Compliance Guide

A posture system for deployments into senior living, medical, and SOX-relevant environments: capabilities removed at build time, a gateway lock that pins where data goes, storage minimization, and operator attribution.

Last updated 2026

Disclaimer

No software makes you HIPAA or SOX compliant on its own. A signed Business Associate Agreement (BAA) with your gateway operator is required and is not verified by this CLI. DPAI performs no PHI detection. Read this guide fully and consult your compliance officer before deploying into any regulated environment.

Checking your posture

Every build reports its own compliance posture and the limits of that posture:

dpai compliance

This prints which capabilities are present in the running binary, whether the gateway is locked, the active retention policy, and any regulatory gaps that remain your responsibility to close.

Capability removal at build time

Whitelabel builds can strip capabilities entirely rather than merely hiding them in the UI — computer-use, scheduling, or sandbox networking can all be compiled out for deployments where they're inappropriate. A removed capability cannot be re-enabled at runtime by an end user or a compromised config file.

Gateway lock pins data destination

When gateway.locked is set in a brand file, the resulting binary can only talk to the endpoint you specify. This means you can state, in writing, exactly where every request from every deployed seat terminates — a requirement most BAAs and SOX controls will ask for directly.

Storage minimization & retention

Local session state, logs, and audit trails are written to a config directory scoped to the build and can be configured with an enforced maximum retention window. Nothing is transmitted to a third party beyond the gateway you've configured.

Operator attribution on every action

Every tool call, shell command, and file edit performed by the agent is attributed to the operator session that initiated it in the local audit log — useful for change control review and incident reconstruction.

Senior-living brand pack

A ready-made brand pack is available for senior-living deployments with a conservative default capability set, a shorter default retention window, and copy reviewed for that context. Start from it with:

dpai brand init senior-living-default --out senior.brand.json

Then follow the Whitelabel Guide to validate and build.