Compliance & Standards

Nest Auth is used across many industries — SaaS, fintech, healthcare, government, education. Rather than chase one regulation, it implements its authentication controls against the two standards that directly specify what good auth looks like, then maps those controls to the higher-level frameworks auditors care about.

Anchor standards:

• OWASP ASVS (Application Security Verification Standard) — V2 Authentication, V3 Session Management, V4 Access Control. Target: Level 2.
• NIST SP 800-63B (Digital Identity Guidelines) — Authentication Assurance. Target: AAL2.

Meeting ASVS L2 + NIST AAL2 satisfies the technical authentication-control portions of SOC 2, ISO 27001, PCI-DSS, HIPAA, GDPR, India DPDP, and PSD2-SCA — because all of those reference the same underlying controls (MFA, strong password storage, session management, rate-limiting, audit logging, least-privilege access).

No library can make you "compliant." Compliance is a property of your whole system and organization — policies, BAAs/DPAs, TLS, database-at-rest encryption, physical safeguards, and access logging in your application. Nest Auth provides the identity & access technical controls. The shared-responsibility matrix below makes the boundary explicit.

Control status legend

Authentication controls

Session management

Access control & authorization

Audit & accountability

Data protection & privacy (GDPR / India DPDP / CCPA)

Transmission security

The compliance preset (roadmap)

Rather than make every consumer configure two dozen knobs, an upcoming preset flips safe defaults for a target framework, all still overridable:

NestAuthModule.forRoot({
  compliance: 'baseline',   // 'asvs-l2' | 'nist-800-63b' | 'hipaa' | 'gdpr' | 'pci'
  // The preset sets, e.g.:
  //   session: { idleTimeout: '15m', absoluteTimeout: '12h' }
  //   mfa: { required: true }
  //   lockout: { enabled: true, maxAttempts: 5 }
  //   rateLimit: { enabled: true }
  //   password: { minLength: 12, breachCheck: true }
  //   audit: { enabled: true, persist: true, immutable: true }
  //   cookie: { secure: true, sameSite: 'strict' }
});

A boot-time complianceReport() will print which required controls are active vs inactive, so you can assert posture in CI and hand evidence to an auditor.

Framework coverage at a glance

Shared responsibility

See also

• Audit Logging — wiring the event stream to your store
• CORS & Security
• Rate Limiting
• Production Checklist
• Sessions & Tokens