Compliance by design