# Compliance & security

How HelixIAM helps you meet security and regulatory obligations — and how to operate it securely.

## In this section

- **[OpenID / FAPI conformance](conformance.md)** — the OpenID Connect and FAPI profiles Helix implements, and how to run the conformance suite against your install.
- **[OpenID Connect conformance-suite run](oidc-conformance.md)** — a self-run of the OpenID Foundation conformance suite against all 13 OpenID Connect OP certification plans: 0 failures in 413 module runs, every warning explained. Not OpenID Certification.
- **[Compliance program](compliance-program.md)** — where Helix fits in SOC 2, ISO 27001, and NL eID accreditation, including the [internal penetration test of 2026-10-15](compliance-program.md#internal-penetration-test-2026-10-15) (no exploitable finding; an independent third-party penetration test is in preparation).
- **[Security hardening](../operations/security.md)** — the checklist for a production-grade, locked-down deployment.
- **[GDPR & privacy](../operations/gdpr.md)** — data-subject rights (export, erasure, consent) built into the platform.
- **[Accessibility (WCAG 2.1 AA)](accessibility.md)** — the self-assessed conformance status of the sign-in pages and account console, how it is tested, and the known gaps.
- **[BSN handling](../federation/digid.md#how-the-bsn-is-handled)** — how the Dutch citizen service number is stored encrypted per realm, masked in the console and released only to applications a realm-admin opts in.
- **[Data retention](../operations/data-retention.md)** — the scheduled cleanup of expired rows, and the audit-log retention policy.
- **[Events & audit](../manage/events.md)** — the tamper-evident audit log and SIEM forwarding that underpin every compliance claim.

## See also

- [Realm keys](../operations/realm-keys.md) — signing-key management and rotation
- [Admin roles (RBAC)](../operations/admin-roles.md) — least-privilege administration