Regulatory Compliance & Geographic Edge Routing

Mapping Primitives to Global Compliance Mandates

Compliance in legacy systems is usually administrative—implemented as policies, written promises, or database access rules that are easily bypassed by system administrators. ShareBolt approaches compliance through mathematical bounds. By employing client-side, zero-knowledge encryption, data residency headers, and immutable blockchains, compliance is enforced by design. Plaintext data and decryption keys are never transmitted to or stored in jurisdictions where they could violate compliance standards.

Whether managing automated file exchanges between autonomous AI agents or handling multi-gigabyte corporate documents across global teams, ShareBolt translates the requirements of GDPR, HIPAA, and SOC 2 Type II into cryptographic rules checked before any byte reaches the edge.

Geographic Data Residency Routing (GDPR Compliance)

Under the General Data Protection Regulation (GDPR, specifically Articles 25 and 32), organizations must ensure that personal data is protected by design and default, and that strict controls govern where data is processed and stored. ShareBolt solves this by evaluating client-supplied routing headers at global edge worker proxies. When a transfer is initiated, the sender specifies the target residency zone. Chunks are stream-routed directly to encrypted storage backends located within that jurisdiction (such as EU-central-1 R2/S3 storage nodes), completely bypassing transit servers in other jurisdictions.

EDGE WORKER: CF-IPCOUNTRY → REGIONAL R2 ROUTING (HONO / CLOUDFLARE WORKERS)

// Cloudflare injects cf-ipcountry on every request — no client header required.
// resolveRegion() maps ISO 3166-1 country codes to "eu-central" or "us-east".
// Enterprise BYOS tenants bypass geo-routing entirely (their bucket is fixed).
const cfIpCountry = c.req.header("cf-ipcountry") || c.req.header("Cf-Ipcountry") || null;
const region = user.tenant_id
  ? "us-east"                           // BYOS: tenant's own bucket, no geo-routing
  : R2Service.resolveRegion(cfIpCountry); // DE/FR/IE/…/GR → "eu-central", else "us-east"

// Presigned URL issued for the resolved region — region decision locked before any byte moves.
const presignedUrl = await R2Service.generateUploadUrl(c.env, fileKey, user.tenant_id, 900, region);

// region stored with every transfer record — included in the tamper-evident hash chain.
// INSERT INTO messages (..., region, ...) VALUES (..., ?, ...);

The EU country list covers all 27 member states. Because Cloudflare injects cf-ipcountry at the network layer, routing decisions cannot be spoofed by client-supplied headers. The storage region is also persisted in the audit ledger hash chain — changing the region field on any stored transfer record breaks the chain for all subsequent blocks.

Healthcare Data & HIPAA-Compliant File Transfer

Sharing Protected Health Information (PHI) in healthcare environments requires compliance with the HIPAA Security Rule. This requires strict access controls, data integrity protection, and transmission security.

ShareBolt meets these standards through its Zero-Knowledge envelope architecture:

• E2E Client-Side Encryption: Data is encrypted locally with AES-256-GCM. Decryption keys are never uploaded to ShareBolt, ensuring that we never have access to raw PHI, satisfying the HIPAA "Privacy Rule by technical impossibility."
• Zero PII in Audit Trails: The audit ledger records only cryptographic signatures, hashes, and generic events (e.g. `FILE_UPLOAD`, `FILE_DECRYPT`). No patient names, medical records, or file names are stored in plaintext.
• Business Associate Agreements (BAA): ShareBolt signs BAAs with enterprise clients subscribing to the Citadel or Ledger Guard tiers, committing to maintain the cryptographic boundaries required by law.

SOC 2 Type II: Immutable Audit Logging (audit in progress — architecture designed for SOC 2 Type II)

Auditors reviewing security controls for SOC 2 Type II require proof that file sharing systems enforce strict access restrictions and that audit logs are protected from modifications, deletions, or retro-active edits.

ShareBolt addresses the "Security, Confidentiality, and Availability" Trust Services Criteria by recording all actions in an immutable, sequentially hashed transaction ledger. Each block contains:

Because the hashes are chained chronologically, any attempt by an insider, hacker, or system administrator to edit or delete a log entry will break the hash link for all subsequent blocks. Compliance teams can export the complete ledger chain as JSON via GET /v1/audit/entries to prove historical access controls to third-party SOC 2 auditors. CSV export and SIEM streaming integrations are on the roadmap.

B2B Compliance Capabilities Matrix

See how ShareBolt compares against legacy consumer file sharing tools, corporate FTP servers, and standard cloud storage systems on key compliance capabilities: