# PhotoRobot Enterprise Compliance Sheet This document represents the PhotoRobot Enterprise Compliance Sheet in a structured, detailed, and procurement-friendly overview. ## PhotoRobot Enterprise Compliance Sheet This document represents the PhotoRobot Enterprise Compliance Sheet: **Version 1.0 — PhotoRobot Edition;** *uni-Robot Ltd., Czech Republic*. The Enterprise Compliance Sheet provides procurement-ready summary and context. Use the matrix for rapid evaluation and the explanatory sections for deeper understanding. ## Introduction - Enterprise Compliance Sheet This Enterprise Compliance Sheet provides a structured, detailed, and procurement-friendly overview of PhotoRobot’s compliance posture across key regulatory, security, privacy, and operational domains. Unlike a simple yes/no table, this document includes contextual explanations, alignment notes, control references, and links to underlying governance frameworks. It is intended as a rapid vendor‑readiness resource for enterprise buyers and evaluators, especially within the United States. ## How to Use This Document Procurement teams should begin with the summary matrix and then review the explanatory sections for each requirement. Each subsection includes: - a description of the control area, - PhotoRobot’s compliance position, - references to the relevant internal policies, - operational notes and implementation details, - regional considerations (U.S. vs international). This Sheet complements, rather than replaces, the U.S. Security Overview and the International Legal & Security Pack introductions. ## Summary Compliance Matrix | Requirement | Supported | Notes | | --- | --- | --- | | SOC 2 Principles Alignment | YES | Controls aligned with Security, Availability, Confidentiality TSCs | | GDPR Compliance | YES | GDPR followed globally for uniformity | | CCPA / CPRA Alignment | YES | Consumer privacy controls implemented | | HIPAA Compatibility | OPTIONAL | Available via contractual addendum | | On-Prem Deployment | YES | Enterprise-only offering | | Hybrid Deployment | YES | Distributed-processing workflows supported | | U.S.-Only Hosting | PLANNED | Architecture prepared; region deployable | | Encryption at Rest | YES | AES-256 across databases and storage | | Encryption in Transit | YES | TLS 1.2+ system-wide | | MFA for Admin Access | YES | Required for all privileged roles | | Incident Response Framework | YES | Defined lifecycle with review gates | | Backup & Disaster Recovery | YES | Encrypted backups + tested recovery | ## SOC 2 Principles Alignment Although PhotoRobot is not yet formally SOC 2 certified, its internal control environment is deliberately designed to align with the **Security**, **Availability**, and **Confidentiality** Trust Service Criteria: - Access is restricted and logged per the **Access Control Policy**. - Infrastructure is monitored continuously according to the **Logging & Monitoring Policy**. - Change implementation follows a structured approval workflow as defined by the **Change Management Policy**. - Availability is supported via redundancy, fail-safes, and disaster recovery practices. This alignment significantly reduces the evaluation burden for enterprise customers with SOC 2 expectations. ## GDPR Compliance PhotoRobot operates under GDPR standards globally, regardless of customer location. This means: - lawful processing bases are documented, - data minimization principles are applied, - retention schedules are enforced, - deletion and access rights are supported, - privacy engineering practices influence system design. This approach simplifies compliance for multinational customers. ## CCPA / CPRA Alignment PhotoRobot supports consumer transparency and control rights consistent with California requirements: - data access, deletion, and opt-out capabilities, - clear disclosures on data use, - avoidance of selling personal information, - privacy-by-design integration. Although CCPA / CPRA do not apply to all global operations, their principles provide a strong baseline for U.S. customers. ## HIPAA Compatibility PhotoRobot is not a covered entity but can operate in a HIPAA-compatible configuration through: - business associate agreements (BAAs), - restricted logging modes, - enhanced privacy controls, - approved hosting architectures. This option is available for enterprise customers in healthcare or adjacent industries. ## Deployment Models ### On-Prem Deployment PhotoRobot offers on-prem solutions for customers requiring: - complete data residency control, - isolated network environments, - custom integration with internal systems. ### Hybrid Deployment Hybrid architectures support: - local processing for latency-sensitive workflows, - cloud-based orchestration or storage, - secure synchronization governed by the **Security Architecture Policy**. ## U.S.-Only Hosting Plan A dedicated U.S. infrastructure region is planned. The architecture is built for regional isolation and supports: - contractual commitments for data residency, - improved performance for U.S. customers, - future regulatory compliance. ## Encryption Controls All customer data benefits from: - **AES‑256 encryption at rest**, - **TLS 1.2+ encryption in transit**, - managed secret rotation policies, - restricted access to encryption keys. ## Access Control Administrative access is tightly limited: - MFA required for all privileged accounts, - role-based access enforced by policy, - automatic session expiration and anomaly detection, - regular access reviews per the **Access Control Policy**. ## Incident Response Readiness PhotoRobot maintains a structured, documented, and repeatable IR process featuring: - detection through automated monitoring, - classification logic, - containment workflows, - eradication and recovery procedures, - post-incident reviews, - corrective action tracking. ## Backup & Disaster Recovery Per the **Backup & Business Continuity Policy**, PhotoRobot maintains: - encrypted scheduled backups, - redundant storage across zones, - tested restoration procedures, - defined RTO and RPO objectives. ## Conclusion This Enterprise Compliance Sheet provides a comprehensive, procurement-ready summary of PhotoRobot’s compliance maturity. Its combination of high-level alignment, documented controls, and operational safeguards allows enterprise customers to evaluate PhotoRobot with confidence and efficiency.