SOC 2 Type II Pathway
Audit logging, access controls, encryption at rest and in transit, change management.
Compliance
The evidence your compliance program runs on.
Renly does not certify your compliance. It produces the action-level evidence a compliance program draws on: who did what, on whose authority, with which model, in a correlated audit trail. Approval gates, and on Enterprise fail-closed controls, keep AI inside your policy. The record format is an open standard, the Action Provenance Record, so an auditor can verify it without Renly in the room.
Framework Alignment
Controls that map to the frameworks you follow
Renly's architecture aligns with common compliance frameworks. Here's how our controls map to the areas auditors ask about.
GDPR Considerations
Tenant-isolated data, no cross-org access, user data controls.
HIPAA Considerations
Approval-gated writes, credential encryption, audit trails, role-scoped access. Talk to us about BAA needs on Enterprise.
Evidence Chain
Every AI action produces a traceable evidence chain
From request to outcome, every step is logged with correlation IDs. Auditors can reconstruct the full decision path for any AI action.
Request
User action captured with tenant, role, and timestamp
→
Policy Evaluation
OPA rules, structural checks, and semantic analysis applied
→
Approval Gate
Write actions require explicit human confirmation
→
Execution
Action performed within defined tool scope boundaries
→
Audit Log
Outcome recorded with correlation ID linking all steps
Policy Templates
Pre-built policy templates for common compliance needs
Enterprise teams start with six built-in policy templates that can be customized to match organizational requirements.
PII Data Protection
Detect and control personally identifiable information in AI inputs and outputs.
Content Safety
Filter harmful, inappropriate, or off-policy content from AI responses.
GDPR Compliance
Enforce data handling rules aligned with GDPR requirements for EU data subjects.
Model Access Control
Restrict which AI models can be used based on organizational policy and data classification.
Token Budget
Set per-organization and per-user token limits to control AI usage costs.
Prompt Injection Defense
Detect and block prompt injection attempts in user inputs and AI-generated plans.
Compliance Controls
What's available now and what Enterprise adds
| Control | All Plans | Enterprise |
|---|---|---|
| Audit logging | Included | Included |
| Encryption (at rest + in transit) | Included | Included |
| SSO (Entra ID) | Included | Included |
| Approval gates | Included | Included |
| Custom policies | Not included | Enterprise |
| Fail-closed enforcement | Not included | Enterprise |
| Semantic evaluation (LLM) | Not included | Enterprise |
| Human-in-the-loop escalation | Not included | Enterprise |
Ready for your compliance review
Renly provides the controls, audit trails, and policy enforcement that compliance teams need. Let us walk your team through the evidence.