Compliance Coverage Map

At a Glance

Coverage Matrix

Each row is a detection rule category built into BitDrip. Each column is a compliance framework. A check mark means BitDrip's detection rules directly enforce requirements in that framework.

Rule Category	GDPR	HIPAA	PCI DSS v4	SOC 2	ISO 27001	CCPA
👥PII Names, emails, phones, addresses, SSNs, DOB, IPs	✓	✓	Partial	✓	✓	✓
🏥PHI Medical records, diagnosis codes, medications, insurance IDs	✓	✓	—	✓	✓	✓
💳PCI / Payment Card numbers (Luhn), CVV/PIN, bank accounts, SWIFT/IBAN	✓	—	✓	✓	✓	✓
🔐Credentials API keys, passwords, OAuth tokens, JWTs, SSH private keys	✓	✓	✓	✓	✓	✓
📄Proprietary Data Classification markers, internal hostnames, project codenames	✓	—	—	✓	✓	—
🤖Agentic Actions MCP tool calls, shell commands, DB connection strings in agent output	✓	✓	✓	✓	✓	Partial
📜Audit Log Tamper-evident hash-chain log of all policy decisions	✓	✓	✓	✓	✓	✓
🏠Architecture Self-hosted, TLS 1.3 enforcement, no cloud egress of content	✓	✓	✓	✓	✓	✓

Detailed Mapping

Per-Framework Requirements

Each section lists specific articles or control numbers, what BitDrip enforces against them, and the mechanism used. Coverage notes are honest about scope.

🇪🇺

GDPR — General Data Protection Regulation

EU Regulation 2016/679 · Applies to any organisation processing personal data of EU residents

GDPR governs the collection, processing, and storage of personal data belonging to EU data subjects. It applies to any organisation worldwide that handles data about EU residents, making it the most broadly applicable privacy regulation. BitDrip addresses the technical controls required for lawful processing — it does not replace the legal and organisational obligations (DPO appointment, DPIA documentation, data subject request workflows) mandated by the regulation.

Article / Requirement	What BitDrip Enforces	How
Art. 5(1)(c) Data minimisation	Prevents unnecessary personal data from leaving the enterprise in AI prompts	PII Detection and blocking of personal identifiers (names, emails, phone numbers, addresses, national ID numbers, DOB) in outbound AI requests. Policy can block, warn, or redact.
Art. 9 Special category data	Detects health and biometric data before it reaches AI services	PHI Rules targeting ICD-10 codes, diagnosis terms, medication names, medical record numbers, and insurance IDs. High-confidence detection with immediate-block option.
Art. 25 Data protection by design	Architecture prevents content from flowing outside controlled infrastructure	Architecture BitDrip is entirely self-hosted. No prompt content, violation details, or user data ever leaves your environment. The proxy intercepts at the network layer before content reaches external AI APIs unvetted.
Art. 32 Security of processing	Enforces encryption in transit; generates evidence of technical controls	Architecture Audit TLS 1.3 enforcement on all proxied connections. Audit log records every policy decision with user identity, timestamp, rule triggered, and action taken.
Art. 83 Administrative fines	Provides documented evidence that technical controls were in place	Audit Tamper-evident, hash-chained audit log exportable for DPA investigations. Demonstrates due diligence and existence of technical safeguards at the time of any alleged violation.

Coverage note: BitDrip covers technical controls for processing security, data minimisation, and audit evidence. It does not cover legal-basis documentation, consent management, data subject access request (DSAR) workflows, DPO appointment, DPIA/LIA reports, cross-border transfer mechanisms (SCCs, BCRs), or physical security requirements. These remain organisational responsibilities.

🏥

HIPAA — Health Insurance Portability and Accountability Act

45 CFR Parts 160 & 164 · Applies to US covered entities and their business associates handling protected health information

HIPAA's Security Rule mandates administrative, physical, and technical safeguards for electronic protected health information (ePHI). BitDrip directly addresses several technical safeguard requirements: access controls, audit controls, integrity controls, and transmission security. Organisations using AI tools in healthcare workflows face significant HIPAA risk if PHI leaks through prompts — BitDrip is designed to prevent exactly this.

Section	What BitDrip Enforces	How
§164.312(a)(1) Access controls	Enforces per-user policy and logs user identity on every AI interaction	Audit RBAC integration: different user groups can have different blocking policies. Every policy decision is logged with the authenticated user identity, supporting unique user identification requirements.
§164.312(b) Audit controls	Records and retains hardware and software activity logs for ePHI access events	Audit Immutable audit log captures: timestamp, user, action (block/warn/pass), rule matched, AI service endpoint. Exportable to SIEM. Configurable retention period per compliance profile.
§164.312(c)(1) Integrity	Ensures audit records have not been altered or destroyed	Audit Hash-chain integrity: each audit log entry includes a SHA-256 hash of the previous entry. Any tampering breaks the chain and is detectable during export verification.
§164.312(e)(1) Transmission security	Protects ePHI in transit between your users and AI services	Architecture BitDrip operates as a TLS 1.3 MITM proxy. All AI traffic is terminated and re-encrypted within your perimeter. No unencrypted ePHI traverses external networks. Certificate pinning options available.
§164.514(b) Minimum necessary	Blocks PHI from being included in AI prompts beyond what is required	PHI 29 detection rules covering the PHI categories most likely to appear in AI prompts: medical record numbers, ICD-10 diagnosis codes, condition and disease names, medication names, insurance member IDs, dates of service, provider names, and patient account numbers.

Coverage note: BitDrip covers technical safeguards for transmission security, audit controls, integrity, and access control logging. It does not cover physical safeguard requirements (workstation use, device controls, facility access), administrative safeguards (workforce training, sanction policy, contingency planning), or Business Associate Agreement (BAA) execution — those require organisational action. BitDrip itself is self-hosted and does not process ePHI on your behalf, so no BAA with Anchor Cyber Security is required for the tool itself.

💳

PCI DSS v4.0 — Payment Card Industry Data Security Standard

PCI SSC v4.0 (March 2022) · Applies to any organisation that stores, processes, or transmits cardholder data

PCI DSS v4.0 tightens controls around cardholder data protection, requiring organisations to prevent sensitive authentication data (SAD) from being stored or transmitted inappropriately. As employees increasingly use AI tools in finance, support, and operations roles, cardholder data can inadvertently enter prompts. BitDrip detects and blocks this at the network layer before it reaches AI service providers.

Requirement	What BitDrip Enforces	How
Req 3.3 SAD protection	Prevents sensitive authentication data from being transmitted to AI services	PCI Dedicated detection rules for CVV/CVC codes, card PINs, and full magnetic stripe data patterns. Immediate-block policy option with violation logged.
Req 3.4 PAN rendering	Detects primary account numbers (PANs) in outbound AI traffic	PCI Luhn-algorithm-validated detection for Visa, Mastercard, Amex, and Discover card number formats. Reduces false positives dramatically compared to regex-only approaches. Violation triggers block or redaction.
Req 7.2 Access control systems	Logs which user triggered which policy decision for access review purposes	Audit Credentials User-identity-tagged audit log supports least-privilege access reviews. Credential detection (API keys, service account tokens) prevents accidental exposure of access control material.
Req 10.2 Audit log implementation	Generates and retains compliant audit logs for AI traffic policy decisions	Audit Audit log captures all required event types: user ID, event type, date/time, success/failure indicator, origination, and identity of affected resource. Tamper-evident with hash-chain integrity. Configurable retention.
Req 12.3.2 Annual risk assessment	Provides violation data and trend reports for the targeted risk analysis (TRA)	Audit Compliance dashboard generates per-framework violation reports exportable as evidence for annual risk assessment documentation.

Coverage note: BitDrip covers detection of cardholder data in AI traffic and audit logging. It does not cover network segmentation of the cardholder data environment (CDE), vulnerability scanning, penetration testing requirements, application security (Reqs 6.x), physical security, or the broader set of PCI DSS controls outside AI traffic flows. PCI DSS requires a Qualified Security Assessor (QSA) for formal compliance certification.

📊

SOC 2 — Service Organization Control 2

AICPA Trust Service Criteria · Applies to service organisations demonstrating security, availability, processing integrity, confidentiality, and privacy

SOC 2 Type II is the de facto security assurance standard in B2B SaaS. It requires documented evidence that controls were operating effectively over a defined audit period. BitDrip contributes controls and supporting evidence across the Security (CC) Trust Service Criteria — particularly logical access, transmission, monitoring, and vendor risk management — which are areas directly impacted by uncontrolled AI tool usage.

Criterion	What BitDrip Enforces	How
CC6.1 Logical access security	Prevents credentials and sensitive data from being disclosed through AI prompts	Credentials PII Detection of API keys (OpenAI, AWS, GCP, GitHub, Stripe, etc.), passwords in context, OAuth tokens, JWTs, and private SSH keys. Access to AI services is logged per user identity.
CC6.2 Prior to issuing credentials	Detects credentials being inadvertently exposed via AI interactions before revocation can occur	Credentials Real-time detection and blocking of credential patterns in prompts and AI responses. Violation triggers immediate alert, enabling rapid revocation workflow.
CC6.7 Transmission and disclosure	Controls and monitors disclosure of information to AI service providers	Architecture Audit All AI API traffic is proxied. No transmission occurs without policy evaluation. Full request/response metadata logged (content hashed, not stored in full) to support disclosure audit trail.
CC7.2 Monitoring of system components	Provides anomaly detection and alerting for AI usage policy violations	Audit Violation rate monitoring, per-user anomaly detection, and SIEM export (CEF/JSON). Threshold-based alerting configurable in the compliance dashboard.
CC9.2 Vendor and business partner risk	Provides visibility into data shared with AI service vendors (ChatGPT, Claude, Gemini, etc.)	Audit Per-vendor traffic reports show volume, violation counts, and blocked requests by AI provider. Supports vendor risk assessment documentation for SOC 2 auditors.

Coverage note: BitDrip provides technical controls and evidence supporting the Security Trust Service Criteria. A SOC 2 report requires a licensed CPA firm to perform the audit — BitDrip's audit log and violation reports become evidence artefacts in that process. Availability, Processing Integrity, and Privacy criteria require additional organisational controls beyond what BitDrip provides.

🌎

ISO 27001:2022 — Information Security Management

ISO/IEC 27001:2022 · International standard for information security management systems (ISMS)

ISO 27001:2022 introduced significant updates to Annex A controls, including new controls specifically addressing data leakage prevention (A.8.12) and information transfer (A.5.14). AI tool usage is now an explicit risk category that ISMS risk assessments must address. BitDrip maps directly to these updated controls, providing a technical layer that can be cited in the Statement of Applicability (SoA) and risk treatment plan.

Control	What BitDrip Enforces	How
A.5.14 Information transfer	Enforces policies governing the transfer of information to AI service providers	Proprietary PII Policy rules applied to all outbound AI traffic. Transfer rules configurable per user group, AI provider, and data classification. Block, warn, or log actions available.
A.8.2 Information classification	Detects classified and proprietary information markers before transmission	Proprietary Detection of internal classification labels: CONFIDENTIAL, INTERNAL, PROPRIETARY, RESTRICTED, and custom markers configurable per organisation. Source code file paths with internal hostname patterns also detected.
A.8.12 Data leakage prevention	Provides DLP controls across all detection categories for AI channel	PII PHI PCI Credentials 29 detection rules across 6 categories covering the data types most likely to appear in AI prompt leakage incidents. BitDrip is purpose-built as an AI-channel DLP control.
A.8.16 Monitoring activities	Provides continuous monitoring and logging of AI channel activity	Audit Continuous policy evaluation of every AI request. Tamper-evident audit log with SIEM export. Anomaly alerting on violation rate thresholds. All monitoring data retained for configurable period.
A.8.20 Networks security	Enforces TLS inspection and network-layer policy on AI traffic	Architecture BitDrip operates as a network-layer HTTPS proxy. TLS 1.3 termination and re-encryption within the perimeter ensures all AI traffic is inspected. CA certificate management for enterprise-wide trust deployment.

Coverage note: BitDrip addresses Annex A controls in the information security, network security, and data leakage areas. An ISO 27001 certification requires a full ISMS covering all applicable Annex A controls, a certified auditor, and ongoing surveillance audits. BitDrip is a technical control within the ISMS — it does not constitute an ISMS by itself. Controls such as asset management, supplier relationships, business continuity, and physical security require separate organisational measures.

🇨🇦

CCPA / CPRA — California Consumer Privacy Act

Cal. Civ. Code §1798.100 et seq., amended by CPRA (Prop. 24) · Applies to for-profit businesses meeting revenue/data thresholds that handle personal information of California residents

The CCPA and its CPRA amendment give California residents rights over their personal information and impose obligations on businesses to protect that data. The "reasonable security" standard (§1798.81.5) is a key enforcement point — businesses must implement appropriate technical measures. AI tools present a novel risk vector: employee use of ChatGPT, Claude, or Gemini can result in California resident personal information being sent to third-party AI providers, triggering CCPA obligations.

Section	What BitDrip Enforces	How
§1798.100 Right to know	Creates an audit trail of personal information categories disclosed to AI providers	Audit PII Audit log records every violation category and AI provider involved. Per-user and per-provider reports support disclosure mapping exercises required for CCPA "Right to Know" fulfilment.
§1798.140(o) Personal information definition	Detects personal information as broadly defined under CCPA	PII CCPA's PI definition is broad: names, addresses, IP addresses, email addresses, government IDs, biometric data, browsing history, inferences. BitDrip's PII rules cover the technically detectable subset of this definition in text form.
§1798.150 Data breach liability	Reduces breach risk by blocking PI before it reaches AI service providers	PII Credentials Blocking PI in AI prompts prevents that data from appearing in AI provider logs, training datasets, or potential provider-side breaches — all of which could trigger §1798.150 private right of action.
§1798.81.5 Reasonable security	Provides documented technical safeguards for personal information handling	Architecture Audit The California AG's "reasonable security" standard references CIS Controls. BitDrip's combination of network-layer DLP, TLS 1.3 enforcement, per-user access logging, and tamper-evident audit trail constitutes evidence of reasonable security measures applied to the AI traffic channel.

Coverage note: BitDrip covers technical detection and blocking of personal information in AI traffic, and generates audit evidence supporting CCPA compliance claims. It does not cover privacy notice requirements, opt-out mechanism implementation (GPC signal handling, "Do Not Sell" links), data subject request workflows, or sensitive personal information use limitation obligations — these require website and operational changes outside the scope of a network proxy. Organisations selling data may have additional obligations not addressed here.

Important Disclaimer

BitDrip enforces technical controls that are aligned with the frameworks described on this page. The mappings above are provided to assist your technical evaluation — they are not a legal opinion and do not constitute a compliance certification.

BitDrip does not replace your legal counsel, a qualified Data Protection Officer, a PCI QSA, a certified ISO 27001 auditor, or a licensed CPA performing a SOC 2 audit. Compliance with any regulation requires a combination of technical controls, organisational policies, staff training, contractual measures, and ongoing governance — only some of which BitDrip addresses.

Compliance requirements vary by jurisdiction, industry, and the specific nature of your data processing activities. Always engage qualified legal and compliance professionals before making regulatory claims.

Need a compliance walkthrough?

We can walk your security or compliance team through exactly how BitDrip maps to your specific regulatory obligations and help you gather the evidence artefacts your auditor needs.

Contact sales@bitdrip.app Read the docs →