https://github.com/solomonkassa/jedan_auth
Jedan-Auth 🔐 authentication library built with security-first principles, offering a comprehensive suite of authentication methods, enterprise-grade security features, and exceptional developer experience.
https://github.com/solomonkassa/jedan_auth
0auth auth authentication authorization django jwt openid-connect python security two-factor-authentication
Last synced: 3 months ago
JSON representation
Jedan-Auth 🔐 authentication library built with security-first principles, offering a comprehensive suite of authentication methods, enterprise-grade security features, and exceptional developer experience.
- Host: GitHub
- URL: https://github.com/solomonkassa/jedan_auth
- Owner: Solomonkassa
- Created: 2026-02-03T09:42:26.000Z (5 months ago)
- Default Branch: main
- Last Pushed: 2026-02-03T10:15:32.000Z (5 months ago)
- Last Synced: 2026-02-03T22:25:45.226Z (5 months ago)
- Topics: 0auth, auth, authentication, authorization, django, jwt, openid-connect, python, security, two-factor-authentication
- Homepage:
- Size: 50.8 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Codeowners: .github/CODEOWNERS
- Security: .github/SECURITY.md
Awesome Lists containing this project
README
# **Jedan-Auth: File Structure & Architecture**
```bash
jedan-auth/
├── 📁 .github/ # GitHub workflows
│ ├── workflows/
│ │ ├── ci-cd.yml # CI/CD pipeline
│ │ ├── security-scan.yml # Security scanning
│ │ ├── release.yml # Automated releases
│ │ └── dependency-review.yml # Dependency checks
│ ├── CODEOWNERS
│ ├── SECURITY.md # Security policy
│ └── PULL_REQUEST_TEMPLATE.md
├── 📁 .husky/ # Git hooks
│ └── pre-commit
├── 📁 docs/ # Comprehensive documentation
│ ├── 📁 api/
│ │ ├── reference.md # API reference
│ │ ├── authentication.md # Auth flow docs
│ │ ├── security.md # Security features
│ │ └── migration.md # Migration guides
│ ├── 📁 guides/
│ │ ├── getting-started.md
│ │ ├── production-deployment.md
│ │ ├── security-hardening.md
│ │ └── custom-providers.md
│ ├── 📁 examples/
│ │ ├── django-rest-api/
│ │ ├── nextjs-frontend/
│ │ ├── microservices/
│ │ └── multi-tenant/
│ ├── 📁 architecture/
│ │ ├── data-flow.md
│ │ ├── security-model.md
│ │ └── scaling-guide.md
│ └── index.md
├── 📁 jedan_auth/ # Main package
│ ├── 📁 __pycache__/
│ ├── __init__.py # Package exports
│ ├── __main__.py # CLI entry point
│ ├── py.typed # Type hints marker
│ ├── 📁 admin/ # Django admin enhancements
│ │ ├── __init__.py
│ │ ├── dashboard.py # Security dashboard
│ │ ├── widgets.py # Custom admin widgets
│ │ └── templates/
│ │ └── admin/
│ │ ├── security_overview.html
│ │ └── user_security_detail.html
│ ├── 📁 api/ # REST API layer
│ │ ├── __init__.py
│ │ ├── 📁 v1/ # API versioning
│ │ │ ├── __init__.py
│ │ │ ├── routers.py # FastAPI/Django REST routers
│ │ │ ├── schemas.py # Pydantic schemas
│ │ │ ├── views.py # API views
│ │ │ ├── dependencies.py # FastAPI dependencies
│ │ │ └── 📁 endpoints/
│ │ │ ├── auth.py
│ │ │ ├── users.py
│ │ │ ├── sessions.py
│ │ │ ├── mfa.py
│ │ │ └── admin.py
│ │ └── 📁 v2/ # Future API version
│ │ └── __init__.py
│ ├── 📁 audit/ # Audit logging system
│ │ ├── __init__.py
│ │ ├── logger.py # Structured audit logging
│ │ ├── events.py # Audit event definitions
│ │ ├── handlers.py # Log handlers (DB, SIEM, etc.)
│ │ └── middleware.py # Audit middleware
│ ├── 📁 cli/ # Command Line Interface
│ │ ├── __init__.py
│ │ ├── main.py # CLI entry point (Typer)
│ │ ├── commands/
│ │ │ ├── init.py # Project initialization
│ │ │ ├── users.py # User management
│ │ │ ├── security.py # Security operations
│ │ │ ├── audit.py # Audit log inspection
│ │ │ └── migrate.py # Migration commands
│ │ └── utils/
│ │ ├── formatters.py # Output formatting
│ │ └── validators.py # CLI input validation
│ ├── 📁 core/ # Core authentication engine
│ │ ├── __init__.py
│ │ ├── auth.py # Main authentication class
│ │ ├── config.py # Configuration management
│ │ ├── exceptions.py # Custom exceptions
│ │ ├── models.py # Base models (abstract)
│ │ ├── managers.py # Custom model managers
│ │ └── types.py # Type definitions
│ ├── 📁 crypto/ # Cryptography utilities
│ │ ├── __init__.py
│ │ ├── hashing.py # Password hashing (Argon2, bcrypt)
│ │ ├── tokens.py # JWT token handling
│ │ ├── encryption.py # Field-level encryption
│ │ └── key_management.py # Key rotation and management
│ ├── 📁 database/ # Database layer
│ │ ├── __init__.py
│ │ ├── migrations/
│ │ │ ├── __init__.py
│ │ │ └── 0001_initial.py
│ │ ├── backends.py # Custom database backends
│ │ ├── queries.py # Optimized queries
│ │ └── redis.py # Redis client wrapper
│ ├── 📁 decorators/ # Python decorators
│ │ ├── __init__.py
│ │ ├── auth.py # @auth_required, @permission_required
│ │ ├── rate_limit.py # @rate_limit
│ │ ├── audit.py # @audit_log
│ │ └── security.py # Security decorators
│ ├── 📁 device/ # Device fingerprinting
│ │ ├── __init__.py
│ │ ├── fingerprint.py # Device identification
│ │ ├── recognition.py # Device recognition
│ │ └── models.py # Device models
│ ├── 📁 integrations/ # Third-party integrations
│ │ ├── __init__.py
│ │ ├── 📁 monitoring/
│ │ │ ├── __init__.py
│ │ │ ├── sentry.py
│ │ │ ├── datadog.py
│ │ │ └── prometheus.py # Metrics export
│ │ ├── 📁 siem/
│ │ │ ├── __init__.py
│ │ │ ├── splunk.py
│ │ │ ├── elastic.py
│ │ │ └── aws_cloudtrail.py
│ │ └── 📁 compliance/
│ │ ├── __init__.py
│ │ ├── gdpr.py
│ │ ├── hipaa.py
│ │ └── soc2.py
│ ├── 📁 middleware/ # Django/FastAPI middleware
│ │ ├── __init__.py
│ │ ├── authentication.py # Auth middleware
│ │ ├── security.py # Security headers
│ │ ├── rate_limit.py # Rate limiting middleware
│ │ └── audit.py # Request/response logging
│ ├── 📁 migrations/ # Database migrations
│ │ ├── __init__.py
│ │ └── 0001_initial.py
│ ├── 📁 models/ # Django models
│ │ ├── __init__.py
│ │ ├── user.py # Extended User model
│ │ ├── session.py # Session model
│ │ ├── device.py # Device model
│ │ ├── security.py # Security models (2FA, passkeys)
│ │ ├── audit.py # Audit log models
│ │ └── mixins.py # Model mixins
│ ├── 📁 monitoring/ # Health & monitoring
│ │ ├── __init__.py
│ │ ├── health.py # Health checks
│ │ ├── metrics.py # Prometheus metrics
│ │ ├── alerts.py # Alert management
│ │ └── dashboard.py # Monitoring dashboard
│ ├── 📁 providers/ # Authentication providers
│ │ ├── __init__.py
│ │ ├── base.py # Base provider class
│ │ ├── 📁 email/
│ │ │ ├── __init__.py
│ │ │ ├── password.py # Email/password auth
│ │ │ └── magic_link.py # Magic link auth
│ │ ├── 📁 social/
│ │ │ ├── __init__.py
│ │ │ ├── google.py
│ │ │ ├── github.py
│ │ │ ├── microsoft.py
│ │ │ ├── apple.py
│ │ │ └── oauth2.py # Base OAuth2 implementation
│ │ ├── 📁 mfa/
│ │ │ ├── __init__.py
│ │ │ ├── totp.py # TOTP authenticator
│ │ │ ├── sms.py # SMS verification
│ │ │ ├── email_otp.py # Email OTP
│ │ │ └── backup.py # Backup codes
│ │ ├── 📁 passwordless/
│ │ │ ├── __init__.py
│ │ │ ├── passkey.py # WebAuthn/FIDO2
│ │ │ ├── webauthn.py # WebAuthn implementation
│ │ │ └── biometric.py # Biometric auth
│ │ └── 📁 enterprise/
│ │ ├── __init__.py
│ │ ├── saml.py # SAML SSO
│ │ ├── ldap.py # LDAP integration
│ │ └── active_directory.py
│ ├── 📁 schemas/ # Pydantic schemas
│ │ ├── __init__.py
│ │ ├── auth.py # Auth request/response schemas
│ │ ├── user.py # User schemas
│ │ ├── security.py # Security schemas
│ │ └── validation.py # Data validation schemas
│ ├── 📁 security/ # Security subsystem
│ │ ├── __init__.py
│ │ ├── 📁 analysis/
│ │ │ ├── __init__.py
│ │ │ ├── threat.py # Threat detection
│ │ │ ├── anomaly.py # Anomaly detection
│ │ │ ├── risk.py # Risk scoring
│ │ │ └── ml_models/ # ML models for threat detection
│ │ ├── 📁 checks/
│ │ │ ├── __init__.py
│ │ │ ├── password.py # Password breach check
│ │ │ ├── session.py # Session security
│ │ │ ├── device.py # Device trust
│ │ │ └── ip_reputation.py
│ │ ├── audit.py # Security audit
│ │ ├── compliance.py # Compliance checks
│ │ ├── encryption.py # Encryption utilities
│ │ ├── firewall.py # Request filtering
│ │ ├── monitoring.py # Security monitoring
│ │ ├── policy.py # Security policies
│ │ └── validator.py # Security validation
│ ├── 📁 services/ # Business logic services
│ │ ├── __init__.py
│ │ ├── auth_service.py # Authentication service
│ │ ├── user_service.py # User management service
│ │ ├── session_service.py # Session management
│ │ ├── security_service.py # Security operations
│ │ ├── email_service.py # Email notifications
│ │ ├── notification_service.py # Multi-channel notifications
│ │ └── event_service.py # Event publishing
│ ├── 📁 signals/ # Django signals
│ │ ├── __init__.py
│ │ ├── user_signals.py
│ │ ├── security_signals.py
│ │ └── audit_signals.py
│ ├── 📁 storage/ # File/object storage
│ │ ├── __init__.py
│ │ ├── s3.py # AWS S3 integration
│ │ ├── gcs.py # Google Cloud Storage
│ │ ├── azure.py # Azure Blob Storage
│ │ └── local.py # Local file storage
│ ├── 📁 tasks/ # Async tasks (Celery)
│ │ ├── __init__.py
│ │ ├── security.py # Security scanning tasks
│ │ ├── cleanup.py # Data cleanup tasks
│ │ ├── notifications.py # Notification tasks
│ │ └── reports.py # Report generation
│ ├── 📁 templates/ # Django templates
│ │ ├── 📁 emails/
│ │ │ ├── verification.html
│ │ │ ├── password_reset.html
│ │ │ ├── magic_link.html
│ │ │ ├── security_alert.html
│ │ │ └── welcome.html
│ │ ├── 📁 admin/
│ │ │ └── security_dashboard.html
│ │ └── 📁 frontend/
│ │ ├── login.html
│ │ ├── register.html
│ │ ├── mfa.html
│ │ └── passkey.html
│ ├── 📁 testing/ # Testing infrastructure
│ │ ├── __init__.py
│ │ ├── conftest.py # Pytest configuration
│ │ ├── factories.py # Test factories
│ │ ├── fixtures.py # Test fixtures
│ │ ├── mocks.py # Mock objects
│ │ ├── 📁 integration/
│ │ │ ├── __init__.py
│ │ │ ├── test_auth.py
│ │ │ └── test_security.py
│ │ ├── 📁 security/
│ │ │ ├── __init__.py
│ │ │ ├── test_encryption.py
│ │ │ └── test_pentest.py # Penetration tests
│ │ └── 📁 performance/
│ │ ├── __init__.py
│ │ └── test_load.py
│ ├── 📁 ui/ # Frontend components (optional)
│ │ ├── 📁 react/
│ │ │ ├── src/
│ │ │ │ ├── components/
│ │ │ │ │ ├── LoginForm/
│ │ │ │ │ ├── MFAForm/
│ │ │ │ │ └── SecurityDashboard/
│ │ │ │ ├── hooks/
│ │ │ │ │ └── useAuth.js
│ │ │ │ └── sdk/
│ │ │ │ └── auth-client.js
│ │ │ └── package.json
│ │ ├── 📁 vue/
│ │ │ └── src/
│ │ ├── 📁 svelte/
│ │ │ └── src/
│ │ └── 📁 web-components/
│ │ └── dist/
│ ├── 📁 utils/ # Utility functions
│ │ ├── __init__.py
│ │ ├── datetime.py # Date/time utilities
│ │ ├── encoding.py # Encoding/decoding
│ │ ├── http.py # HTTP utilities
│ │ ├── logging.py # Logging configuration
│ │ ├── strings.py # String manipulation
│ │ ├── validation.py # General validation
│ │ └── web.py # Web utilities
│ └── 📁 webhooks/ # Webhook system
│ ├── __init__.py
│ ├── dispatcher.py # Webhook dispatcher
│ ├── events.py # Webhook event definitions
│ ├── handlers.py # Webhook handlers
│ └── security.py # Webhook security
├── 📁 examples/ # Example projects
│ ├── 📁 basic-django/
│ │ ├── manage.py
│ │ └── myproject/
│ ├── 📁 django-rest-api/
│ │ ├── docker-compose.yml
│ │ └── src/
│ ├── 📁 nextjs-frontend/
│ │ ├── pages/
│ │ └── lib/
│ ├── 📁 microservices/
│ │ ├── auth-service/
│ │ └── user-service/
│ └── 📁 multi-tenant/
│ ├── shared/
│ └── tenants/
├── 📁 tests/ # Comprehensive test suite
│ ├── __init__.py
│ ├── conftest.py
│ ├── 📁 unit/
│ │ ├── __init__.py
│ │ ├── test_auth.py
│ │ ├── test_security.py
│ │ └── test_providers.py
│ ├── 📁 integration/
│ │ ├── __init__.py
│ │ ├── test_api.py
│ │ ├── test_database.py
│ │ └── test_redis.py
│ ├── 📁 e2e/
│ │ ├── __init__.py
│ │ ├── test_auth_flows.py
│ │ └── test_security_scenarios.py
│ └── 📁 performance/
│ ├── __init__.py
│ ├── test_load.py
│ └── test_stress.py
├── 📁 scripts/ # Development & deployment scripts
│ ├── setup-dev.sh
│ ├── deploy-production.sh
│ ├── security-scan.sh
│ ├── benchmark.sh
│ ├── generate-docs.sh
│ └── backup-database.sh
├── 📁 config/ # Configuration files
│ ├── development.yaml
│ ├── production.yaml
│ ├── testing.yaml
│ ├── security-policy.yaml
│ └── compliance/
│ ├── gdpr.yaml
│ └── hipaa.yaml
├── 📁 docker/ # Docker configuration
│ ├── Dockerfile
│ ├── Dockerfile.dev
│ ├── Dockerfile.prod
│ ├── docker-compose.yml
│ ├── docker-compose.dev.yml
│ ├── docker-compose.test.yml
│ └── entrypoint.sh
├── 📁 helm/ # Kubernetes Helm charts
│ ├── Chart.yaml
│ ├── values.yaml
│ ├── templates/
│ │ ├── deployment.yaml
│ │ ├── service.yaml
│ │ ├── ingress.yaml
│ │ └── configmap.yaml
│ └── README.md
├── 📁 terraform/ # Infrastructure as Code
│ ├── main.tf
│ ├── variables.tf
│ ├── outputs.tf
│ └── modules/
│ ├── networking/
│ ├── database/
│ └── redis/
├── 📁 client-sdks/ # Generated client SDKs
│ ├── 📁 python/
│ │ ├── setup.py
│ │ └── jedan_auth_client/
│ ├── 📁 typescript/
│ │ ├── package.json
│ │ └── src/
│ ├── 📁 java/
│ │ └── pom.xml
│ ├── 📁 go/
│ │ └── go.mod
│ └── 📁 swift/
│ └── Package.swift
├── 📁 benchmarks/ # Performance benchmarks
│ ├── auth_performance.py
│ ├── security_benchmarks.py
│ └── results/
├── 📁 security/ # Security artifacts
│ ├── threat-models/
│ ├── penetration-tests/
│ ├── compliance-docs/
│ └── audit-reports/
├── 📁 monitoring/ # Monitoring configuration
│ ├── prometheus.yml
│ ├── grafana-dashboards/
│ └── alerts/
├── 📁 migrations/ # Data migration scripts
│ ├── from-allauth.py
│ ├── from-auth0.py
│ └── from-firebase.py
├── .env.example # Environment template
├── .env.test # Test environment
├── .pre-commit-config.yaml # Pre-commit hooks
├── .gitignore
├── .dockerignore
├── .editorconfig
├── .prettierrc # Code formatting
├── .eslintrc.js # JS linting
├── pyproject.toml # Python project config
├── poetry.lock # Poetry lock file
├── setup.py # Legacy setup
├── setup.cfg
├── MANIFEST.in
├── requirements.txt
├── requirements-dev.txt
├── requirements-test.txt
├── README.md # Main documentation
├── SECURITY.md # Security policy
├── CONTRIBUTING.md # Contribution guidelines
├── CODE_OF_CONDUCT.md # Community guidelines
├── CHANGELOG.md # Release history
├── LICENSE # MIT License
├── Makefile # Development tasks
├── docker-compose.yml # Local development
├── pytest.ini # Test configuration
├── mypy.ini # Type checking config
├── bandit.yml # Security scanning
├── sonar-project.properties # Code quality
├── CODEOWNERS # Repository owners
├── ROADMAP.md # Project roadmap
├── ARCHITECTURE.md # System architecture
├── API.md # API documentation
└── DEPLOYMENT.md # Deployment guide
```
## **Key Architectural Decisions**
### **1. Layered Architecture**
```
┌─────────────────────────────────────┐
│ Presentation Layer │
│ (API, CLI, Admin, Web Components) │
├─────────────────────────────────────┤
│ Application Layer │
│ (Services, Business Logic) │
├─────────────────────────────────────┤
│ Domain Layer │
│ (Models, Core, Security Policies) │
├─────────────────────────────────────┤
│ Infrastructure Layer │
│ (Database, Redis, Storage, Crypto) │
└─────────────────────────────────────┘
```
### **2. Module Dependencies**
```
jedan_auth/
├── core/ ← Independent foundation
├── security/ ← Depends on core/
├── providers/ ← Depends on core/ and security/
├── api/ ← Depends on services/ and schemas/
├── services/ ← Depends on models/, security/, providers/
└── cli/ ← Depends on all modules
```
### **3. Database Schema**
```sql
-- Main tables
users
├── id (UUID)
├── email (encrypted)
├── password_hash
├── security_score
├── is_locked
└── created_at
sessions
├── id (UUID)
├── user_id
├── device_fingerprint
├── ip_address
├── user_agent
└── expires_at
security_events
├── id
├── user_id
├── event_type
├── severity
├── metadata (JSONB)
└── created_at
passkeys
├── id
├── user_id
├── credential_id
├── public_key
└── created_at
```
### **4. Environment-Specific Configs**
```yaml
# config/development.yaml
redis:
url: "redis://localhost:6379"
security:
rate_limiting: true
encryption: false # Disable for development
# config/production.yaml
redis:
url: ${REDIS_URL}
ssl: true
security:
rate_limiting: true
encryption: true
audit_logging: true
compliance:
gdpr: true
hipaa: true
```
### **5. Deployment Structure**
```
Production Deployment:
├── Load Balancer (Nginx/Traefik)
├── Jedan-Auth API (auto-scaling)
├── PostgreSQL (HA cluster)
├── Redis (cluster mode)
├── S3/MinIO (file storage)
├── Prometheus + Grafana (monitoring)
└── Elastic Stack (logs)
```
## **Development Workflow**
### **1. Local Setup**
```bash
make setup-dev # Installs dependencies
make migrate # Runs database migrations
make seed # Seeds test data
make run-dev # Starts development server
```
### **2. Testing Pipeline**
```bash
make test # Runs all tests
make test-security # Security tests only
make lint # Code quality checks
make type-check # Type checking
make coverage # Test coverage report
```
### **3. CI/CD Pipeline**
```yaml
# .github/workflows/ci-cd.yml
name: CI/CD Pipeline
on: [push, pull_request]
jobs:
test:
runs-on: ubuntu-latest
steps:
- name: Security Scan
run: make security-scan
- name: Unit Tests
run: make test-unit
- name: Integration Tests
run: make test-integration
- name: E2E Tests
run: make test-e2e
- name: Performance Tests
run: make benchmark
deploy:
needs: test
if: github.ref == 'refs/heads/main'
runs-on: ubuntu-latest
steps:
- name: Build Docker Image
run: docker build -t jedan-auth:latest .
- name: Deploy to Production
run: make deploy-prod
```
## **Security Hardening Features**
### **1. Encryption at Rest**
```python
# jedan_auth/crypto/encryption.py
class FieldEncryption:
def __init__(self):
# Use AWS KMS, HashiCorp Vault, or local keys
self.kms_client = boto3.client('kms')
async def encrypt_field(self, value: str) -> EncryptedData:
"""Encrypt sensitive user data."""
pass
async def decrypt_field(self, encrypted: EncryptedData) -> str:
"""Decrypt sensitive user data."""
pass
```
### **2. Zero-Trust Security Model**
```python
# jedan_auth/security/policy.py
class ZeroTrustPolicy:
def evaluate_request(self, request: Request) -> RiskScore:
"""Evaluate every request based on multiple factors."""
factors = [
self.check_device_trust(request.device_id),
self.check_location(request.ip_address),
self.check_behavioral_patterns(request.user_id),
self.check_time_of_access(),
self.check_request_anomalies()
]
return self.calculate_risk_score(factors)
```
### **3. Real-time Threat Intelligence**
```python
# jedan_auth/security/analysis/threat.py
class ThreatIntelligence:
def __init__(self):
# Integrate with external threat feeds
self.feeds = [
AbuseIPDB(),
VirusTotal(),
AlienVaultOTX(),
TorExitNodes()
]
async def check_ip_reputation(self, ip: str) -> ThreatScore:
"""Check IP against multiple threat intelligence feeds."""
pass
```
## **Monitoring & Observability**
### **1. Prometheus Metrics**
```python
# jedan_auth/monitoring/metrics.py
AUTH_REQUESTS = Counter('auth_requests_total', 'Total auth requests')
FAILED_LOGINS = Counter('failed_logins_total', 'Failed login attempts')
SECURITY_EVENTS = Counter('security_events_total', 'Security events')
RESPONSE_TIME = Histogram('auth_response_time_seconds', 'Response time')
```
### **2. Structured Logging**
```python
# jedan_auth/utils/logging.py
def setup_logging():
"""Configure structured JSON logging."""
logging.config.dictConfig({
'version': 1,
'formatters': {
'json': {
'class': 'pythonjsonlogger.jsonlogger.JsonFormatter',
'format': '%(asctime)s %(name)s %(levelname)s %(message)s'
}
},
'handlers': {
'console': {
'class': 'logging.StreamHandler',
'formatter': 'json'
}
}
})
```
## **Developer Experience Features**
### **1. Auto-generated SDKs**
```bash
# Generate client SDKs from OpenAPI spec
make generate-sdk-python
make generate-sdk-typescript
make generate-sdk-java
```
### **2. Interactive Documentation**
```python
# Auto-generated API docs with Swagger/ReDoc
@app.get("/docs", include_in_schema=False)
async def custom_swagger_ui():
return get_swagger_ui_html(
openapi_url="/openapi.json",
title="Jedan-Auth API Documentation"
)
```
### **3. One-Command Deployment**
```bash
# Deploy to various platforms
jedan-auth deploy heroku
jedan-auth deploy aws
jedan-auth deploy kubernetes
jedan-auth deploy docker
```
This structure supports:
- **Enterprise scaling** with microservices-ready design
- **Comprehensive security** with defense-in-depth
- **Developer productivity** with excellent tooling
- **High availability** with proper monitoring
- **Compliance** with industry standards (GDPR, HIPAA, SOC2)