Skip to content
Compliance

Fail-closed policy packs, and evidence you can prove.

Starter packs pre-wire policy to named regulatory requirements, detection is reported by kind and count rather than by value, and every decision lands in a hash chain an independent verifier can check.

Starter policy packs.

Three starter packs pre-wire policy controls to named regulatory requirements. Every allow-list ships empty or as a placeholder — your team names the approved providers, models, and prompt templates before it goes live.

HIPAA

Restrictive-by-default baseline for protected health information — provider and model allow-lists scoped to your BAA, PHI detection that blocks on match, and minimum-necessary limits on prompt templates and input size.

§164.312(a) Access control §164.312(b) Audit controls §164.502(b) Minimum necessary

GDPR

Baseline for personal data of EU/EEA subjects — provider and model allow-lists pinned to adequacy- or SCC-covered endpoints, with detection set to flag rather than block so lawful-basis processing isn't rejected outright.

Art. 5(1)(c) Minimisation Art. 30 Records Art. 44+ Transfers

FINRA / GLBA / PCI-DSS

Baseline for nonpublic personal information and cardholder data — Luhn-validated card detection, vendor-scoped provider allow-lists, and an optional full-transcript mode for books-and-records retention.

PCI-DSS Req 3/4 PCI-DSS Req 10 FINRA 4511 / SEC 17a-4

Also mapped: SOC 2

SOC 2 is a control mapping rather than a policy pack. Virtual keys and policy scoping support logical access; the audit trail and denial reason codes support monitoring; and config-as-code — reviewable YAML with every secret referenced by environment variable, never written in the file — supports change management.

CC6.1 Logical access CC7.2 Monitoring CC8.1 Change management

Data protection scanning

Pattern-based detection on request input, reported by kind and count only — the matched value itself is never logged or stored anywhere.

Secrets SSN Credit card · Luhn Email Phone IP address NPI DEA Optional NER
Block Reject before it reaches a provider — 403, before a token is spent.
Flag Allow the request; record the detected kinds on the audit trail as evidence.
Require approved Allow only to providers explicitly approved for every kind detected; reject the rest.

Evidence, on demand

Every request — allowed or denied — writes one audit record: who made it, which policy applied, the disposition and matched rule, PII flags, and latency.

Append-only JSONL
No update or delete path from the gateway — hand it to an auditor as-is.
Queryable Postgres
Same records in SQL form, plus a summary analytics API by org and date range.
Optional full transcripts
Opt-in per policy for books-and-records — request/response bodies, PII-redacted by default, size-capped and retention-windowed.

Scanning the response, too

Input scanning stops sensitive data going to a provider. Response scanning catches it coming back — PHI the model was given elsewhere and echoed, or a generated value that looks real.

Buffered responses Withheld on detection — the client receives a 403 and the audit record notes the request was forwarded and why the body was held back.
Live streams Bytes already relayed cannot be unsent, so a block degrades to a recorded flag and the reconstructed stream is scanned when it ends. Inline stream redaction is on the roadmap.
Separate evidence Response detections are recorded apart from input detections, so an assessor can distinguish what was sent from what came back — kinds only, never values.

Tamper evidence you can prove

Every record is SHA-256 hash-chained to its predecessor, so inserting, deleting, reordering, or editing a committed record forces recomputing every hash after it — and is detectable.

Require Evidence-required mode refuses new governed work while the durable sink is unhealthy, so regulated traffic cannot silently outrun its record.
Verify Verification walks the hash chain and cross-checks the denormalized analytics columns against each canonical record to catch a clean-looking but misleading read model.
Sign A consistent transactional snapshot can be canonically serialized and signed with Ed25519 for independent offline verification.
Anchor Chain heads are anchored outside the store on a scheduled cadence — delivered to webhook witnesses or written to S3 Object Lock buckets under COMPLIANCE retention — and an independent verifier checks the payload against a pinned key. An anchor proves the chain existed at that time; it does not by itself prove global consistency.
append-only · audit.jsonl one record per request
{
"ts": "2026-07-06T14:22:08Z",
"request_id": "req_9f3ac21b",
"subject": { "user": "a.rivera", "org": "acme-clinical" },
"provider": "anthropic", "model": "claude-3-5-sonnet",
"activity": "chat_completion",
"disposition": "denied", "matched_rule": "deny:*-vision*",
"pii": ["ssn"],
"tokens": { "in": 0, "out": 0 }, "cost_usd": 0.0, "latency_ms": 3
}

One line in the append-only audit trail — attributed, priced, and policy-tagged. Denied here before a token was spent.

Compliance packs and detection accelerate the work — they are scaffolding, not legal advice or a certification. The platform also carries a 31-framework reference library as versioned metadata only: it is not compliance credit, attestation, or legal advice, and the console labels it that way. Pattern-based detection has real gaps: unformatted identifiers, names, and free-text narratives are not caught, so layer a dedicated DLP or NER service where your obligations demand it. Full control mapping in docs/COMPLIANCE.md ↗.

How it works →

The exact gates a request passes before it is allowed or denied.

Roadmap →

What is delivered, what is in progress, and what still gates a release.

Bring your framework questions.

Request access and we will map the packs and evidence to your specific obligations.

By joining, you agree to our Privacy Policy and Terms.