Skip to main content

​
Compliance plugin marketplace

The plugin marketplace (Settings → Compliance → Marketplace) is the single browse page for the two classes of compliance packs your workspace can use: evidence-export packs (the binder frameworks: SOC 2, ISO 27001, GDPR, HIPAA) and activation bundles (industry packs: HIPAA healthcare, fintech KYC, e-commerce, PCI payment collection). The evidence binder page documents the binder mechanics; the marketplace is where you see both pack classes side by side before you mount anything. Open it with either Binder history (past generations) or Bundle checklists (go-live checklists) as shortcuts at the top of the page, plus a counter for how many packs you have generated or activated.

​
What the marketplace surfaces

Evidence-export packs — each framework card shows its name, issuing authority, control count, and scope. Each one assembles its evidence in one click:
  • SOC 2 (AICPA Trust Services Criteria)
  • ISO 27001 (Annex-A controls)
  • GDPR (data-subject request history, breach counts, consent and retention posture)
  • HIPAA (PHI access logging, BAA posture, configured retention)
You pick the output format on the card — ZIP (one Markdown file per control plus a SHA-256 manifest, for GRC imports) or HTML (a browser-printable attestation; print to PDF for the buyer copy) — and generate. If a generation for that framework is already queued or running, the card shows the job instead of queueing a duplicate, so repeated clicks are safe. Activation bundles — each industry pack provisions a draft compliance profile, draft campaigns, a vertical-tuned AI agent, and an opt-in flow configuration in one call. Nothing goes live on activation; the go-live checklist walks you from draft to production step by step. That draft-only shape is deliberate: activating a bundle never wires a carrier and never places a send.

​
Tenant-owned posture controls

Compliance posture is the tenant’s configuration, never a platform mandate. The marketplace gives you the controls; you decide which bundles your workspace mounts and which frameworks you export. The platform does not require any bundle, and a tenant can run with none mounted.
  • Mounting bundles — a workspace owner or admin activates a bundle; the resulting draft resources stay draft until you work the go-live checklist, and you can leave a bundle dormant indefinitely.
  • Issuing packs — pack generation requires the workspace owner or admin role, and API keys follow the same role gate. Every generation writes an audit-log entry with the framework, format, and requesting role; completion writes a second entry.
  • Export retention windows — the 24-hour signed download link is a tenant safety measure: the link you hand to an auditor lapses on a schedule you can point to, and an expired link is refreshed by regenerating on demand. You set the export cadence; the expiry just stops a hand-off from staying valid forever.

​
Mapping — which compliance sections feed a pack

Evidence packs read the workspace data these sections govern. Configure the sources first, then configure the mounts:

​
Download flow

  1. POST /api/v1/compliance/binder/generate queues the assembly and returns 202 with a job id.
  2. Poll GET /api/v1/compliance/binder/:jobId until the job reports Completed.
  3. The completed job carries a download_url (24-hour signed link), a download_sha256 checksum, and download_size_bytes.
Forward the signed URL to the auditor or buyer. If the audit-integrity check flagged anything while the pack was built, the completed job carries a tamper alert — treat that as a signal to investigate before forwarding. For the legal surface the auditor note heads to, see Legal.

​
Example — SOC 2 pack end to end

  1. Queue the generation:
The response is 202:
  1. Poll until the job completes:
  1. Hand the completed job’s download_url to your auditor, with download_sha256 so they can verify the file. If it lapses until expiry, regenerate on demand — the second click reattaches to the same running job rather than queueing a duplicate.