> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sector8.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance Overview

> How Sector8 enforces GDPR, HIPAA, PCI-DSS, ISO 27001, and SOC 2 at the tool execution boundary

Sector8 enforces compliance controls **before data moves** — at the tool call boundary, not in post-execution audit logs.

## The pre-execution advantage

Traditional compliance tools operate after the fact. Sector8 intercepts before the OS executes the tool call. Data never moves until a policy decision is made.

| Framework              | Key controls enforced                                    |
| ---------------------- | -------------------------------------------------------- |
| [GDPR](/guides/gdpr)   | PII detection, data minimisation, Art. 5/17 audit trail  |
| [HIPAA](/guides/hipaa) | PHI patterns, minimum-necessary access, §164.312 logging |
| PCI-DSS v4             | PAN/CVV detection, CDE path blocking, Req. 10.2 + 6.3.2  |
| ISO 27001              | A.8.2, A.9.4, A.12.4, A.14.2                             |
| SOC 2 Type II          | CC6.1, CC6.6, CC7.2, CC9.2                               |

## Audit trail

Every blocked call produces a tamper-evident record:

```json theme={null}
{
  "evidence_hash": "bdbde1558fb883...",
  "has_forensic_payload": true,
  "policy_version": "eea811e4f6d3c2...",
  "decision_trace_id": "17e797c0-eb5c-4f97..."
}
```

* `evidence_hash` — SHA-256 of the blocked payload. Tamper-evident.
* `policy_version` — HMAC-SHA256 signed bundle. Proves which policy made the decision.
* `decision_trace_id` — Links the denial to the full admission trace.

See [Guardrails](/guides/guardrails#forensic-telemetry) for the full telemetry reference.