Compliance overview
vulkro-sf compliance turns a scan of your Salesforce project into evidence mapped to SOC 2, HIPAA, GDPR and PCI-DSS controls.
vulkro-sf compliance bundle soc2 ./force-app -o soc2-bundle.md
vulkro-sf compliance report --framework gdpr ./force-app
Commands
| Command | Output |
|---|---|
compliance bundle <soc2|hipaa|pci> [PATH] | Auditor package (Markdown or --format json) with per-control evidence. |
compliance report --framework <sox|pci|hipaa|gdpr> [PATH] | Per-regulation report (--format table|json|markdown). |
compliance ropa [PATH] | GDPR Article 30 Record of Processing Activities, seeded from the personal-data surface. |
compliance hipaa-matrix [PATH] | HIPAA Security Rule safeguard matrix (164.308 / 164.312). |
compliance evidence-export [PATH] | One timestamped JSON evidence file for CI pipelines. |
compliance baa-verify [PATH] | Integrations with no recorded BAA / DPA (SF-COMPLIANCE-BAA-001). |
compliance attest <FILE> | SHA-256 attestation over a generated file, appended to ~/.vulkro-sf/attestations.log. --against <json> verifies it. |
compliance kpi [PATH] | Executive KPI summary. |
Use -o <file> to write to a file instead of stdout. See compliance CLI for every flag.
Exit codes: 0 generated with no failing control, 1 at least one failing control, 2 error.
Frameworks
| Framework | Salesforce controls covered | Detail |
|---|---|---|
| SOC 2 | CC6 Logical access, CC7 System operations, CC8 Change management, CC9 Risk mitigation, C1 Confidentiality | SOC 2 |
| HIPAA | 164.312(a) Access control, (b) Audit controls, (c) Integrity, (d) Authentication, (e) Transmission security | HIPAA |
| GDPR | Art. 5, 25, 30, 32, 33, 35 | GDPR |
| PCI-DSS | Card-data fields in logs and audit columns | PCI-DSS |
The per-detector map for every framework is on the compliance mapping page.
What a scanner cannot do
Vulkro produces technical evidence for a control on a given date. It does not run access reviews, write policies, sign a BAA or DPA, or own incident response. Organizational controls (SOC 2 CC1 to CC5, HIPAA administrative safeguards, GDPR controller obligations) need people and process. Vulkro does not make you compliant: the audit is yours to pass.
See also: General compliance docs