---
title: "Enterprise Security and Compliance"
source: https://docs.autohand.ai/guides/enterprise-security
---

# Enterprise Security and Compliance

Understanding SOC 2, data residency, and security controls in Autohand for enterprise deployments.

**Tip:** These guides demonstrate a modified version of the Autohand CLI built for Enterprise customers. Feel free to [fork the Autohand CLI](https://github.com/autohand/autohand-cli) to add support for these features in your own environment.

**Related Skills:** Strengthen your security posture with specialized skills from [Skilled](https://skilled.autohand.ai). Explore [security auditing skills](https://skilled.autohand.ai/categories/quality), [compliance workflows](https://skilled.autohand.ai/categories/workflows), and [infrastructure security skills](https://skilled.autohand.ai/categories/devops) for your enterprise needs.

## Security overview

Autohand is built with enterprise security requirements in mind. This guide covers the security controls, compliance certifications, and deployment options available.

-   SOC 2 Type II certified infrastructure
-   End-to-end encryption for all data
-   Role-based access control (RBAC)
-   Comprehensive audit logging

## Compliance certifications

Autohand maintains the following certifications:

-   **SOC 2 Type II**: Annual audit covering security, availability, and confidentiality
-   **GDPR**: Full compliance with EU data protection regulations
-   **HIPAA**: Available for healthcare customers (Enterprise plan)
-   **ISO 27001**: Information security management certification

Request compliance documentation from your account manager or via the admin console.

## Data handling

Understand how Autohand processes and stores your code:

``` yaml
# Data processing controls
processing:
  code_retention: session_only  # Code not persisted after session
  logs_retention: 90_days
  encryption: AES-256-GCM

# Configure data residency
residency:
  region: eu-west-1  # or us-east-1, ap-southeast-1
  backup_region: eu-central-1
```

Code context is processed in memory and not retained after sessions unless explicitly saved to your memory store.

## Access control

Configure granular permissions for your organization:

``` yaml
# .autohand/rbac.yaml
roles:
  developer:
    permissions:
      - read_code
      - execute_sessions
      - view_own_history

  lead:
    extends: developer
    permissions:
      - view_team_history
      - manage_memory

  admin:
    extends: lead
    permissions:
      - manage_users
      - configure_integrations
      - view_audit_logs
```

## Single sign-on

Integrate with your identity provider:

-   SAML 2.0 (Okta, OneLogin, Azure AD)
-   OIDC (Google Workspace, Auth0)
-   LDAP/Active Directory

``` bash
# Configure SSO
autohand admin sso configure \
  --provider okta \
  --metadata-url https://your-org.okta.com/metadata

# Test SSO integration
autohand admin sso test
```

## Audit logging

All actions are logged for compliance and security review:

``` bash
# View audit logs
autohand admin logs --type audit --last 7d

# Export for SIEM integration
autohand admin logs export \
  --format json \
  --destination s3://your-bucket/audit-logs/

# Configure log forwarding
autohand admin logs forward \
  --endpoint https://your-siem.example.com/ingest
```

## Deployment options

Choose the deployment model that meets your requirements:

-   **Cloud (SaaS)**: Fully managed, multi-tenant deployment
-   **Dedicated cloud**: Single-tenant instance in Autohand infrastructure
-   **Private cloud**: Deployed in your AWS/GCP/Azure account
-   **On-premises**: Air-gapped deployment for sensitive environments