# Compliance

URL: /systems/compliance · Id: `system:compliance`

> Compliance maps controls to frameworks, tests each from the records every Action leaves, and publishes the trust center buyers read.

Compliance maps controls to frameworks, tests each from the records every [Action](/business/nouns/action) leaves, and publishes the trust center buyers read. A [Startup](/business/nouns/startup) inherits its controls, so it sells as compliant from its first day.

## Summary
| Part | This System |
| --- | --- |
| Group | Trust and governance |
| Status | Beta: it works, and its Verbs may still change |
| Shelf | Wakes: offered once its Event fires |

You can ask:

- “Show me our SOC 2 status”
- “Answer this security questionnaire”
- “What risks are open?”
- “Publish a trust page”

## What you get
| Part | This System |
| --- | --- |
| Starts | On for every Startup at creation, with nothing to install. |
| Wakes | On [`Deal.advanced`](/business/events/Deal.advanced) when the buyer asks for a SOC 2 report or a security questionnaire. |
| Built from | [Audit log](/systems/trust-and-governance/audit-log), [Event streams](/code/platform/event-streams), [Functions](/code/platform/capabilities/functions), [Workflows](/code/platform/workflows) |

## Nouns it owns
| Noun | Definition |
| --- | --- |
| [Control](/business/nouns/control) | A Control is a rule the platform enforces on every write it covers, with a test that runs over the whole population. |
| [Criterion](/business/nouns/criterion) | A Criterion is one requirement of an outside framework, such as SOC 2 or GDPR, that one or more Controls satisfy. |
| [Proof](/business/nouns/proof) | A Proof is the sealed result of one Control test: the Events it read, the root it checked them against, and every exception. |
| [Audit](/business/nouns/audit) | An Audit is one engagement with an outside firm: the namespaces in scope, the Criteria, the report period, and the firm’s Attestation. |
| [Risk](/business/nouns/risk) | A Risk is something that could harm a Startup or a Portfolio, scored by likelihood and impact, and treated, accepted, or closed. |

## Verbs
| Verb | Object | Approval | Event |
| --- | --- | --- | --- |
| [Risk.assess](/business/nouns/risk/assess) | [Risk](/business/nouns/risk) | None | [`Risk.assessed`](/business/events/Risk.assessed) |
| [Risk.treat](/business/nouns/risk/treat) | [Risk](/business/nouns/risk) | None | [`Risk.treated`](/business/events/Risk.treated) |
| [Risk.accept](/business/nouns/risk/accept) | [Risk](/business/nouns/risk) | Asks first; waits 1 business hour | [`Risk.accepted`](/business/events/Risk.accepted) |
| [Risk.close](/business/nouns/risk/close) | [Risk](/business/nouns/risk) | Asks first; waits 1 business hour | [`Risk.closed`](/business/events/Risk.closed) |

## Events
| Direction | Event | How |
| --- | --- | --- |
| Emits | [`Risk.assessed`](/business/events/Risk.assessed) | By [Risk.assess](/business/nouns/risk/assess) |
| Emits | [`Risk.treated`](/business/events/Risk.treated) | By [Risk.treat](/business/nouns/risk/treat) |
| Emits | [`Risk.accepted`](/business/events/Risk.accepted) | By [Risk.accept](/business/nouns/risk/accept) |
| Emits | [`Risk.closed`](/business/events/Risk.closed) | By [Risk.close](/business/nouns/risk/close) |

## States
None.

## Who operates it
| Part | This System |
| --- | --- |
| Accountable | [Compliance Officer](/agents/legal/compliance-officer) |
| Team | [Legal Team](/agents/legal) |
| Seat | A role agent holds it until a Human is seated. |
| Autonomy | `assist` |
| Also calls its Verbs | [Founder](/agents/founding/founder), [Risk Analyst](/agents/operations/risk-analyst) |

## Approvals and limits
| Verb | Rule | Detail |
| --- | --- | --- |
| [Risk.accept](/business/nouns/risk/accept) | A person says yes first | Waits 1 business hour |
| [Risk.close](/business/nouns/risk/close) | A person says yes first | Waits 1 business hour |

## Processes that use it
| Process | How it uses it |
| --- | --- |
| [Procure](/workflows/processes/procure) | A step calls [Risk.assess](/business/nouns/risk/assess) |
| [Upstream review](/workflows/processes/upstream-review) | A step calls [Risk.assess](/business/nouns/risk/assess) |
| [Risk assessment](/workflows/processes/risk-assessment) | A step calls [Risk.assess](/business/nouns/risk/assess) |

## Rail underneath
None.

## Views and dashboards
| View | Shows | Metrics |
| --- | --- | --- |
| The [Compliance Officer](/agents/legal/compliance-officer)’s view | The Metrics its accountable Role answers for. | [Intakes answered on time](/agents/legal#intakes-on-time) |

## Access
What each Access level may call here.

| Access level | May call |
| --- | --- |
| `owner` | Every Verb (16) |
| `admin` | All but 2 of 16: `Risk.accept`, `Risk.close` |
| `member` | All but 2 of 16: `Risk.accept`, `Risk.close` |
| `viewer` | Read only (10 of 16) |

## Import and export
None.

## Fees and pricing
None.

## Availability and limits
| Part | This System |
| --- | --- |
| Status | Beta: it works, and its Verbs may still change |

## Compliance notes
Controls it carries:

- [Governance oversight](/systems/trust-and-governance/controls/governance-oversight)
- [Action accountability](/systems/trust-and-governance/controls/action-accountability)
- [Risk assessment](/systems/trust-and-governance/controls/risk-assessment)
- [Control wake review](/systems/trust-and-governance/controls/control-wake-review)
- [Control definition](/systems/trust-and-governance/controls/control-definition)
- [Inherited floors](/systems/trust-and-governance/controls/inherited-floors)
- [Policy approval](/systems/trust-and-governance/controls/policy-approval)
- [System description](/systems/trust-and-governance/controls/system-description)
- [Trust status](/systems/trust-and-governance/controls/trust-status)
- [Log completeness](/systems/trust-and-governance/controls/log-completeness)
- [Continuous control testing](/systems/trust-and-governance/controls/continuous-testing)
- [Control sameness](/systems/trust-and-governance/controls/control-sameness)
- [Adversarial control testing](/systems/trust-and-governance/controls/adversarial-testing)
- [Deviation closure](/systems/trust-and-governance/controls/deviation-closure)
- [Append-only records](/systems/trust-and-governance/controls/append-only-records)
- [Revert by query](/systems/trust-and-governance/controls/revert-by-query)
- [Action completion](/systems/trust-and-governance/controls/action-completion)
- [Disclosure record](/systems/trust-and-governance/controls/disclosure-record)

## Related Systems
- [Privacy](/systems/privacy)
- [Trust and safety](/systems/trust-safety)

## Example
A [b2b](/business/motions/b2b) [Headless SaaS](/products/templates/headless-saas) for HR data receives a 180-question security questionnaire from a buyer. The trust center answers 171 from tested controls. The [Compliance Officer](/agents/legal/compliance-officer) [Agent](/business/nouns/agent) answers the other nine and links each answer to its [Evidence](/business/nouns/evidence).