> ## Documentation Index
> Fetch the complete documentation index at: https://docs.whawit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance criteria

> Declare the frameworks that govern your organization's data — HIPAA, SOC 2, PCI DSS, GDPR, CCPA and Aviation / PNR — so WHAWIT knows which classes of sensitive data to treat as protected

## Declare what governs your data

Different industries answer to different rules: a hospital to HIPAA, a payments company to
PCI DSS, an airline to passenger-record regulations. The **Compliance** card on the
[Policies page](/policies/overview) lets an organization declare, framework by framework,
which of those criteria govern its data.

Enabling a framework declares which classes of sensitive data WHAWIT must treat as
protected. The declaration is organization-wide — one setting set per organization, applied
across every project.

<Note>
  This release records the declaration. Masking of sensitive data in logs and analysis
  output based on these criteria is **not enforced yet** — the card itself says so — and
  arrives with the next phase of this feature. Declaring your frameworks now means the
  enforcement phase switches on with the right scope from day one.
</Note>

## The six frameworks

Each toggle names a framework, explains what it protects, and shows badges for the data
classes it covers:

| Framework          | What it declares                                                                                        | Protected data classes           |
| ------------------ | ------------------------------------------------------------------------------------------------------- | -------------------------------- |
| **HIPAA**          | US health privacy — protected health information and patient identifiers must not be exposed.           | Health data, Personal data       |
| **SOC 2**          | Service-organization confidentiality — credentials, tokens and personal data stay out of shared output. | Credentials, Personal data       |
| **PCI DSS**        | Payment card industry — primary account numbers and card data must never surface.                       | Card data                        |
| **GDPR**           | EU data protection — personal data of natural persons is minimized in every output.                     | Personal data                    |
| **CCPA**           | California consumer privacy — personal information is shielded from casual exposure.                    | Personal data                    |
| **Aviation / PNR** | Airline passenger data — record locators and passenger name records must not be exposed.                | Passenger records, Personal data |

Frameworks **union** rather than stack: enabling both HIPAA and GDPR protects health data
plus personal data once — overlapping frameworks are expected, so enable every framework
that applies to you.

<Note>
  This is about **your** data: the criteria your organization answers to. It is separate
  from WHAWIT's own certifications — for the platform's SOC 2 Type II posture, see
  [Security & enterprise](/concepts/security-enterprise).
</Note>

## Enable your frameworks

<Steps>
  <Step title="Open Policies">
    In [app.whawit.ai](https://app.whawit.ai), pick the organization in the switcher, then
    open **Policies** in the sidebar (`/policies`). You need the **Admin** or **Owner**
    role — the page is not visible to responders or viewers.
  </Step>

  <Step title="Find the Compliance card">
    It sits below the **Coder** and **MCP actions** cards: *"The industry criteria that
    govern this organization's data."*
  </Step>

  <Step title="Flip the switches">
    Enable each framework that governs your data. Every change saves immediately — there
    is no save button — and confirms with a **Policies updated** toast.
  </Step>
</Steps>

## Defaults and behavior

* **Everything starts off.** No framework governs an organization until it says so.
  Organizations that never open the page are unaffected.
* **Toggling is immediate and lossless.** Turning a framework off simply removes the
  declaration; nothing is deleted, rewritten or reprocessed.
* **Compliance toggles never disturb the other policies.** The Coder, MCP actions and
  incident automation settings on the same page are independent.
* **Who can change it:** the same capability that guards the whole Policies page —
  **Admin** and **Owner** only. Every save records who made it.

## What enabling a framework does *not* do (yet)

To keep expectations exact, in the current release a declaration does **not**:

* mask or redact data in logs, analyses or notifications — that is the next phase;
* change AI prompts, model choice or agent behavior;
* restrict agents, MCP tools, integrations or notification channels;
* modify, delete or reprocess anything already stored;
* change anyone's role or access.

## For scripted setups

Policies can also be read and written through the API: `GET /policies?organization=…` and
`PUT /policies`. Compliance travels as `compliance.frameworks`, a map of framework id
(`hipaa`, `soc2`, `pci_dss`, `gdpr`, `ccpa`, `iata_pnr`) to boolean. An unknown framework
id is rejected with `400 Unknown compliance framework`, and every value must be a boolean.

## Related

<CardGroup cols={2}>
  <Card title="Organization policies" icon="scale-balanced" href="/policies/overview">
    The page where all of WHAWIT's behavior policies live.
  </Card>

  <Card title="Security & enterprise" icon="building-shield" href="/concepts/security-enterprise">
    WHAWIT's own security posture — certifications, dedicated instances, data residency.
  </Card>
</CardGroup>