> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blindfold.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance & Legal

> How Blindfold helps you meet GDPR, HIPAA, PCI DSS, EU AI Act, CCPA, LGPD, and SOC 2 requirements

## Why Compliance Matters for AI

When using AI services like OpenAI, Anthropic, or other LLM providers, you're sending user data to third-party systems. This creates significant **legal and compliance risks** under modern privacy regulations.

**Blindfold protects you** by ensuring sensitive data never reaches AI providers in plain text. PII is detected and anonymized *before* it leaves your infrastructure.

```
User message                    Blindfold                        AI Provider
"Email hans@example.de"  →  "Email <Email Address_1>"  →  AI only sees tokens
                                                              ↓
"I'll email hans@..."    ←   Detokenize with mapping   ←  "I'll email <Email Address_1>"
```

## Regulation Guides

<CardGroup cols={2}>
  <Card title="GDPR" icon="globe" href="/compliance/gdpr">
    EU data protection for AI applications. Use the **EU region** and `gdpr_eu` policy to keep European personal data compliant.
  </Card>

  <Card title="HIPAA" icon="heart-pulse" href="/compliance/hipaa">
    Protect PHI in healthcare AI. Use the **US region** and `hipaa_us` policy to meet HIPAA de-identification requirements.
  </Card>

  <Card title="PCI DSS" icon="credit-card" href="/compliance/pci-dss">
    Secure cardholder data in payment AI. Use the `pci_dss` policy to mask, encrypt, and redact card numbers.
  </Card>

  <Card title="EU AI Act" icon="scale-balanced" href="/compliance/eu-ai-act">
    Meet the world's first comprehensive AI regulation. Data minimization, transparency, and high-risk system requirements.
  </Card>

  <Card title="Data Residency" icon="earth-americas" href="/compliance/data-residency">
    Keep sensitive data in the right jurisdiction. Regional endpoints and tokenization for cross-border AI compliance.
  </Card>

  <Card title="CCPA / CPRA" icon="flag-usa" href="/compliance/ccpa">
    Protect California consumer data. Prevent "sale" or "sharing" of personal information with AI providers.
  </Card>

  <Card title="LGPD" icon="globe" href="/compliance/lgpd">
    Brazil's data protection law. Use the EU region and `gdpr_eu` policy for LGPD-compliant AI processing.
  </Card>

  <Card title="SOC 2" icon="certificate" href="/compliance/soc2">
    Demonstrate security practices to enterprise customers. Audit logs, encryption, and access controls.
  </Card>
</CardGroup>

## Quick Comparison

| Regulation         | Policy               | Region  | Key Focus                                                          |
| ------------------ | -------------------- | ------- | ------------------------------------------------------------------ |
| **GDPR**           | `gdpr_eu`            | EU      | Personal data of EU residents — names, emails, IBANs, addresses    |
| **HIPAA**          | `hipaa_us`           | US      | Protected Health Information — 18 identifiers including SSNs, MRNs |
| **PCI DSS**        | `pci_dss`            | Any     | Cardholder data — card numbers, CVVs, expiry dates                 |
| **EU AI Act**      | `gdpr_eu` + `strict` | EU      | Data minimization, transparency, high-risk AI systems              |
| **Data Residency** | Any                  | EU / US | Cross-border data transfers, Schrems II, GDPR Chapter V            |
| **CCPA / CPRA**    | `strict`             | US      | California consumer rights — opt-out of sale/sharing of PI         |
| **LGPD**           | `gdpr_eu`            | EU      | Brazilian personal data — names, CPFs, addresses                   |
| **SOC 2**          | Any                  | Any     | Trust Services Criteria — security, confidentiality, privacy       |

## Common Compliance Questions

<AccordionGroup>
  <Accordion title="Do I need a Data Processing Agreement (DPA) with Blindfold?" icon="file-contract">
    Yes, for GDPR compliance. Contact us at [hello@blindfold.dev](mailto:hello@blindfold.dev) to sign a DPA.

    Blindfold processes personal data to detect and protect PII, making us a data processor under GDPR.
  </Accordion>

  <Accordion title="Can I use Blindfold for HIPAA-covered entities?" icon="hospital">
    Yes. Blindfold offers:

    * Business Associate Agreement (BAA)
    * AES-256 encryption (HIPAA compliant)
    * Audit logging
    * Access controls

    Contact us for a BAA: [hello@blindfold.dev](mailto:hello@blindfold.dev)
  </Accordion>

  <Accordion title="Is Blindfold SOC 2 certified?" icon="certificate">
    SOC 2 certification is in progress. Contact us for current compliance status and security documentation.
  </Accordion>

  <Accordion title="Where is data processed and stored?" icon="globe">
    * **EU region**: PII processed on EU-based servers (`eu-api.blindfold.dev`)
    * **US region**: PII processed on US-based servers (`us-api.blindfold.dev`)
    * **Data retention**: We don't store your text data
    * **Audit logs**: Retained for 90 days
    * **Backups**: Encrypted at rest

    See [Regions](/essentials/regions) for details.
  </Accordion>

  <Accordion title="What happens if there's a data breach?" icon="shield-exclamation">
    Because Blindfold protects PII before it reaches AI providers:

    1. **If AI provider is breached**: Your users' real PII was never exposed (only tokens/hashes)
    2. **If Blindfold is breached**: We notify you within 72 hours per GDPR
    3. **Reduced risk**: Tokenized/hashed data is not useful to attackers
  </Accordion>

  <Accordion title="How do I prove compliance to auditors?" icon="clipboard-check">
    Blindfold provides:

    1. **Audit logs** — every PII detection and anonymization is logged
    2. **API documentation** — proof of data protection implementation
    3. **DPA/BAA** — legal agreements for GDPR/HIPAA
    4. **Dashboard reports** — export audit logs for compliance reviews

    Export audit logs from the [dashboard](https://app.blindfold.dev) for compliance reports.
  </Accordion>
</AccordionGroup>

## Getting Started with Compliance

<Steps>
  <Step title="Sign up for Blindfold">
    Create your account at [app.blindfold.dev](https://app.blindfold.dev)
  </Step>

  <Step title="Choose your region">
    Select EU or US region based on your data residency requirements. See [Regions](/essentials/regions).
  </Step>

  <Step title="Select a compliance policy">
    Use `gdpr_eu`, `hipaa_us`, or `pci_dss` depending on your regulation. See [Policies](/essentials/policies).
  </Step>

  <Step title="Integrate Blindfold">
    Follow the [Quick Start guide](/quickstart) to add Blindfold to your application.
  </Step>

  <Step title="Request compliance documents">
    Email [hello@blindfold.dev](mailto:hello@blindfold.dev) for DPA, BAA, or security documentation.
  </Step>
</Steps>

## Need Help?

<CardGroup cols={2}>
  <Card title="Legal Questions" icon="scale-balanced" href="mailto:legal@blindfold.dev">
    Contact our legal team for DPAs, BAAs, and compliance questions
  </Card>

  <Card title="Technical Support" icon="headset" href="mailto:hello@blindfold.dev">
    Get help with integration and implementation
  </Card>

  <Card title="Documentation" icon="book" href="/quickstart">
    Read our technical documentation
  </Card>

  <Card title="Cookbook Examples" icon="code" href="https://github.com/blindfold-dev/blindfold-cookbook">
    Working code examples for GDPR and HIPAA
  </Card>
</CardGroup>

***

**Disclaimer**: This documentation provides general information about compliance requirements. It is not legal advice. Consult with legal counsel to ensure your specific implementation meets all applicable regulations.