> ## Documentation Index
> Fetch the complete documentation index at: https://docs.knoxcall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance Packs

> One-click HIPAA, PCI-DSS, GDPR, and SOC 2 packs that install PII recognizers and audit-log alert rules — with honest install reporting that never silently drops a rule.

# Compliance Packs

A compliance pack installs, in one operation, the recognizers and alert rules for a regulatory regime. Available packs: `hipaa-safe-harbor`, `pci-dss`, `gdpr`, `soc2`.

## What a pack installs

1. **PII recognizers** — entity-type patterns added to the [detector stack](/ai-gateway/pii-redaction) (for example, HIPAA Safe Harbor's 18 identifiers).
2. **Alert rules** — `ai_gateway_event` alerts that fire on specific conditions, including PII-event conditions counted from the `ai_gateway_pii_events` ledger. For example, HIPAA installs a rule for *"an SSN appears in a response"* and a *"canary echoed"* rule.

## Honest install reporting

The installer **never silently drops a rule**. If a pack contains an alert condition the current engine can't express, the install result reports it explicitly in an `alerts_skipped` field rather than quietly discarding it — so what you installed is always exactly what you can see. PII-event conditions (entity type + direction) are translated into real evaluator conditions, so the richer rules install instead of vanishing.

Install a pack from the **Compliance tab** on the gateway detail page, or via the Packs API. A dry-run shows exactly what would be created before you commit.

## Evidence exports

The Compliance tab can produce a **per-request evidence bundle** — what was redacted or blocked, by which policy, for a given period — as an exportable artifact. This is the compliance evidence auditors ask for and that most gateways can't produce.

## Related audit actions

Packs listen on audit actions the gateway already emits, so alerts light up with no extra wiring:

| Audit action             | Fires when                                                                       |
| ------------------------ | -------------------------------------------------------------------------------- |
| `ai_gateway.canary_leak` | A [canary token](/ai-gateway/firewall) was echoed by the model.                  |
| PII-event conditions     | A configured entity type appears in a request or response (from the PII ledger). |

<Note>
  Right-to-be-forgotten (RTBF) and retention automation for the PII ledger and token map are part of the compliance roadmap; the recognizer + alert-rule install and evidence export described here are available today.
</Note>