Compliance and Data Governance

Compliance Framework Selector: a first-class admin control — pick the frameworks the organization operates under (GDPR, HIPAA, SOX, PCI-DSS, SOC 2, ISO 27001, NIST, HITRUST) and AgentWatch activates the relevant DLP categories, data-handling rules, retention policies, and audit-report templates as a bundle. This is a meaningful contrast to platforms that achieve compliance for themselves (their own SOC 2) but provide no compliance posture for the customer’s AI applications.

Retention: configurable per data type with a default of 365 days for audit logs. Defaults: conversations (90d), audit (365d), metrics (180d), events (90d). Enforcement and incident APIs.

Audit reports: exportable in JSON, CSV, and PDF formats from the audit UI; programmatic export via the audit API for SIEM ingestion.

Certifications: AgentWatch is a deployable product — SOC 2 Type II, ISO 27001, FedRAMP, etc. are attestations against a deployed instance plus the operating organization’s controls. The customer’s deployment of AgentWatch inherits the certifications of the underlying cloud provider (AWS, Azure, GCP) plus whatever controls the customer’s own infosec team layers on top.

FCC + state law compliance: the platform’s data-residency, audit-log retention, and DLP feature set are designed to operate inside a customer’s compliance perimeter without sending operational data to a vendor cloud. The “Golden Security Configuration” — a hardened company-settings baseline with all guardrails ON, max audit retention, IP allowlisting, mTLS for agents, and Bedrock Guardrails enabled — ships as a documented preset that customers can apply at deploy time.

---