Compliance

Compliance is a feature.
Not a footnote.

Every Composite product applies the compliance rules of its vertical inside the generation process — not as an after-the-fact review. Every output ships with a verifiable trace. Audit-ready, by default.

How it works

Frames shape the output. They don't review it.

A compliance frame is a set of rules that the vertical's industry requires — OWASP Top 10 for code, HIPAA Safeguards for clinical, MNPI handling for finance. Every Composite product applies the frames of its vertical inside the generation process. The output is shaped by the rules as it's produced.

Every call returns a complianceTrace — a verifiable record listing which rules were requested, which were enforced, and which checks passed. The trace is exportable to your audit pipeline.

complianceTrace.json

{
  "requestId": "req_8c2a1f",
  "capability": "generate",
  "vertical": "code",
  "rulesRequested": ["owasp-top-10", "soc2"],
  "rulesEnforced": [
    "no-eval",
    "parameterized-queries",
    "secrets-redacted",
    "auth-required",
    "rate-limit-applied"
  ],
  "checks": {
    "lint": "pass",
    "typecheck": "pass",
    "securityReview": "pass"
  },
  "latencyMs": 1840
}

Certifications & posture

Where we are. Where we're headed.

●

SOC 2 Type II

In audit. Target: Q3 2026. Report shared under NDA with Business and Enterprise customers at completion.

●

GDPR

Live. EU data residency available on Enterprise (region-pinned tenants). DPA available for all paid tiers.

○

HIPAA / BAA

Composite Clinical launches Q4 2026 with HIPAA controls + BAA from day one. Other verticals do not handle PHI.

○

ISO 27001

Planned for 2027 once SOC 2 is established. Many controls overlap with SOC 2.

Data handling

What we log. What we don't.

Data type	Retention default	Configurable on
Request / response bodies	7 days (Free), 30 days (Team), 1 year (Business)	Enterprise
Compliance traces	Matched to body retention	Enterprise
Aggregate metrics	90 days	Enterprise
PII inside requests	Never used for model training. Redacted in logs at edge.	Always
Account / billing	7 years (regulatory)	—

Request and response bodies are never used to train any model. This is contractual on all paid tiers and documented in the DPA.

Legal docs

DPA, BAA, security questionnaire.

All paid tiers receive a Data Processing Addendum (DPA) on request. Composite Clinical customers receive a Business Associate Agreement (BAA) at launch. We respond to security questionnaires within 5 business days; the most common ones (CAIQ, SIG Lite) have pre-filled templates available.

Request a trust packet →

Compliance is a feature.Not a footnote.