidelines on SBOM, QBOM and CBOM, AIBOM and HBOM (v2.0, 9 July 2025) ask for 21 data fields per component. How binding they are, where each field goes in CycloneDX, why the sample pkg:supplier identifier isn't a valid Package URL type, the VEX and newer BOM sections, and a stdlib checker.
What should a yearly audit calendar look like for a small SaaS team?
A simple monthly, quarterly and yearly calendar of evidence tasks, with a named owner for each, so nothing waits for the week before the auditor arrives.
How do you write a security exception renewal request?
A renewal request should show what changed since the first approval, what the exception cost you in risk, and a firm plan to end it. A template.
How do you plan a compliance project backwards from a customer deadline?
Plan SOC 2 or ISO 27001 backwards from the date a customer needs proof: confirm what they accept, then set auditor slots, evidence windows and prep work.
Which words in vulnerability records cause audit findings?
False positive, not applicable, mitigated, accepted: loose words in tickets draw audit questions. Here is what each should mean and what to write instead.
WordPress guideline 7: must plugins ask before contacting outside servers?
The WordPress.org plugin directory requires explicit opt-in consent before a plugin contacts external servers, with data use documented. What that means.
Can a public records request expose a vendor's security documents?
Public bodies can be asked to release records, including documents vendors send. Learn what to mark, what to ask, and why exemptions are not automatic.
Why should SBOM storage be append-only instead of overwritten?
Overwriting an SBOM erases what you told a customer last quarter. Store each version, link it to a release, and keep a clear record of corrections.
Why does architecture review matter for open source license obligations?
A scan lists components, but obligations can depend on how they connect. The TODO guide adds an architecture review of linking and communication.
Who should write the control description: compliance or engineering?
Compliance should draft the control description and engineering should verify it against what actually runs. A two step workflow that avoids fiction.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.