GDPR — processor terms in DPA EU data residency — Hetzner Nuremberg HIPAA — PHI tokenised on-device · PCI SAQ-A out of scope

Compliance.
What we ship today.

CloakAPI is a privacy-preserving AI gateway. The architecture — client-side tokenisation, signed receipts, zero-payload server logging — is what does the regulatory work. This page describes only the controls and artefacts that exist right now, not certifications we haven't engaged. For audit roadmap and per-framework status, see the Trust Center.

Honest baseline

PCI DSS v4.0 is out of scope (SAQ-A) — Stripe processes cards, so no cardholder data touches CloakAPI. The GDPR Article 28 DPA is available now. On the client-side ways, plaintext PHI is tokenised on the customer's device before the prompt reaches us and the gateway is a blind token relay that forwards only those tokens (it does not inspect or tokenise content on our servers), so detected PHI is already pseudonymised before it reaches our infrastructure. Detection is best-effort — undetected text still crosses in the clear — and CloakAPI is a data-minimisation tool, not a HIPAA-compliance product.

01 — Framework mapping

How the architecture maps to each framework.

Every claim below is backed by an artefact you can read or a control you can exercise from a customer account today. Where a formal certification is the only way to satisfy a control, we say so explicitly rather than implying coverage.

EU
GDPR · UK-DPA 2018
  • Lawful basis & processor terms — Article 28 DPA template at /legal/dpa; counter-signed copy on request.
  • Data residency — gateway hosting in Hetzner Nuremberg, DE. Receipt signing, public JWKS, billing metadata and the staff-action audit log stay in-region.
  • Data minimisation — direct-identifier tokenisation runs client-side on the user's device (a Rust/WASM regex + structured-ID engine in the browser and extension, native Rust in the desktop app and the local proxy, plus on-device name matching — a name dictionary today, with an optional downloadable on-device model) before the prompt is sent upstream. The gateway is a blind token relay: it forwards only the tokens your device produced and never inspects, detects, or tokenises content on our servers. Zero-payload logging invariant is CI-verified.
  • Sub-processors & SCCs — full list with regions and contracts at /legal/subprocessors; 30-day advance notice on changes.
  • Data-subject rights — export & delete from the portal; receipts are detokenised only on the customer's device.
Evidence: DPA, sub-processor list, Trust Center, privacy model.
Health
HIPAA · UK-NHS DSPT
  • On-device PHI tokenisation — detected PHI is tokenised on the customer device before egress, so the gateway holds pseudonymised tokens rather than plaintext identifiers; detection is best-effort, so undetected text still crosses. CloakAPI is a data-minimisation tool, not a HIPAA-compliance product.
  • Audit log — every staff and customer action lands in an append-only, tenant-scoped log: insert-only at the database level, SHA-256 hash-chained row to row, and anchored daily with an ECDSA-P256 signature. Personal fields are sealed as AES-256-GCM ciphertext under a per-data-subject key, so a GDPR erasure destroys that key (crypto-shredding) instead of rewriting the record. CSV export from the portal.
UK-NHS DSPT submission is customer-led; CloakAPI provides the supporting evidence pack (architecture, sub-processors, residency).
Financial
PCI DSS v4.0 · FINRA 17a-4
  • Out of CDE by construction — PAN data is detected on the device (Luhn + per-brand checks) and tokenised before egress, and CloakAPI stores no payloads, so no cardholder data is retained on our infrastructure. PCI scope reduction is the primary control.
  • QSA engagement — not yet engaged; initiated on first PCI-scope enterprise customer.
  • FINRA 17a-4 / SEC Rule 17a-4(f) — append-only receipt chain provides immutable, time-stamped record of every gateway interaction; per-tenant transparency log feed at GET /v1/transparency/seeds.jsonl.
Evidence: receipt spec, transparency log, billing audit log. Customers needing WORM-grade retention should pair with their own SEC-compliant archive.
Security
Information security
  • Security controls implemented — access management, change management, incident response, supplier security, encryption in transit and at rest, and a zero-payload logging invariant enforced in CI.
  • CAIQ-lite (CCM v4) — Cloud Security Alliance self-assessment across 50 controls available now at /legal/caiq.
  • Coordinated disclosure — vulnerability-disclosure programme live at security.cloakapi.io.
  • Verifiable receipts — every response is cryptographically signed (ECDSA P-256) and verifiable offline against our public JWKS — evidence no point-in-time audit can give you.
02 — Controls you can exercise today

Verifiable, not promised.

For each common audit ask, here is the artefact or feature that satisfies it now — and the path you'd cite in a procurement questionnaire.

Audit askWhat CloakAPI shipsWhere
PII / PHI redaction Client-side tokenisation on the user's device (Rust/WASM regex + structured-ID engine plus on-device name matching — a name dictionary today, with an optional downloadable on-device model; native Rust in the desktop app and local proxy). The gateway is a blind token relay: it forwards only the client's tokens and never inspects or tokenises content on our servers. Configurable detector packs per tenant; deterministic re-detokenisation on the device. privacy model
Cryptographic non-repudiation Every gateway response carries a receipt signed under ECDSA P-256. Public JWKS published; offline verifier requires no CloakAPI account. spec · verifier
Key-rotation transparency Per-tenant append-only seed feed (JSONL, signed under the same P-256 keys). Lets any verifier confirm we never silently rotated a tenant's signing key or shadow-swapped routing policy. GET /v1/transparency/seeds.jsonl
Audit trail & export Append-only, tenant-scoped audit log of every staff and customer action against the gateway and portal — insert-only (update/delete triggers reject writes), SHA-256 hash-chained, daily ECDSA-P256 anchor. Personal fields are stored only as AES-256-GCM ciphertext under a per-data-subject key; erasure destroys the key (crypto-shredding) and is itself appended as new chain events, so tamper-evidence survives erasure. Operator break-glass reads are console-only, require a stated reason and named operator, and are recorded in the chain before any disclosure. CSV export from the admin console. app.cloakapi.io/admin/audit
Data residency Gateway, signing infrastructure, billing metadata and audit log run in Hetzner Nuremberg (DE). Cloudflare edge is EU-pinned. Upstream model providers carry their own DPAs and Article 28 clauses. Trust → Sub-processors
Sub-processor change notice 30-day advance email notice of any sub-processor addition or replacement; subscribe to the list at trust@cloakapi.io. /legal/subprocessors
Incident response & status Per-region, per-component health page. SEV-3+ incidents trigger a public postmortem within 5 business days. Coordinated vulnerability disclosure programme with safe-harbour terms and public hall of fame. status.cloakapi.io · security.cloakapi.io
Business continuity / DR Architecture, backup strategy, RTO 4h / RPO 6h, annual DR drill. Plan published openly. /legal/bcp
CSA self-assessment CAIQ-lite mapped to Cloud Controls Matrix v4 across 50 controls. Updated on each architectural change. /legal/caiq
03 — Open-source and verifiable components

The privacy-critical path is auditable code.

The components that decide whether your data ever leaves the device — detection, tokenisation, receipt signing — run on your own device where you can inspect them, or are openly specified. You don't have to take CloakAPI's word for what they do.

PII detection

Direct-identifier detection and tokenisation run entirely on the user's device — a Rust/WASM regex + structured-ID engine (native Rust in the desktop app and local proxy) plus on-device name matching — a name dictionary today, with an optional downloadable on-device model — before any network egress. The gateway is a blind token relay: it forwards only the tokens your device produced and never inspects, detects, or tokenises content on our servers. Configurable recognisers for direct identifiers, named entities, financial PAN, healthcare codes.

OpenReceipt

P-256 ECDSA-signed receipts with canonical hash chaining. Independent verifier hosted at signedreceipts.org. The spec and public JWKS are published; reference-implementation source distribution is in preparation at signedreceipts.org/source.

04 — What's next

Where to go from here.

Compliance is one slice of the trust story. The Trust Center has the full picture — attestations roadmap, sub-processors, transparency log, incident history. Procurement-style questionnaires (CAIQ, SIG-lite, custom RFP) go to trust@cloakapi.io.

Trust Center

Attestations roadmap, sub-processors, receipts, transparency log, incident response and the legal artefact index.

Procurement

CAIQ-lite, custom DPA edits, audit-letter requests, sub-processor questions.