> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance plugin marketplace

> Browse every compliance pack in one place — evidence-export binders for SOC 2, ISO 27001, GDPR, and HIPAA, plus one-click activation bundles for your industry. Tenant-owned controls throughout.

# Compliance plugin marketplace

The plugin marketplace (**Settings → Compliance → Marketplace**) is the single browse page for the two classes of compliance packs your workspace can use: **evidence-export packs** (the binder frameworks: SOC 2, ISO 27001, GDPR, HIPAA) and **activation bundles** (industry packs: HIPAA healthcare, fintech KYC, e-commerce, PCI payment collection). The [evidence binder](/compliance/evidence-binder) page documents the binder mechanics; the marketplace is where you see both pack classes side by side before you mount anything.

Open it with either **Binder history** (past generations) or **Bundle checklists** (go-live checklists) as shortcuts at the top of the page, plus a counter for how many packs you have generated or activated.

## What the marketplace surfaces

**Evidence-export packs** — each framework card shows its name, issuing authority, control count, and scope. Each one assembles its evidence in one click:

* **SOC 2** (AICPA Trust Services Criteria)
* **ISO 27001** (Annex-A controls)
* **GDPR** (data-subject request history, breach counts, consent and retention posture)
* **HIPAA** (PHI access logging, BAA posture, configured retention)

You pick the output format on the card — **ZIP** (one Markdown file per control plus a SHA-256 manifest, for GRC imports) or **HTML** (a browser-printable attestation; print to PDF for the buyer copy) — and generate. If a generation for that framework is already queued or running, the card shows the job instead of queueing a duplicate, so repeated clicks are safe.

**Activation bundles** — each industry pack provisions a **draft** compliance profile, draft campaigns, a vertical-tuned AI agent, and an opt-in flow configuration in one call. Nothing goes live on activation; the go-live checklist walks you from draft to production step by step. That draft-only shape is deliberate: activating a bundle never wires a carrier and never places a send.

| Endpoint                                                                             | Purpose                                                                     |
| ------------------------------------------------------------------------------------ | --------------------------------------------------------------------------- |
| `GET /api/v1/compliance/binder/frameworks`                                           | Evidence-pack catalogue                                                     |
| `POST /api/v1/compliance/binder/generate`                                            | Queue a pack generation (`202`)                                             |
| `GET /api/v1/compliance/binder/:jobId`                                               | Status, signed download URL, checksum                                       |
| `GET /api/v1/compliance/binder?page=`                                                | Generation history                                                          |
| `GET /api/v1/compliance/vertical-bundles`                                            | Activation-bundle catalogue                                                 |
| `GET /api/v1/compliance/vertical-bundles/:key`                                       | Full manifest — everything a bundle provisions, previewed before activation |
| `POST /api/v1/compliance/vertical-bundles/:key/activate`                             | Provision the bundle as drafts                                              |
| `GET /api/v1/compliance/vertical-bundles/activations/:profileId`                     | Activation state + checklist                                                |
| `PATCH /api/v1/compliance/vertical-bundles/activations/:profileId/checklist/:stepId` | Toggle a checklist step                                                     |

## Tenant-owned posture controls

Compliance posture is the **tenant's** configuration, never a platform mandate. The marketplace gives you the controls; you decide which bundles your workspace mounts and which frameworks you export. The platform does not require any bundle, and a tenant can run with none mounted.

* **Mounting bundles** — a workspace owner or admin activates a bundle; the resulting draft resources stay draft until you work the go-live checklist, and you can leave a bundle dormant indefinitely.
* **Issuing packs** — pack generation requires the workspace **owner** or **admin** role, and API keys follow the same role gate. Every generation writes an audit-log entry with the framework, format, and requesting role; completion writes a second entry.
* **Export retention windows** — the 24-hour signed download link is a tenant safety measure: the link you hand to an auditor lapses on a schedule you can point to, and an expired link is refreshed by regenerating on demand. You set the export cadence; the expiry just stops a hand-off from staying valid forever.

## Mapping — which compliance sections feed a pack

Evidence packs read the workspace data these sections govern. Configure the sources first, then configure the mounts:

| Marketplace section                                                                    | Feeds                                                                                        |
| -------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| [Consent management](/compliance/consent-management)                                   | Consent posture rows cited in GDPR packs                                                     |
| [Evidence binder](/compliance/evidence-binder)                                         | The four framework packs and the signed download flow                                        |
| [EU AI Act](/compliance/eu-ai-act)                                                     | AI-agent disclosures that attach to activation bundles that provision a vertical-tuned agent |
| [Compliance health](/compliance/compliance-health)                                     | The posture score used to pre-check a pack before you hand it to an auditor                  |
| [Troubleshooting pending surfaces](/compliance/troubleshooting-pending-gated-surfaces) | Clearing stuck draft resources left by a bundle activation before generation                 |

## Download flow

1. `POST /api/v1/compliance/binder/generate` queues the assembly and returns `202` with a job id.
2. Poll `GET /api/v1/compliance/binder/:jobId` until the job reports **Completed**.
3. The completed job carries a `download_url` (24-hour signed link), a `download_sha256` checksum, and `download_size_bytes`.

Forward the signed URL to the auditor or buyer. If the audit-integrity check flagged anything while the pack was built, the completed job carries a tamper alert — treat that as a signal to investigate before forwarding. For the legal surface the auditor note heads to, see [Legal](/legal/index).

## Example — SOC 2 pack end to end

1. Queue the generation:

```bash theme={null}
curl -X POST https://api.orbit.devotel.io/api/v1/compliance/binder/generate \
  -H "X-API-Key: dv_live_sk_..." \
  -H "Content-Type: application/json" \
  -d '{"orgId": "org_...", "framework": "soc2", "format": "zip"}'
```

The response is `202`:

```json theme={null}
{
  "data": { "jobId": "binder_...", "status": "pending", "dedup": false }
}
```

2. Poll until the job completes:

```bash theme={null}
curl https://api.orbit.devotel.io/api/v1/compliance/binder/binder_... \
  -H "X-API-Key: dv_live_sk_..."
```

3. Hand the completed job's `download_url` to your auditor, with `download_sha256` so they can verify the file. If it lapses until expiry, regenerate on demand — the second click reattaches to the same running job rather than queueing a duplicate.

## Related

* [Compliance evidence binder](/compliance/evidence-binder) — the binder mechanics this page unifies
* [Legal](/legal/index) — the public trust and legal surfaces the auditor note heads to