compliance packs

What Gateplex actually does, framework by framework

Gateplex is not a certification and does not issue one. This page describes the controls each compliance pack enforces and the evidence it produces, so your risk and audit teams can judge the mapping for themselves.

EU AI Act

Article 12, record keeping

EU AI Act

Article 50, transparency

Financial services

Spend, transaction, and data access boundaries

HIPAA

Data handling

Active Compliance Control HubMapping_Runtime_Events

Frameworks mapped

Control packs

Evidence model

SHA-256

Runtime eventmapFramework control

agent.tool_callEU_AI_ACT_ART_12

output.disclosure_checkEU_AI_ACT_ART_50

payload.pii_scanHIPAA_SEC_402

payment.authorizeSAMA_CYBER_2.1

api.scope_checkQCB_AI_GUIDELINE

Every mapped event writes one hash chained record chain_intact

EU AI Actdossier 01

Article 12, record keeping

Article 12 requires that high risk systems automatically record events over their lifetime, to a standard that supports traceability.

What the pack enforces

Every intercepted agent action is written to an append only record with the input, the matched rule, the verdict, the agent identity, and the timestamp.

Integrity model

Each record stores its own SHA-256 hash and the hash of the preceding record. The hash is computed server side at insert time, so a modified or removed row breaks the chain.

Evidence output

Period scoped compliance exports covering policy triggers, per agent activity, and hash chain verification status.

Append only evidence ledgerVerifying_Chain

record 0x00A1verified

prev_hash: genesissha256: 9f2c…41be

record 0x00A2verified

prev_hash: 9f2c…41besha256: c7d0…88a3

record 0x00A3verified

prev_hash: c7d0…88a3sha256: 41ee…02fc

record 0x00A4 chain_break_detected

prev_hash: 41ee…02fcsha256: —

A modified or removed row no longer reproduces the stored hash, so verification fails at the exact record where tampering occurred.

EU AI Actdossier 02

Article 50, transparency

Article 50 covers transparency obligations where people interact with AI systems or receive AI generated output.

What the pack enforces

Output rules that check agent responses before they are returned, including output length limits and pattern rules you define for disclosure text.

Human oversight

Rules can be marked as requiring approval. Matching actions become PENDING_APPROVAL and are held in the approval queue until a named reviewer decides.

Reviewer identity

Reviewer identity is derived server side from the authenticated session. It cannot be supplied or overridden by the client.

Runtime access control planeHuman_In_The_Loop

Held action

VERDICT: PENDING_APPROVAL

rule: requires_approval = true

queue: approval_queue

execution: suspended

Authenticated session identity

reviewed_by_email = jwt.claims.email

source: server side session

write path: database trigger

client grant: denied

Cannot be supplied or overridden by the client

Financial servicesdossier 03

Spend, transaction, and data access boundaries

Built to support the governance, audit trail, and human oversight requirements financial institutions face under frameworks such as Qatar Central Bank's AI Guideline and SAMA's Cyber Security Framework.

Spend and transaction boundaries

Threshold rules evaluate transaction amounts in the intercepted action. Actions above your configured limit are blocked or routed to a human reviewer before execution.

Data access scope

API scope rules restrict which target hosts and endpoints an agent may reach. Calls outside the declared scope are dropped at the proxy and never egress.

Rule change accountability

Every create, update, enable, disable, and delete on a guardrail rule is written to a hash chained rule change audit log with the actor and a field level diff.

[TRANSACTION BOUNDARIES]

$ 4,200.00ALLOW

$ 18,400.00BLOCK

$ 9,950.00HOLD

threshold: max_amount = 10,000

[DATA ACCESS SCOPE]

agent gateplex proxy

api.core-bank.internalegress

ledger.internal/v1/readegress

pastebin.com/rawdropped

api.unlisted-vendor.iodropped

out_of_scope calls never reach the network perimeter

[RULE CHANGE ACCOUNTABILITY]

rule_audit_log :: entry 0x1F4

actor: r.haddad@bank.example

action: update

- threshold_amount: 25000

+ threshold_amount: 10000

+ requires_approval: true

prev_hash linked

HIPAAdossier 04

Data handling

For teams handling protected health information, the control question is whether sensitive values can leave the perimeter through an agent.

Detection

PII rules scan the full request payload, including nested JSON, for patterns such as email addresses, national identifiers, card numbers, and phone numbers.

Containment

Matching actions are blocked at the proxy or held for approval. In the VPC and air gapped editions, payload data never leaves your perimeter at all.

Review trail

Detections, verdicts, and approval decisions are recorded in the same hash chained trail used for the rest of your evidence.

PII / PHI sanitization matrixPerimeter_Enforced

Inbound payloadunsanitized

{
  "patient": "M. Alvarez",
  "ssn": "412-88-7190",
  "card": "4111 1111 1111 1129",
  "email": "m.alvarez@clinic.example",
  "phone": "+1 415 555 0148",
  "note": "MRN 88213, dx follow up"
}

in memory

pii_scan

Outbound payloadcontained

{
  "patient": "M. Alvarez",
  "ssn": "[REDACTED:NATIONAL_ID]",
  "card": "[REDACTED:CARD_NUMBER]",
  "email": "[MASKED:m***@clinic.example]",
  "phone": "[MASKED:+1 415 555 ****]",
  "note": "[HELD_FOR_APPROVAL]"
}

nested_json_scannedheld_for_approvalvpc: payload never leaves perimeter

auditor verification notice

On sample reports

We do not publish a downloadable sample audit report. Reports are generated from real intercept data in your own environment, and a synthetic example would not represent what you receive. The fastest way to see the real output is a Shadow Compliance Audit against your own agent traffic.

Request a Shadow Audit Enterprise and VPC deployment