Compliance

Built for regulated industries.

Piixie processes everything locally on your machine. No cloud uploads, no cross-border transfers, no third-party exposure. That single architectural decision simplifies compliance across every major regulatory framework.

100% local processing Data never leaves your machine
Zero cloud exposure No APIs, no uploads, no SaaS risk
8 frameworks covered GDPR, HIPAA, CCPA, SOC 2, and more
Audit-ready output Redaction logs for every run
Regulatory coverage

One tool, eight frameworks.

Because Piixie runs entirely on your device, data never enters a third-party environment. That single fact eliminates entire categories of compliance risk and simplifies the controls you need to maintain.

GDPR

EU General Data Protection Regulation

The GDPR requires organizations to protect personal data of EU residents through principles of lawfulness, fairness, transparency, and data minimization.

Controllers and processors must demonstrate compliance at every stage of data handling, from collection through deletion. Key obligations include maintaining a lawful basis for processing, honoring data subject rights, implementing data protection by design, and executing Data Processing Agreements with any third party that handles personal data.

How Piixie helps

  • Personal data never crosses organizational or national boundaries, eliminating the need for Standard Contractual Clauses.
  • Data minimization is enforced at the source: PII is stripped before sharing with any downstream system.
  • Anonymized output is no longer personal data under GDPR Recital 26.
  • No third-party processor involved, removing the DPA requirement for anonymization.
  • Right to erasure is simplified -- original data stays on a single machine you control.
  • Audit logs provide evidence of data protection by design.

HIPAA

Health Insurance Portability and Accountability Act

HIPAA establishes national standards for protecting individually identifiable health information, known as Protected Health Information (PHI).

Covered entities and business associates must implement administrative, physical, and technical safeguards. The Privacy Rule mandates the minimum necessary standard, requiring only the least amount of PHI needed for a given purpose is used or disclosed.

How Piixie helps

  • PHI stays entirely on your premises -- never transmitted to external servers or cloud APIs.
  • Minimum necessary standard enforced automatically: detects patient names, MRNs, DOBs, diagnoses, and more.
  • No BAA required -- no third party ever accesses the PHI.
  • De-identified data can be shared for research or AI training without triggering disclosure rules.
  • Prevents accidental PHI exposure in LLM prompts or model training data.
  • Audit trails document exactly which PHI was detected and redacted.

CCPA / CPRA

California Consumer Privacy Act / California Privacy Rights Act

The CCPA, as amended by CPRA, grants California residents sweeping rights over their personal information: the right to know, delete, opt out, and non-discrimination.

Businesses must disclose data practices, honor consumer requests within prescribed timeframes, and implement reasonable security measures. CPRA expanded protections with sensitive personal information categories and the California Privacy Protection Agency.

How Piixie helps

  • Anonymize personal information before it enters analytics or shared datasets, reducing CCPA/CPRA scope.
  • No data transmitted to third parties -- not a "sale" or "sharing" under the statute.
  • Deletion requests easier when data is stripped at ingestion, not scattered across cloud services.
  • SSNs, financial details, and geolocation redacted before downstream use, satisfying CPRA.
  • Local processing avoids creating data inventories with third-party providers.
  • Anonymized data falls outside "personal information" -- no opt-out requirements.

SOC 2

Service Organization Controls

SOC 2 evaluates an organization's controls across five Trust Service Criteria: security, availability, processing integrity, confidentiality, and privacy.

Organizations pursuing SOC 2 Type II must demonstrate effective controls over a sustained period. For companies handling sensitive customer data, SOC 2 is often a baseline requirement from enterprise clients.

How Piixie helps

  • Confidentiality controls inherently satisfied -- data never leaves local environment.
  • Eliminates vendor risk that would require assessment and documentation in SOC 2 reports.
  • Processing integrity demonstrable through deterministic redaction with full audit logs.
  • Privacy criteria benefit from data minimization at source before SOC 2 boundary.
  • No data in transit -- Piixie operates within your workstation or server boundary.
  • Availability unaffected by external dependencies. Runs fully offline.

ISO 27001

Information Security Management

ISO 27001 is the international standard for establishing and maintaining an Information Security Management System (ISMS).

It requires organizations to assess risks, apply controls from Annex A, and demonstrate ongoing compliance. Key areas include access management, cryptography, operations security, and incident response.

How Piixie helps

  • Data stays within your ISMS scope boundary -- no extending controls to external processors.
  • Access controls simplified to local file system permissions, not cloud IAM policies.
  • Minimal residual risk -- data never exposed to networks, APIs, or third parties.
  • Annex A communications security (A.13) inherently met -- no network data transmission.
  • Reduced incident response scope -- anonymized output has no identifiable information.
  • Audit evidence straightforward from redaction logs for every processed document.

EU AI Act

Artificial Intelligence Act

The EU AI Act is the first comprehensive legal framework for AI, classifying systems by risk level and imposing requirements accordingly.

High-risk AI systems face obligations around transparency, human oversight, data governance, and cybersecurity. The Act mandates quality standards for datasets and explainable AI decisions.

How Piixie helps

  • Local AI runs on your hardware -- not through an opaque cloud API you cannot inspect.
  • Human oversight preserved: users review and adjust every redaction before output.
  • Data governance simplified -- training and operational data never leave your environment.
  • Transparency inherent: shows exactly what was detected, categorized, and actioned.
  • No dependency on third-party AI that may change models or terms without notice.
  • Technical documentation straightforward -- entire pipeline in a single local application.

FERPA

Family Educational Rights and Privacy Act

FERPA protects the privacy of student education records at all institutions receiving federal funding.

Schools must obtain written consent before disclosing PII from education records. Violations can result in withdrawal of federal funding, making compliance critical for schools, colleges, and universities.

How Piixie helps

  • Student records anonymized locally before sharing with researchers or AI tools.
  • No student PII transmitted to cloud services, preserving institutional control.
  • Consent simplified -- de-identified data may fall outside FERPA's scope.
  • Research offices can analyze outcomes using anonymized datasets without per-student consent.
  • Detects education-specific identifiers: student IDs, enrollment, grades, disciplinary data.
  • Audit logs demonstrate proper de-identification to accreditation bodies.

PCI DSS

Payment Card Industry Data Security Standard

PCI DSS ensures that organizations accepting, processing, or transmitting credit card information maintain a secure environment.

The standard includes twelve core requirements covering network security, access controls, encryption, and monitoring. Non-compliance can result in fines and loss of card processing ability.

How Piixie helps

  • Credit card numbers, PANs, and financial PII redacted locally before sharing or analytics.
  • Cardholder data never transits a network, reducing CDE scope and simplifying assessments.
  • Access controls limited to local workstation, not cloud environments or third parties.
  • Detects and masks card numbers, expiration dates, CVVs, and cardholder names.
  • Redacted output safely shared with teams, enforcing the need-to-know principle.
  • Processing logs support your SAQ or Report on Compliance.

Simplify your compliance posture today.

Start anonymizing locally in minutes. No cloud account required, no data processing agreements to negotiate.

Download Piixie