Regulatory Alignment
How Spine supports EU compliance frameworks through cryptographic audit integrity.
Important: Spine supports compliance. It is not a legal compliance authority. This page describes technical alignment, not legal certification.
Our Approach
Spine is infrastructure. It does not "certify compliance" — it enables verifiable evidence. Organizations use Spine to create tamper-evident audit trails that can be independently verified by auditors, regulators, and forensic investigators.
Frameworks Supported
DORA
Digital Operational Resilience Act
| Requirement | Spine Capability |
|---|---|
| Tamper-evident audit trails | Hash-chained WAL + Ed25519 signatures |
| External audit verification | Offline CLI verification tool |
| Incident evidence retention | Retention engine + sealed archives |
| ICT risk documentation | Forensic WAL with extended metadata |
NIS2 Directive
Network and Information Security
| Requirement | Spine Capability |
|---|---|
| Security incident logging (Art. 21) | Immutable event capture with timestamps |
| Demonstrable security measures | Cryptographic proof of log integrity |
| Incident response documentation | Sealed batch receipts + Merkle proofs |
GDPR
General Data Protection Regulation
| Requirement | Spine Capability |
|---|---|
| Data integrity (Art. 5) | BLAKE3 hash chain ensures no silent modifications |
| Security of processing (Art. 32) | Append-only storage, cryptographic sealing |
| Breach notification evidence | Timestamped, signed incident records |
MiCA
Markets in Crypto-Assets Regulation
| Requirement | Spine Capability |
|---|---|
| Order book integrity | Immutable transaction logging |
| Transaction record retention | Configurable retention with WORM support |
| Forensic-ready evidence | Court-admissible audit trails |
EU AI Act
Artificial Intelligence Act
| Requirement | Spine Capability |
|---|---|
| Automatic logging (Art. 12) | Native AIEvent type with decision metadata |
| Human oversight records (Art. 14) | HumanOversight events with approval tracking |
| Input data traceability | InputReference linking to source data |
| Audit trail for high-risk AI | Complete decision chain with Merkle proofs |
External Audit Model
No platform trust required. Auditors verify cryptographic proofs, not vendor claims.
Unlike traditional logging systems where auditors must trust the platform's integrity, Spine provides independent verification. Auditors receive data exports and use our open-source CLI to cryptographically validate every hash and signature.
Export
Request audit data for specific time range
Transfer
Receive sealed data package offline
Verify
Run CLI tool to validate all proofs
Report
Generate verification report
What Spine is NOT
Not a Certification Body
We provide infrastructure, not compliance certifications or legal opinions.
Not Legal Advice
Consult your legal and compliance teams for regulatory interpretation.
Not a Replacement
Spine complements, not replaces, your existing compliance officers and processes.
Need Detailed Mapping?
We provide comprehensive article-by-article compliance mapping documents for qualified prospects during the evaluation process.
Request Detailed DocumentationDisclaimer: This page describes technical capabilities and their alignment with regulatory requirements. It does not constitute legal advice or compliance certification. Organizations are responsible for their own compliance assessments. Spine is a technical tool that supports compliance efforts but does not guarantee regulatory compliance. Consult qualified legal and compliance professionals for specific guidance.