Compliance
Vault's architecture is a direct response to two overlapping Vietnamese legal requirements, and its governance model is built so compliance teams can answer audit questions without opening an engineering ticket.
Legal context
Two layered requirements shape the residency design.
| Regulation ▲ | Effective | Relevance to Vault |
|---|---|---|
| Decree 53/2022 | 2022 | Existing data-localization rules; the baseline requirement Vault's residency split was originally built around. |
| Personal Data Protection Law (Law 91/2025/QH15) | 1 Jan 2026 | Layered on top of Decree 53/2022; raises the bar on PII handling, which is why Vault's Comprehend-based redaction pipeline exists ahead of, not in reaction to, enforcement. |
See the PII handling and residency split sections of the Architecture page for the concrete mechanisms — tokenization before cross-region calls, KMS-encrypted lookup tables, and data-at-rest confined to the Hanoi Local Zone.
Audit self-service
CloudTrail records every inference call. Those records flow into a Glue Data Catalog, exposed to compliance teams through a dedicated Athena workgroup. The result: a compliance officer can run a query like "show me every call touching customer X's data in the last 90 days" directly, without engineering involvement.
| Layer ▲ | Role |
|---|---|
| CloudTrail | Captures every inference call as an immutable log event |
| Glue Data Catalog | Structures the log data into queryable tables |
| Athena compliance workgroup | Isolated query environment for compliance-team self-service, separate from engineering's operational queries |
Cost baseline
At a representative scale — roughly 10,000 documents and about 1,000 queries/day — the same production RAG cost baseline that applies to EFFOMA's broader RAG work holds for Vault: approximately $350/month steady-state.
| Line item ▲ | Monthly cost | Notes |
|---|---|---|
| S3 | ~$1 | Document storage |
| Lambda | ~$5 | App-tier compute |
| Vector store | ~$200 | Largest recurring line item |
| Bedrock inference | ~$100 | ap-southeast-1 |
| Textract | $150 one-time | Document ingestion/OCR, not recurring |
Disaster recovery & residency
Full detail is on the Architecture page. In short: DR for Vault is not fully solved. A standard cross-region failover would risk violating the residency guarantee the platform exists to provide, so the data tier runs pilot-light and only activates under a documented, compliance-approved exception — a decision compliance teams sign off on, not one engineering makes unilaterally.