Compliance Coverage Map

At a Glance

Coverage Matrix

Each row is a detection rule category built into BitDrip. Each column is a compliance framework. A check mark identifies a technical mapping to evaluate; it is not certification that a legal requirement is satisfied.

Rule Category	GDPR	HIPAA	PCI DSS v4	SOC 2	ISO 27001	CCPA
👥PII Names, emails, phones, addresses, SSNs, DOB, IPs	✓	✓	Partial	✓	✓	✓
🏥PHI Medical records, diagnosis codes, medications, insurance IDs	✓	✓	—	✓	✓	✓
💳PCI / Payment Card numbers (Luhn), CVV/PIN, bank accounts, SWIFT/IBAN	✓	—	✓	✓	✓	✓
🔐Credentials API keys, passwords, OAuth tokens, JWTs, SSH private keys	✓	✓	✓	✓	✓	✓
📄Proprietary Data Classification markers, internal hostnames, project codenames	✓	—	—	✓	✓	—
🤖Agentic Actions MCP tool calls, shell commands, DB connection strings in agent output	✓	✓	✓	✓	✓	Partial
📜Audit Log Tamper-evident hash-chain evidence for supported recorded policy decisions	✓	✓	✓	✓	✓	✓
🏠Architecture Customer-controlled supported paths, TLS inspection, bounded portal data path	✓	✓	✓	✓	✓	✓

Detailed Mapping

Per-Framework Requirements

Each section lists specific articles or control numbers, what BitDrip enforces against them, and the mechanism used. Coverage notes are honest about scope.

🇪🇺

GDPR — General Data Protection Regulation

EU Regulation 2016/679 · Applies to any organisation processing personal data of EU residents

GDPR governs processing of personal data in its scope. BitDrip capabilities may support selected technical-control objectives when validated and configured for the deployment; they do not replace legal analysis or organisational obligations such as governance, assessments, and data-subject workflows.

Article / Requirement	What BitDrip Enforces	How
Art. 5(1)(c) Data minimisation	Can block detected personal data on supported configured AI paths	PII Detection and blocking of personal identifiers (names, emails, phone numbers, addresses, national ID numbers, DOB) in outbound AI requests. Policy can block, warn, or redact.
Art. 9 Special category data	Detects health and biometric data before it reaches AI services	PHI Rules targeting ICD-10 codes, diagnosis terms, medication names, medical record numbers, and insurance IDs. High-confidence detection with immediate-block option.
Art. 25 Data protection by design	Customer-controlled evaluation can apply policy before forwarding on supported paths	Architecture The customer-controlled proxy and policy engine evaluate supported configured paths before forwarding to external AI services. The separate commercial portal has the bounded data path described in the privacy notice.
Art. 32 Security of processing	Enforces encryption in transit; generates evidence of technical controls	Architecture Audit Supported configured proxy paths use authenticated TLS connections and can produce policy-decision evidence. Validate protocol configuration and the deployed audit fields before relying on the mapping.
Art. 83 Administrative fines	Provides documented evidence that technical controls were in place	Audit Tamper-evident, hash-chained audit log exportable for DPA investigations. Demonstrates due diligence and existence of technical safeguards at the time of any alleged violation.

Coverage note: BitDrip capabilities can support selected processing-security, data-minimisation, and audit-evidence objectives. They do not cover legal-basis documentation, consent management, data subject access request (DSAR) workflows, DPO appointment, DPIA/LIA reports, cross-border transfer mechanisms (SCCs, BCRs), or physical security requirements. These remain organisational responsibilities.

🏥

HIPAA — Health Insurance Portability and Accountability Act

45 CFR Parts 160 & 164 · Applies to US covered entities and their business associates handling protected health information

HIPAA's Security Rule includes administrative, physical, and technical safeguards for electronic protected health information (ePHI). BitDrip capabilities can support selected technical safeguards, including access, audit, integrity, and transmission-security controls, when validated and configured for the organization's environment.

Section	Capability mapping	How
§164.312(a)(1) Access controls	Applies per-user policy and records identity on supported configured AI interactions	Audit Supported user groups can have different policy actions. Validated audit configurations can associate supported policy decisions with an authenticated identity.
§164.312(b) Audit controls	Records and retains hardware and software activity logs for ePHI access events	Audit Tamper-evident audit records can contain timestamp, user, action, matched rule, and service endpoint. Confirm deployed fields, export behavior, and customer-controlled retention before relying on them.
§164.312(c)(1) Integrity	Ensures audit records have not been altered or destroyed	Audit Hash-chain integrity: each audit log entry includes a SHA-256 hash of the previous entry. Any tampering breaks the chain and is detectable during export verification.
§164.312(e)(1) Transmission security	Protects ePHI in transit between your users and AI services	Architecture BitDrip operates as a TLS interception proxy for supported configured paths. Validate TLS behavior, application compatibility, and certificate trust before relying on the control; pinned and proxy-bypassing applications are outside this coverage.
§164.514(b) Minimum necessary	Blocks PHI from being included in AI prompts beyond what is required	PHI 29 detection rules covering the PHI categories most likely to appear in AI prompts: medical record numbers, ICD-10 diagnosis codes, condition and disease names, medication names, insurance member IDs, dates of service, provider names, and patient account numbers.

Coverage note: BitDrip can support selected technical safeguards for transmission security, audit controls, integrity, and access control logging. It does not cover physical safeguard requirements (workstation use, device controls, facility access), administrative safeguards (workforce training, sanction policy, contingency planning), or Business Associate Agreement (BAA) execution. Determine contract and processing requirements with qualified counsel based on the actual deployment and services used.

💳

PCI DSS v4.0 — Payment Card Industry Data Security Standard

PCI SSC v4.0 (March 2022) · Applies to any organisation that stores, processes, or transmits cardholder data

PCI DSS v4.0 includes controls for protecting cardholder data and sensitive authentication data (SAD). BitDrip can detect supported patterns and apply configured policy actions on validated proxy paths; organizations must assess detector coverage, bypass paths, and the rest of their cardholder-data environment.

Requirement	What BitDrip Enforces	How
Req 3.3 SAD protection	Can detect and block supported sensitive-authentication-data patterns on configured paths	PCI Dedicated detection rules for CVV/CVC codes, card PINs, and full magnetic stripe data patterns. Immediate-block policy option with violation logged.
Req 3.4 PAN rendering	Detects primary account numbers (PANs) in outbound AI traffic	PCI Luhn-algorithm-validated detection for Visa, Mastercard, Amex, and Discover card number formats. Reduces false positives dramatically compared to regex-only approaches. Violation triggers block or redaction.
Req 7.2 Access control systems	Logs which user triggered which policy decision for access review purposes	Audit Credentials User-identity-tagged audit evidence can support least-privilege access reviews. Credential detection can apply configured actions to supported API-key and service-token patterns.
Req 10.2 Audit log implementation	Generates audit evidence that can support customer-defined retention and review controls	Audit Validated audit configurations can record user, event, time, result, origin, and affected-resource fields. Confirm deployed event coverage, hash-chain verification, and customer-controlled retention.
Req 12.3.2 Annual risk assessment	Provides violation data and trend reports for the targeted risk analysis (TRA)	Audit Compliance dashboard generates per-framework violation reports exportable as evidence for annual risk assessment documentation.

Coverage note: BitDrip can support detection of cardholder-data patterns in configured AI traffic and related audit evidence. It does not cover network segmentation of the cardholder data environment (CDE), vulnerability scanning, penetration testing requirements, application security (Reqs 6.x), physical security, or the broader set of PCI DSS controls outside AI traffic flows. PCI DSS requires a Qualified Security Assessor (QSA) for formal compliance certification.

📊

SOC 2 — Service Organization Control 2

AICPA Trust Service Criteria · Applies to service organisations demonstrating security, availability, processing integrity, confidentiality, and privacy

SOC 2 Type II is the de facto security assurance standard in B2B SaaS. It requires documented evidence that controls were operating effectively over a defined audit period. BitDrip contributes controls and supporting evidence across the Security (CC) Trust Service Criteria — particularly logical access, transmission, monitoring, and vendor risk management — which are areas directly impacted by uncontrolled AI tool usage.

Criterion	What BitDrip Enforces	How
CC6.1 Logical access security	Can detect supported credential and sensitive-data patterns in configured AI paths	Credentials PII Detection of API keys (OpenAI, AWS, GCP, GitHub, Stripe, etc.), passwords in context, OAuth tokens, JWTs, and private SSH keys. Access to AI services is logged per user identity.
CC6.2 Prior to issuing credentials	Detects credentials being inadvertently exposed via AI interactions before revocation can occur	Credentials Real-time detection and blocking of credential patterns in prompts and AI responses. Violation triggers immediate alert, enabling rapid revocation workflow.
CC6.7 Transmission and disclosure	Controls and monitors disclosure of information to AI service providers	Architecture Audit Supported configured AI traffic is proxied and evaluated before forwarding. Validate each application path; bypassing, pinned, and unsupported traffic requires separate controls.
CC7.2 Monitoring of system components	Provides anomaly detection and alerting for AI usage policy violations	Audit Violation rate monitoring, per-user anomaly detection, and SIEM export (CEF/JSON). Threshold-based alerting configurable in the compliance dashboard.
CC9.2 Vendor and business partner risk	Provides visibility into data shared with AI service vendors (ChatGPT, Claude, Gemini, etc.)	Audit Per-vendor traffic reports show volume, violation counts, and blocked requests by AI provider. Supports vendor risk assessment documentation for SOC 2 auditors.

Coverage note: BitDrip provides technical controls and evidence supporting the Security Trust Service Criteria. A SOC 2 report requires a licensed CPA firm to perform the audit — BitDrip's audit log and violation reports become evidence artefacts in that process. Availability, Processing Integrity, and Privacy criteria require additional organisational controls beyond what BitDrip provides.

🌎

ISO 27001:2022 — Information Security Management

ISO/IEC 27001:2022 · International standard for information security management systems (ISMS)

ISO 27001:2022 Annex A includes controls addressing data leakage prevention (A.8.12) and information transfer (A.5.14). The mappings below can support an organization's evaluation of BitDrip as one technical control; applicability and inclusion in an ISMS remain the organization's and auditor's decisions.

Control	What BitDrip Enforces	How
A.5.14 Information transfer	Enforces policies governing the transfer of information to AI service providers	Proprietary PII Policy rules can apply to supported configured outbound AI paths. Transfer rules are configurable per user group, provider, and data classification, with block, warn, or log actions.
A.8.2 Information classification	Detects classified and proprietary information markers before transmission	Proprietary Detection of internal classification labels: CONFIDENTIAL, INTERNAL, PROPRIETARY, RESTRICTED, and custom markers configurable per organisation. Source code file paths with internal hostname patterns also detected.
A.8.12 Data leakage prevention	Provides configurable DLP controls for supported detection categories and AI paths	PII PHI PCI Credentials 29 detection rules across 6 categories covering the data types most likely to appear in AI prompt leakage incidents. BitDrip is purpose-built as an AI-channel DLP control.
A.8.16 Monitoring activities	Provides continuous monitoring and logging of AI channel activity	Audit Policy evaluation on supported configured AI requests, audit evidence, SIEM export, and threshold alerting can support monitoring controls. Customer storage configuration governs retention.
A.8.20 Networks security	Enforces TLS inspection and network-layer policy on AI traffic	Architecture BitDrip operates as a network-layer HTTPS proxy. TLS termination and re-encryption let it inspect configured supported traffic paths. Applications that bypass the proxy, use certificate pinning, or use unsupported transports require separate controls.

Coverage note: BitDrip capabilities may support selected Annex A controls in information security, network security, and data leakage areas. An ISO 27001 certification requires a full ISMS covering all applicable Annex A controls, a certified auditor, and ongoing surveillance audits. BitDrip does not constitute an ISMS by itself. Controls such as asset management, supplier relationships, business continuity, and physical security require separate organisational measures.

🇨🇦

CCPA / CPRA — California Consumer Privacy Act

Cal. Civ. Code §1798.100 et seq., amended by CPRA (Prop. 24) · Applies to for-profit businesses meeting revenue/data thresholds that handle personal information of California residents

The CCPA and its CPRA amendment give California residents rights over their personal information and impose obligations on businesses to protect that data. The "reasonable security" standard (§1798.81.5) is a key enforcement point — businesses must implement appropriate technical measures. AI tools present a novel risk vector: employee use of ChatGPT, Claude, or Gemini can result in California resident personal information being sent to third-party AI providers, triggering CCPA obligations.

Section	What BitDrip Enforces	How
§1798.100 Right to know	Creates an audit trail of personal information categories disclosed to AI providers	Audit PII Validated recorded events can identify the supported category and provider involved. Per-user and per-provider reports may support an organization's disclosure-mapping work but do not establish legal fulfilment.
§1798.140(o) Personal information definition	Detects personal information as broadly defined under CCPA	PII CCPA's PI definition is broad: names, addresses, IP addresses, email addresses, government IDs, biometric data, browsing history, inferences. BitDrip's PII rules cover the technically detectable subset of this definition in text form.
§1798.150 Data breach liability	Reduces breach risk by blocking PI before it reaches AI service providers	PII Credentials A successful block on a supported configured path stops that request before forwarding. Detector misses, bypass paths, policy choices, and other transfers require separate assessment and controls.
§1798.81.5 Reasonable security	Provides documented technical safeguards for personal information handling	Architecture Audit Supported-path policy evaluation, authenticated connections, per-user evidence, and verified tamper-evident records may contribute to an organization's broader reasonable-security evidence. They do not establish legal compliance by themselves.

Coverage note: BitDrip can support detection and configured policy actions for personal-information patterns on supported AI paths, and can provide audit evidence for an organization's compliance evaluation. It does not cover privacy notice requirements, opt-out mechanism implementation (GPC signal handling, "Do Not Sell" links), data subject request workflows, or sensitive personal information use limitation obligations. Organisations may have additional obligations not addressed here.

Important Disclaimer

BitDrip provides configurable technical controls that can support selected framework objectives on validated paths. The mappings above assist technical evaluation; they are not a legal opinion, certification, or guarantee of control effectiveness.

BitDrip does not replace your legal counsel, a qualified Data Protection Officer, a PCI QSA, a certified ISO 27001 auditor, or a licensed CPA performing a SOC 2 audit. Compliance with any regulation requires a combination of technical controls, organisational policies, staff training, contractual measures, and ongoing governance — only some of which BitDrip addresses.

Compliance requirements vary by jurisdiction, industry, and the specific nature of your data processing activities. Always engage qualified legal and compliance professionals before making regulatory claims.

Need a compliance walkthrough?

We can walk your security or compliance team through exactly how BitDrip maps to your specific regulatory obligations and help you gather the evidence artefacts your auditor needs.

Contact sales@bitdrip.app Read the docs →