Four Approaches Compared
1. Manual Processes
What: Custom DELETE scripts, PII spreadsheets, manual health checks.
Pros: No cost, no dependencies, full control.
Cons: Error-prone, no audit trail, breaks with schema changes, does not scale. The spreadsheet is always outdated.
Best for: Personal projects with zero compliance requirements.
2. pg_audit
What: PostgreSQL extension that logs SQL statements.
Pros: Built-in PostgreSQL ecosystem, detailed statement logging, configurable verbosity.
Cons: Log-only (no enforcement), mutable logs (superuser can delete), no PII management, no masking, no consent tracking. Cannot prove deletion happened.
Best for: Adding forensic logging alongside other compliance tools.
3. Enterprise CSPM (Vanta, Drata, OneTrust)
What: SaaS platforms for organizational compliance across all systems.
Pros: Comprehensive (covers HR, cloud, endpoints, vendors), automated evidence collection from APIs, auditor-friendly dashboards, SOC 2 / ISO 27001 readiness.
Cons: 20-100k EUR annually, focused on organizational level (not database internals), cannot inspect PII columns or run SQL health checks, heavyweight onboarding.
Best for: Mid-size to enterprise companies preparing for SOC 2 Type II or ISO 27001 certification.
4. pgcomply (In-Database Extension)
What: Pure PL/pgSQL extension with optional Pro dashboard.
Pros: Runs inside the database, PII-aware (registry, masking, deletion, consent), immutable audit trail, CIS health checks, zero external dependencies, Community Edition is free.
Cons: Database-specific (does not cover HR, endpoint, vendor compliance), requires PostgreSQL 14+, Pro features need subscription.
Best for: Engineering teams that need database-level GDPR, DORA, or SOC 2 compliance.
Comparison Matrix
| Capability | Manual | pg_audit | Enterprise CSPM | pgcomply | |-----------|--------|----------|----------------|----------| | PII registry | ✗ | ✗ | ✗ | ✓ | | Automated deletion (GDPR Art. 17) | ✗ | ✗ | ✗ | ✓ | | Data masking | ✗ | ✗ | ✗ | ✓ | | Consent management | ✗ | ✗ | Partial | ✓ | | CIS health check | ✗ | ✗ | Basic | ✓ (14 checks) | | Immutable audit trail | ✗ | ✗ (mutable) | ✗ (external) | ✓ (SHA-256 chain) | | Schema drift detection | ✗ | ✗ | ✗ | ✓ | | Access reviews | ✗ | ✗ | ✓ | ✓ (Pro) | | PDF reports | ✗ | ✗ | ✓ | ✓ (Pro) | | Organizational compliance | ✗ | ✗ | ✓ | ✗ | | Cost | Free | Free | 20-100k/yr | Free / 49€/mo |
The Practical Answer
For database-level compliance, use pgcomply. For organizational compliance, use Vanta/Drata/Secureframe. They solve different problems. pgcomply handles what happens inside your database; enterprise platforms handle everything outside it.
Summary
There is no single tool that covers all compliance requirements. pgcomply fills a specific gap: database-level compliance that enterprise platforms do not reach. The Community Edition is free and genuinely useful. Pro adds the dashboard and reports your auditors expect. Combine with pg_audit for statement logging and an enterprise platform for organizational coverage.