Policy templates and compliance scope
Reviewed safeguard bundles, required setup, and the evidence they can support.
Nyraxis provides six policy starting points. Apply a bundle from Security Policies → Templates, review its scope, and test its enabled checks. Reapplying a bundle reuses its existing rules for that scope and preserves your edits. Configuration-dependent tool, topic, competitor and grounded-output rules start disabled.
| Bundle | Supporting checks | Separate requirements |
|---|---|---|
| GDPR safeguards | Personal-data, credential and prompt checks | Lawful basis, rights handling, DPIA, transfers, retention and processing agreements |
| HIPAA safeguards | Health-data detector option, prompt/credential checks, configurable tool access | BAA, risk analysis, access review, safeguards and verified PHI coverage |
| SOC 2 security safeguards | Runtime security checks and policy/activity evidence | Independent assurance, control design and operating-effectiveness evidence |
| EU AI Act safeguards | Runtime risk, bias signals, grounded output, prompt/credential checks | Classification, applicable obligations, data governance, documentation, oversight and assessment |
| AI Safety | Content and prompt checks | Representative safety benchmarks and source context |
| Enterprise Chatbot | Content, data and configurable domain checks | Topic/competitor configuration, source context and integration verification |
Templates do not establish compliance, certification, clinical safety or a complete legal control system. A detector error is an incomplete check. A passed probe describes only its tested scope. Model availability and measured accuracy are separate questions.
What the templates actually establish
The bundle names describe the review they can support. They are not complete, article-by-article implementations of the named laws or assurance frameworks. For example, toxicity and bias checks in the GDPR bundle are optional application safeguards; GDPR does not prescribe those detectors or their thresholds.
The current PII implementation does not use a generic entities list as an
entity filter. Templates use supported settings; verify languages, identifier
types, false positives and missed cases with representative permitted data.
Grounded-output template rules require approved policy sources and an output
before they can complete. Configure and test them before enabling them. The new
template default sets require_sources: true; it does not automatically treat a
user's question as factual evidence. Known source/output truncation is reported
as incomplete. See grounded-output scope.
Template revision 2026-10-19.1 changes newly created rules. Existing policies are not silently rewritten. Review existing source-dependent rules separately; reapplying a bundle preserves their settings and enabled state.
Reports and organizational obligations
The PDF/CSV export is a shared operational evidence report. It is not a complete GDPR assessment, a SOC 2 auditor's report, a HIPAA approval or an EU AI Act conformity assessment. Selected or bounded audit records are not complete statutory logging. Your review must also cover contracts, access, processing destinations, retention, rights handling, incident procedures and any applicable organizational obligations.
Having these templates does not establish that Nyraxis itself is GDPR compliant. Review the actual service agreement, provider schedule and deployment evidence through the trust center.
Reviewed sources
- GDPR Articles 5, 25 and 32: data principles, protection by design, and processing security.
- HHS HIPAA Security Rule: administrative, physical and technical safeguards.
- AICPA Trust Services Criteria: assessment framework for relevant controls.
- EU AI Act consolidated text: review Articles 9–15 alongside system classification and your applicable role. Metadata-only records are not a complete statutory logging solution.
Sources and implementation scope reviewed on 19 October 2026. The mappings are engineering interpretations for supporting controls. Applicability requires a separate assessment.
Read the evidence guide and integration support before using real workload data.