---
title: "Governance"
description: "Enterprise governance for stream processing. Role-based access, audit logging, data lineage, and compliance controls built into the Ververica Platform."
lastUpdated: 2026-10-14T09:40:33.000Z
source_url:
  html: "https://www.ververica.com/product/governance"
  md: "https://www.ververica.com/product/governance.md"
---

# Your Data Is Ungoverned. Regulators Have Noticed.

**Built in, not bolted on.**

Most streaming platforms add governance as an afterthought. Ververica was built for regulated industries from day one. Every event tracked. Every transformation auditable.

- DORA
- GDPR
- SOC 2
- ISO 27001
- MiFID II

## What is governance and compliance on Ververica?

Governance on Ververica is built into the streaming platform rather than added on. Data lineage tracks every transformation, schema management blocks breaking changes, role-based access control decides who sees what, and continuous audit trails record every change. Ververica is ISO 27001:2022 certified, holds SOC 2 Type II and SOC 3 reports, and is built for DORA and GDPR requirements.

## Banking Proof Points

- **Top-10 EU Banks**
- **Audit Coverage**
- **Data Sovereignty Gaps**

## Problem of The Governance Gap

Your batch pipelines have governance. Your data warehouse has lineage. But your streaming infrastructure? It's a black box. Regulators don't care that "streaming is different."

## Five Governance Capabilities.

| Feature | Description | Regulation |
| --- | --- | --- |
| Complete Data Lineage | Track every transformation, column-level lineage | DORA Article 11, GDPR Article 30, SOC 2 CC6.1 |
| Immutable Audit Trails | Every action logged, tamper-proof, cryptographic verification | DORA Article 12, SOC 2 CC7.2, MiFID II Article 16 |
| Role-Based Access Control | Fine-grained permissions, SSO/SAML, least privilege | SOC 2 CC6.3, ISO 27001 A.9, GDPR Article 25 |
| Automated Compliance Reporting | Pre-built dashboards, on-demand audit reports | DORA Article 15, SOC 2 CC4.1, GDPR Article 35 |
| AI Governance | Govern AI inputs/outputs, feature lineage, model drift monitoring | EU AI Act Article 14, GDPR Article 22, DORA Article 5 |

## Regulation Coverage

Digital Operational Resilience Act (financial entities)

General Data Protection Regulation (personal data)

Type II trust service criteria

Markets in Financial Instruments Directive

## Sovereign Infrastructure

### Data Sovereignty

Headquartered in Munich, Germany. Self-managed or BYOC (AWS or Azure) in the region you choose.

### Trust Center

SOC 2 Type II, ISO 27001, GDPR ready, HIPAA compliant, built for DORA requirements, CSA STAR certified

### DORA Readiness

Downloadable compliance checklist