COMPLIANCE INTELLIGENCE / REQUIREMENTS BEFORE REASSURANCE
The right requirements. The evidence to decide.
Start with the rules and assurances that matter to your work. Find the published evidence, understand its limits and know what to ask before you commit.
01 / FIND THE EVIDENCE
Your requirements. A more precise shortlist.
Find published claims that discuss your framework. A matching mention can describe a capability, condition or limitation. Read the statement before drawing a conclusion.
Purpose labels are curated against exact current evidence. Workflow support does not establish supplier assurance. Unclassified mentions remain available under “All published mentions”.
Braintrust describes inspecting agent traces and comparing prompts and models using datasets and automated or human scoring.
Vendor-reported assurance
Obtain the service-specific DPA, subprocessor list, data locations and rights/deletion process.
vendor asserted · Reviewed 11/2/2026
Braintrust advertises GDPR compliance on its product page. This statement does not establish the applicable processor agreement, international-transfer mechanism, retention settings or lawfulness of a particular customer workflow.
Collibra documents AI Command Center as the evolution of AI Governance, bringing AI registries and governance workflows together.
Data-processing documentation
Reconcile the applicable DPA, subprocessors, transfer mechanism and assessment with the actual service and regions.
vendor asserted · Reviewed 11/2/2026
Collibra's trust center directs customers to a data-processing addendum and subprocessor list, and offers transfer-impact assessments on request. This documents a GDPR diligence route, not the adequacy of a customer's transfer arrangement or a finding about AI Command Center's data flows.
ComplyCloud presents software for managing compliance work and documentation.
Customer compliance workflow support
Confirm the contracted entity, current product/module and migration obligations. This dossier retains the legacy product identity and does not create a duplicate listing.
vendor asserted · Reviewed 11/3/2026
Cerivo's official ComplyCloud transition page says ComplyCloud is now Cerivo and that existing customers retain their login, legal documentation and agreement. It points to GDPR records, DPA and data-subject-request workflows. This documents vendor-stated continuity, not universal migration terms or a customer's compliance outcome.
Cookiebot presents a consent management product and website scanning workflow.
Data-processing documentation
Read the current agreement, annexed subprocessors and third-country conditions against the selected CMP features and actual integrations.
Data-processing documentation
Trace consent records and add-ons separately from downstream advertising/analytics processing; retain the applicable subprocessor-list version.
vendor asserted · Reviewed 11/3/2026
Cookiebot's public DPA includes an annex listing subprocessors and their processing purposes. Buyers must reconcile that annex and the applicable agreement with their deployment; a listed supplier does not establish that customer-configured tags, trackers or destinations are covered.
Cookiebot's posted DPA describes EU/EEA processing and conditional third-country transfers under its consent and transfer provisions. This is a contractual description, not proof that every data flow remains in the EU/EEA or that a customer's transfer assessment is complete.
DataGrail describes a live data map, consent management, request management and privacy assessments.
Customer compliance workflow support
Test a synthetic request across connected and unconnected systems; inspect verification, exemptions, evidence exports and ownership of incomplete responses.
vendor asserted · Reviewed 11/3/2026
DataGrail's GDPR solution page describes request intake and identity verification, fulfillment tracking, data mapping and pre-populated privacy-impact assessments. These are vendor-described operational functions, not evidence that every system is discovered, a request is complete or a customer's processing is lawful.
Dataiku describes model registries, approval workflows, lineage and performance monitoring within its enterprise AI platform.
Data-processing documentation
Reconcile Cloud versus self-managed roles, DPA scope, support access, regions, subprocessors and retention before ingesting personal data.
vendor asserted · Reviewed 11/3/2026
Dataiku's privacy documentation distinguishes customer-operated installations from Dataiku Cloud, where it describes a processor role and a DPA. Buyers must assess the chosen deployment and any support or integration data flows; the distinction does not establish lawful processing or executed customer terms.
Enzai describes structured AI intake, centralized inventories, assessments and oversight workflows.
Customer compliance workflow support
Request the current mapping version, applicability decisions, evidence exports and treatment of obligations outside the tool.
vendor asserted · Reviewed 11/2/2026
Enzai describes structured AI intake, assessment and approval workflows mapped to GDPR, alongside other frameworks. The published mapping is a supplier-described governance capability; it does not establish that a customer system meets every applicable requirement.
HoneyHive describes agent tracing, online evaluations, experiments, datasets, annotation queues and prompt management. Its site distinguishes SaaS, hybrid and self-hosted operating models and describes exporting telemetry and evaluation records.
vendor asserted · Reviewed 11/2/2026
HoneyHive's pricing FAQ asserts HIPAA, GDPR and SOC 2 Type II compliance and says data is encrypted at rest and in transit. These are vendor assertions; GovernAtlas has not reviewed an assurance report or tested the controls.
Hyperproof describes control mapping, risk workflows, audit evidence requests and third-party assessments.
Vendor-reported assurance
Request the attestation, date, scope and assessment basis; separately review your DPA, transfers, processing purposes and current changes.
vendor asserted · Reviewed 11/3/2026
Hyperproof states that 360 Advanced provided a GDPR attestation in January 2025 with no findings. GovernAtlas has not reviewed that attestation or its scope and methodology; this vendor statement is not a regulatory approval or proof of GDPR compliance for a customer's processing.
Immuta describes authoring data policies and applying masking or access restrictions through supported data infrastructure.
Data-processing documentation
Review the operative DPA, current recipient changes, support locations and selected region; do not equate hosting geography with every access or transfer.
vendor asserted · Reviewed 11/3/2026
Immuta distinguishes its GDPR processor/subprocessor role for licensed SaaS use from controller processing for its own purposes. Its trust page includes recipient lists marked March 16, 2026. These documented roles and lists still need reconciliation with the customer's agreement and actual processing.
Langfuse documents tracing, prompt version management, datasets and evaluation workflows.
Data-processing documentation
Inspect the current DPA, subprocessor chain, deletion settings and transfer assessment; a privacy contact alone does not establish compliance.
vendor asserted · Reviewed 11/2/2026
Langfuse's GDPR documentation directs users to its DPA and personal-data management guidance, and identifies privacy@clickhouse.com for data-subject requests. Buyers still need to reconcile the current contracting entity, agreement, processing roles and transfer terms for their chosen service.
Langfuse's compliance FAQ states that its cloud offering supports SOC 2 Type II, ISO 27001 and GDPR requirements and offers a HIPAA-ready region. These remain supplier assertions; GovernAtlas has not inspected an auditor's report or determined regulatory compliance.
LangChain describes LangSmith tracing and monitoring for model calls, tool activity, latency, cost and online evaluations.
Data-processing documentation
Inspect the operative DPA, order form, region, retention, subprocessors and support-access terms for the selected LangSmith deployment.
vendor asserted · Reviewed 11/3/2026
LangChain's posted LangSmith terms incorporate a DPA for processing subject to applicable data-protection laws. This documents the contractual route for GDPR diligence, not execution, transfer adequacy or coverage of every customer instruction and integration.
A current published claim makes a product discoverable here. Its original classification remains visible. A negative statement, a restricted feature or a qualified promise can also mention a framework: matching text is not a positive compliance assessment.
A BAA is a scoped agreement.
HHS explains that a cloud provider handling ePHI on behalf of a covered entity or business associate may itself be a business associate, even when it cannot decrypt the data. Establish the relationship, obtain the appropriate agreement and assess the safeguards for the service you intend to use.
SOC 2 is an assurance report; ISO 27001 concerns an information security management system. Neither label alone answers your HIPAA deployment question. Ask for the relevant report or certificate, its scope, date and exclusions, and evaluate what it actually covers.
The HIPAA Security Rule addresses administrative, physical and technical safeguards. Your risk analysis, workforce practices, integrations and configuration remain part of the assessment. Review before sharing PHI and when material circumstances change.
Identify who decides the purposes and who processes on instructions. Review the DPA, subprocessors, transfers, rights assistance and retention for the actual service. A vendor privacy claim or an EU hosting option leaves those questions open.
Assess the intended purpose, operator role and current applicable obligations before selecting controls. A mapping platform can help organize work; its policy pack does not establish legal applicability, a completed conformity assessment or customer compliance.
A claim starts the conversation. Evidence moves it forward.
Follow personal data through the actual service. Establish roles, processing terms, transfers and rights handling before relying on a privacy badge.
A security certificate, EU hosting location or published privacy policy does not settle GDPR applicability or lawful processing. These questions prepare a review; they are not an exhaustive assessment.
Answers stay in this page’s memory. Export before leaving or switching frameworks; switching clears answers. Record source links and review notes, never patient information or credentials. “Evidence received” is not a finding of compliance.
01 / Roles & purposeWho is controller, processor or another recipient for each use of our data?
Request a data-flow map listing purposes, data categories, data subjects and recipients. Separate processing on your instructions from the supplier's own uses. Assign your own reviewer to assess applicability and lawful basis.
02 / Processing agreementWhich binding processing terms apply to this service?
Request the current DPA and schedules covering instructions, duration, confidentiality, safeguards, assistance, subprocessors, audit rights and return/deletion. Reconcile the legal entity and order form; a website privacy notice is not the same document.
03 / Subprocessors & changeWho processes the data downstream, and how can changes be challenged?
Request the current subprocessor list, functions, processing locations, authorization terms and notice/objection process. Include model providers, support, telemetry and backups. Test whether changes reach the contract owner.
04 / International transfersWhere can data be stored or accessed, and on what transfer basis?
Request the transfer map, applicable mechanism and assessment with supplementary measures where needed. Include remote support access. Distinguish residency from transfer restrictions; have your reviewer assess the current legal position.
05 / Rights & retentionCan we locate, export, correct and delete a person's data throughout the service?
Use synthetic records to test rights assistance, configured retention and deletion. Ask about backup expiry, derived records, logs and model-training uses. Record what is automatic and what requires a support request.
06 / Security & incidentsWhat safeguards and notification commitments cover this processing?
Request relevant security evidence, access controls, breach escalation terms and assistance commitments. Compare obligations with your own response process. A SOC 2 report may inform the review but does not decide GDPR compliance.
07 / Impact & exitWhat evidence supports our risk assessment and a workable exit?
Request assistance for DPIAs where relevant, audit evidence, data export formats and deletion confirmation. Assign owners to residual risks and review again after material changes. Keep your legal and operational decisions separate from vendor claims.
QUESTIONS ANSWERED
Before you shortlist.
Does GovernAtlas certify these products?
No. Discovery links published claims to their sources. Inclusion, payment and a framework mention do not establish compliance or suitability for your deployment.
What if a vendor has no matching evidence?
Our current coverage may be incomplete. Use the checklist to ask the vendor for documents and submit public sources for editorial review. An unknown result is not an adverse finding.
Can I use the checklist for a clinical AI tool?
Use it for the PHI-handling review, then separately evaluate clinical safety, intended use, human oversight and any applicable medical-device requirements. HIPAA alone does not establish clinical safety or effectiveness.
Can companies pay for a better evidence classification?
No. Public research and this checklist stay free. Company subscriptions do not change editorial gates, evidence classifications or search eligibility.
GovernAtlas editorial buying method · reviewed November 2, 2026. Primary references: HHS business associates, HHS risk analysis. The checklist is a preparation aid, not an exhaustive legal assessment.