Compliance Overview

How Sector8 enforces GDPR, HIPAA, PCI-DSS, ISO 27001, and SOC 2 at the tool execution boundary

Sector8 enforces compliance controls before data moves — at the tool call boundary, not in post-execution audit logs.

The pre-execution advantage

Traditional compliance tools operate after the fact. Sector8 intercepts before the OS executes the tool call. Data never moves until a policy decision is made.

Framework	Key controls enforced
GDPR	PII detection, data minimisation, Art. 5/17 audit trail
HIPAA	PHI patterns, minimum-necessary access, §164.312 logging
PCI-DSS v4	PAN/CVV detection, CDE path blocking, Req. 10.2 + 6.3.2
ISO 27001	A.8.2, A.9.4, A.12.4, A.14.2
SOC 2 Type II	CC6.1, CC6.6, CC7.2, CC9.2

Audit trail

Every blocked call produces a tamper-evident record:

{
  "evidence_hash": "bdbde1558fb883...",
  "has_forensic_payload": true,
  "policy_version": "eea811e4f6d3c2...",
  "decision_trace_id": "17e797c0-eb5c-4f97..."
}

• evidence_hash — SHA-256 of the blocked payload. Tamper-evident.
• policy_version — HMAC-SHA256 signed bundle. Proves which policy made the decision.
• decision_trace_id — Links the denial to the full admission trace.

See Guardrails for the full telemetry reference.