Compliance modes: HIPAA, SOC2, GDPR-EU, FedRAMP as configuration

Compliance work on infrastructure is usually translation labor: take a regime's controls, map each to scattered settings, document the mapping, defend it annually. The mapping rots as settings drift, and every audit re-litigates it. The fix is to make the regime itself the configuration unit.

Crowkis Enterprise ships compliance modes as presets: select HIPAA, SOC2, GDPR-EU, or FedRAMP posture and the relevant behaviors, retention rules, PII handling strictness, audit-log persistence and export, erasure workflow guarantees, configure as a coherent set. The auditor's question 'how do you ensure X?' answers with a mode name and the mode's documented contract.

flowchart TD
  W["candidate write"] --> S1["coherence · 0.30"]
  S1 --> S2["content · 0.10"]
  S2 --> S3["source trust · 0.30"]
  S3 --> S4["isolation · 0.15"]
  S4 --> S5["neighbourhood · 0.15"]
  S5 --> G{"composite ≥ 0.75?"}
  G -- yes --> OK["accepted"]
  G -- no --> NO["refused + ledger entry"]
  style OK fill:#fbe9e8,stroke:#d62221,stroke-width:2.5px
  style NO fill:#f3eee5

The underlying machinery is the same trust-and-privacy stack every edition runs, the modes tighten and document it rather than bolting on a parallel system. That matters for honesty: compliance mode is the everyday engine with stricter dials, not a demo configuration that diverges from what actually serves traffic.

#The bottom line

Regulated teams don't fear controls; they fear ambiguity about controls. Presets kill the ambiguity, and the audit meeting gets shorter, which, in compliance, is the entire definition of victory.