Compliance
cloneside is designed for teams that handle regulated data. The local-first architecture means your source records never reach cloneside servers — which satisfies the most fundamental requirement of every major privacy framework: don't collect what you don't need.
This page maps cloneside's controls to HIPAA (US health data), LGPD (Brazil), and PIPEDA (Canada). It is informational — not legal advice. Engage qualified counsel before making compliance determinations.
HIPAA — Health Insurance Portability and Accountability Act (US)
| Requirement | How cloneside addresses it |
|---|---|
| PHI minimum necessary (45 CFR §164.502(b)) | cloneside never persists PHI. Scans read schema + sample rows in-memory to classify columns; no ePHI is stored or uploaded on the local path. |
| Synthetic data for development | Generated clones contain statistically plausible values with no cryptographic link to real patients. Safe to use in dev, test, and AI workflows. |
| Audit controls (§164.312(b)) | The hosted dashboard records an append-only audit trail of every scan, clone, and data-access event. |
| Business Associate Agreement (BAA) | Available on the Compliance tier. Contact compliance@cloneside.com to request a BAA before connecting a covered database to the hosted service. |
| Transmission security (§164.312(e)(1)) | TLS 1.3 on all API and dashboard endpoints. Connection strings travel only over your local machine on the local path. |
LGPD — Lei Geral de Proteção de Dados (Brazil)
| Requirement | How cloneside addresses it |
|---|---|
| Purpose limitation (Art. 6, III) | Column metadata is used solely to classify PII and build a privacy-preserving clone. No secondary use. |
| Data minimisation (Art. 6, III) | Only schema and sample-row statistics are extracted — not full tables. The source database is not replicated. |
| Data subject rights (Art. 18) | Because no real records are retained by cloneside on the local path, deletion requests are automatically satisfied. The hosted service retains only account metadata. |
| Security (Art. 46) | AES-256 (Fernet) encryption for any metadata stored at rest; TLS 1.3 in transit; bcrypt passwords; append-only audit logs. |
| Breach notification (Art. 48) | In the event of a confirmed incident affecting user data, cloneside commits to notifying affected users within 72 hours and the ANPD as required. |
PIPEDA — Personal Information Protection and Electronic Documents Act (Canada)
| Principle | How cloneside addresses it |
|---|---|
| Accountability (Principle 1) | You (the data controller) retain full control of your source database and connection string. cloneside acts as a data processor under your instructions. |
| Limiting collection (Principle 4) | cloneside collects only schema metadata and aggregate statistics needed to build the synthetic clone. No original records are retained. |
| Safeguards (Principle 7) | AES-256 encryption at rest; TLS 1.3 in transit; credential sanitisation in all error messages; append-only audit logs. |
| Openness (Principle 8) | Data flows are described in this page, the privacy policy, and the security disclosure page. No hidden collection. |
| Individual access (Principle 9) | The hosted service stores only account metadata (email, hashed password, scan stats). Users can request deletion via privacy@cloneside.com. |
Compliance tier
The Compliance tier includes a signed BAA (HIPAA), extended audit-log retention, and a dedicated onboarding call. Contact us to discuss your requirements.