Compliance
Compliance (/compliance) holds the record-keeping the panel is obliged to
do under Vietnamese law: a tamper-evident audit chain, enforced log retention,
signed exports for an authority, personal-data consent records, the 72-hour
breach workflow, and the uptime figures the status page and SLA credits are
computed from.
The section has these pages:
| Page | Path | What it is |
|---|---|---|
| Audit | /compliance/audit | The audit chain, and the daily seal for a given day at /compliance/audit/anchor/<day>. |
| Consent | /compliance/consent | Personal-data consent records, and the data-protection impact assessment held with them. |
| Export | /compliance/export | A signed export for an authority. |
| Incidents | /compliance/incidents | The breach workflow, including the notification for one incident. |
| Retention | /compliance/retention | The enforced log-retention floor. |
| SLA | /compliance/sla | Uptime against the target, and the credit that earns. |
A public status page is served at /status, with the same data as JSON at
/status.json.
What the audit chain is, and is not
Every entry commits to the one before it, and a daily seal commits to the chain head at the end of each day. That makes an alteration or a deletion detectable: changing or removing one entry invalidates every hash after it.
It does not make alteration impossible. An operator with root owns the database file, the seal file and the signing key, and could rebuild all three into a consistent forgery. What that operator cannot do is reproduce a seal digest that has already left the machine — which is why the seals are short enough to publish, email or read out.
Retention
Nghị định 53/2022/NĐ-CP, Điều 26 khoản 3 sets two minimums: system logs kept
to support the investigation of cybersecurity offences are kept for at least 12
months, and the data a service generates about its users for at least 24 months.
The Retention page shows what is being kept and for how long, and
hitechcloudcli compliance-retention applies the floor.
SLA
The uptime target and the credit tiers live in
/etc/hitechcloud/hitechadmin/config/sla.json — a file rather than a constant,
because those numbers are a commercial promise and differ per contract. A tier
says that uptime at or above a figure earns a percentage of the period's fee
back.
From a terminal
hitechcloudcli compliance-run [-ingest|-probe|-seal|-check|-all]
hitechcloudcli compliance-retention