Compliance Brief
Security & Legal
A plain-language summary of what LineageLens captures, how it stores data, and how it maps to common compliance frameworks. Built to support your certification — it does not certify you.
The EU AI Act
The EU AI Act (Articles 11, 12, 14), enforceable from August 2026, requires organizations to document which AI model generated code, what governed its generation, and what human review occurred.
LineageLens creates that audit trail automatically at the point of generation — the hash chain provides tamper evidence and the signed AI-BOM provides an exportable summary — without changing the git workflow.
The evidence you can produce
- Per-insertion provenance — prompt, model, tool, developer, file, timestamp, risk.
- Tamper-evident hash chain —
GET /integrity/verifywalks the chain and reports the first altered record. - Signed AI Bill of Materials — HMAC-signed: percent AI-authored, per-model breakdown, disclosure coverage, chain status.
- Human-review record — review queue, approvals, and audit log (Plus/Max).
- Retention & redaction policies — per-workspace controls (Max).
Where data lives
Every tier is self-hosted. There is no LineageLens cloud and we have no access to your data.
| Tier | Storage | Residency |
|---|---|---|
| Base | Local JSON (VS Code) | Developer’s machine |
| Lite | SQLite in a Docker volume | Your machine / VPS |
| Plus / Max | Your PostgreSQL (+ Neo4j) | Your infrastructure / VPC |
Security controls
- TLS 1.2 minimum enforced in the proxy.
- PBKDF2-SHA256 password hashing (390,000 iterations).
- Field-level encryption for stored integration secrets (Plus/Max).
- RBAC (admin / member), audit log, review queue (Plus/Max).
- OIDC/SSO via full discovery — Okta, Auth0, Azure AD (Max).
Honest scope
LineageLens is developer-governance tooling. RBAC, SSO, hash-chain integrity, and AI-BOM export exist but have not been validated against SOC 2 / ISO 27001 controls. The risk score is heuristic, not a SAST scanner — pair it with Snyk or Semgrep. It supports your compliance work; it does not replace your auditor.