SOC 2, HIPAA, and PCI-DSS in the pull request

Q: Which frameworks does Devzy cover in code?

Devzy ships mapped checks for SOC 2, HIPAA, PCI-DSS, GDPR, CCPA/CPRA, OWASP Top 10, NIST SP 800-53, ISO 27001, and related catalogs. Coverage is the code-reachable subset described in the product docs, not a full audit.

Q: Where does compliance review run?

On GitHub and GitLab pull requests and from the CLI. Findings appear on the PR with file-level evidence and stay in repository scan history.

Q: Does Devzy certify SOC 2 or HIPAA?

No. Trust-services attestation and HIPAA programs still require auditors and operational controls outside the repository. Devzy supplies pipeline evidence only.

Devzy maps selected code-reachable checks to security and privacy frameworks so reviewers see evidence before merge. It does not replace an auditor or claim full certification.

Start from the homepage, read documentation, or sign in to connect GitHub or GitLab.

SOC 2

Change-management gates, governance files, CI and supply-chain signals. Attestation still requires auditors.

HIPAA

Insecure PHI transport, encryption-at-rest signals, auth and logging hygiene. Operational HIPAA workflows are out of code scope.

PCI-DSS

Cardholder-data pattern review, access and authentication signals, logging and MFA-related checks (subset of PCI DSS 4).

GDPR / CCPA

PII detection, encryption signals, governance files. DPAs, DPIAs, and data-subject workflows are not in code scope.

Limitations

Checks are a code-reachable subset. DPAs, DPIAs, data-subject requests, and auditor fieldwork stay outside Devzy. See the security and compliance docs for the exact rule catalog.

FAQ

Which frameworks does Devzy cover in code?

Where does compliance review run?

Does Devzy certify SOC 2 or HIPAA?