CCAR-P Domain 3: Enterprise Security, Data Privacy & Regulatory Compliance
Architecting for high-security enterprise environments: PII/PHI tokenization, zero-data-retention agreements, encryption, HIPAA/GDPR boundaries, and immutable audit logs.
1. Client-Side PII/PHI De-Identification Pipelines
In regulated healthcare (HIPAA) and financial (GLBA/PCI-DSS) domains, sensitive personal information should be stripped or tokenized in private middleware before requests leave the corporate perimeter:
Tokenization Pattern
1. Raw user input contains: "John Doe, SSN 000-12-3456".
2. Local PII Sanitizer replaces entities with surrogate tokens: [PERSON_1], [SSN_1] and stores the mapping in an encrypted private Redis vault.
3. Claude processes: "[PERSON_1], [SSN_1]" and returns analysis.
4. Local Gateway re-hydrates surrogate tokens for the authenticated end-user.
2. Zero Data Retention (ZDR) & Anthropic Agreements
- No Model Training: Commercial API traffic is never used to train foundation models.
- Zero Data Retention: Enterprise contracts can enforce zero server-side prompt retention, ensuring customer payloads are erased immediately upon inference completion.
- SOC 2 Type II & ISO 27001: Independent third-party security audits verifying organizational data isolation.
3. Immutable Audit Logging & Non-Repudiation
Regulated industries require complete, tamper-proof logs of every LLM interaction, including:
- Timestamp, User ID, and Application Context ID.
- Sanitized prompt payload, system parameters, and model identifier.
- Raw tool call arguments, execution outputs, and completion tokens.
- Stored in immutable write-once-read-many (WORM) storage (e.g. AWS S3 Object Lock).