Compliance isn't a feature.It's the foundation.

§164.312(a)(1) · Access Controls

Role-based access control enforced at the Policy Engine layer. Least-privilege model access by user, department, and data classification. No shared credentials.

§164.312(b) · Audit Controls

Immutable, tamper-evident audit logs for every inference event — user identity, timestamp, model used, data classification tags, and policy decisions.

§164.312(e)(1) · Transmission Security

End-to-end encryption in transit (TLS 1.3) within your environment. No transmission to external networks — PHI never leaves your perimeter.

§164.312(a)(2)(iv) · Encryption at Rest

Model weights, context stores, and audit logs encrypted at rest using AES-256. Key management remains under your control — no vendor-managed keys.

§164.308(a)(5) · Security Awareness

Governance dashboard surfaces policy violations, anomalous query patterns, and access deviations in real time — supporting ongoing workforce training and monitoring requirements.

§164.308(a)(1) · Risk Analysis

Eliminates the entire risk category of third-party AI data transmission — removing a significant HIPAA risk finding that appears in virtually every healthcare AI deployment assessment.

GOVERN

Policy Engine enforces AI-specific governance policies. Model and data usage rules version-controlled and auditable.

IDENTIFY

Full inventory of model assets, inference activity, and data classification across every workload.

PROTECT

RBAC, encryption at rest and in transit, network isolation, and policy-enforced data classification.

DETECT

Continuous monitoring of inference patterns. Anomaly detection and alerting integrated with SIEM via audit log export.

RESPOND & RECOVER

Model quarantine capability. Rollback to prior model versions. Incident evidence preserved in immutable logs.

SAFEGUARDS RULE · NPI Protection

Nonpublic personal information never transmitted outside your network. AI inference on member and customer data runs entirely within your environment — no third-party financial data processor relationship created.

VENDOR MANAGEMENT

Gridlight is an infrastructure platform — not a data processor with access to member records. Significantly simplifies your third-party vendor risk management obligations under NCUA guidance.

BOARD REPORTING

Governance dashboard provides board-level visibility into AI usage, policy compliance, and data handling — supporting the NCUA requirement for board oversight of information security programs.

AC — Access Control

RBAC and least-privilege access enforced at the control plane for all AI workloads handling CUI.

AU — Audit & Accountability

Immutable, timestamped audit trail of all inference events involving CUI — exportable to your audit system.

SC — System Protection

Network isolation ensures AI inference involving CUI never traverses untrusted networks or leaves your boundary.

Air-gap ready

Supports fully disconnected deployments with no external network dependencies for the most sensitive CUI environments.

CC6 — Logical Access

Policy Engine enforces access control criteria. All inference requests authenticated and authorized against defined policies.

CC7 — System Operations

Continuous monitoring with anomaly detection. Deviations from baseline inference patterns surfaced for review.

C1 — Confidentiality

Confidential data processed exclusively within your environment. No confidential information transmitted to or stored by Gridlight infrastructure.

P series — Privacy

Inference on personal data subject to your privacy program controls — not Gridlight's vendor policies.