Skip to main content

​
Declare what governs your data

Different industries answer to different rules: a hospital to HIPAA, a payments company to PCI DSS, an airline to passenger-record regulations. The Compliance card on the Policies page lets an organization declare, framework by framework, which of those criteria govern its data. Enabling a framework declares which classes of sensitive data WHAWIT must treat as protected. The declaration is organization-wide — one setting set per organization, applied across every project.
This release records the declaration. Masking of sensitive data in logs and analysis output based on these criteria is not enforced yet — the card itself says so — and arrives with the next phase of this feature. Declaring your frameworks now means the enforcement phase switches on with the right scope from day one.

​
The six frameworks

Each toggle names a framework, explains what it protects, and shows badges for the data classes it covers: Frameworks union rather than stack: enabling both HIPAA and GDPR protects health data plus personal data once — overlapping frameworks are expected, so enable every framework that applies to you.
This is about your data: the criteria your organization answers to. It is separate from WHAWIT’s own certifications — for the platform’s SOC 2 Type II posture, see Security & enterprise.

​
Enable your frameworks

1

Open Policies

In app.whawit.ai, pick the organization in the switcher, then open Policies in the sidebar (/policies). You need the Admin or Owner role — the page is not visible to responders or viewers.
2

Find the Compliance card

It sits below the Coder and MCP actions cards: “The industry criteria that govern this organization’s data.”
3

Flip the switches

Enable each framework that governs your data. Every change saves immediately — there is no save button — and confirms with a Policies updated toast.

​
Defaults and behavior

  • Everything starts off. No framework governs an organization until it says so. Organizations that never open the page are unaffected.
  • Toggling is immediate and lossless. Turning a framework off simply removes the declaration; nothing is deleted, rewritten or reprocessed.
  • Compliance toggles never disturb the other policies. The Coder, MCP actions and incident automation settings on the same page are independent.
  • Who can change it: the same capability that guards the whole Policies page — Admin and Owner only. Every save records who made it.

​
What enabling a framework does not do (yet)

To keep expectations exact, in the current release a declaration does not:
  • mask or redact data in logs, analyses or notifications — that is the next phase;
  • change AI prompts, model choice or agent behavior;
  • restrict agents, MCP tools, integrations or notification channels;
  • modify, delete or reprocess anything already stored;
  • change anyone’s role or access.

​
For scripted setups

Policies can also be read and written through the API: GET /policies?organization=… and PUT /policies. Compliance travels as compliance.frameworks, a map of framework id (hipaa, soc2, pci_dss, gdpr, ccpa, iata_pnr) to boolean. An unknown framework id is rejected with 400 Unknown compliance framework, and every value must be a boolean.

Organization policies

The page where all of WHAWIT’s behavior policies live.

Security & enterprise

WHAWIT’s own security posture — certifications, dedicated instances, data residency.