Compliance

​

Overview

​

GDPR Compliance

​

Data Subject Rights

​

Right to Access (Article 15)

• Export chat history via Dashboard
• Download session recordings
• Access audit logs for their activity

​

Right to Erasure (Article 17)

• Chat sessions and messages
• AI-generated instructions and plans
• Screenshots and recordings
• User records
• Associated audit logs

1. Submit deletion request via Dashboard or API
2. Moss validates the request
3. All user data is permanently deleted
4. Verification confirms deletion completeness

{
  "status": "completed",
  "deleted_items": {
    "sessions": 12,
    "messages": 147,
    "screenshots": 89,
    "recordings": 12
  },
  "remaining_records": 0,
  "verified_at": "2024-01-15T10:30:00Z"
}

​

Right to Portability (Article 20)

• Chat history (JSON)
• Session metadata (JSON)
• Audit logs (CSV)

​

Lawful Basis

​

Data Processing Agreement

​

SOC 2 Type II

​

Trust Service Criteria

​

Controls

• Access Control - Role-based access, MFA, session management
• Change Management - Code review, deployment approval, rollback capability
• Incident Response - Detection, escalation, resolution procedures
• Monitoring - Real-time alerting, audit logging, anomaly detection

​

Timeline

​

ISO 27001

​

Information Security Management

• Risk Assessment - Regular security risk evaluations
• Asset Management - Inventory and classification of information assets
• Access Control - Need-to-know and least privilege principles
• Cryptography - Encryption standards for data protection
• Operations Security - Secure development and deployment practices

​

Timeline

​

EU AI Act

​

Transparency Requirements

• Clear AI Identification - Users know they’re interacting with AI
• Capability Disclosure - Documentation of AI capabilities and limitations
• Decision Explanation - AI responses include reasoning when applicable

​

Human Oversight

• User Control - Users can dismiss or override AI suggestions
• Admin Control - Application owners can customize AI behavior
• Audit Trail - All AI interactions are logged for review

​

Risk Classification

• Transparency obligations
• User notification
• Human oversight capabilities

​

Domain Whitelisting

​

Purpose

• Prevent unauthorized use of your application ID
• Control which environments can access Moss
• Reduce risk of API key exposure

​

Configuration

app.example.com
staging.example.com
localhost:3000

​

Enforcement

​

Compliance Resources

​

Documentation

• Privacy Policy - Available on viamoss.ai
• Terms of Service - Available on viamoss.ai
• Security Whitepaper - Contact sales

​

Agreements

• Data Processing Agreement (DPA) - Available for enterprise customers

​

Next Steps