Skip to content

rotalabs-comply

Comprehensive AI compliance and audit logging infrastructure for regulatory adherence.

What is rotalabs-comply?

rotalabs-comply provides a complete toolkit for ensuring AI systems meet regulatory compliance requirements. It offers:

  • Audit Logging -- Comprehensive logging of AI interactions with encryption, multiple storage backends (file, S3, memory), and configurable retention policies
  • Compliance Frameworks -- Built-in support for EU AI Act, SOC2 Type II, and HIPAA with extensible framework architecture
  • Privacy-First Design -- Hash-only mode for privacy-preserving audit trails, or encrypted content storage when full records are needed
  • Report Generation -- Automated compliance reports with executive summaries, risk assessments, and remediation recommendations

Package Overview

rotalabs_comply/
├── core/              # Core types, configuration, and exceptions
│   ├── types          # RiskLevel, Framework, AuditEntry, ComplianceProfile
│   ├── config         # AuditConfig, StorageConfig
│   └── exceptions     # ComplianceError hierarchy
├── audit/             # Audit logging infrastructure
│   ├── logger         # AuditLogger main interface
│   ├── encryption     # EncryptionManager, Fernet encryption
│   └── storage        # FileStorage, MemoryStorage, S3Storage
├── frameworks/        # Compliance framework implementations
│   ├── base           # BaseFramework, ComplianceRule, ComplianceFramework
│   ├── eu_ai_act      # EU AI Act (2024) compliance checks
│   ├── soc2           # SOC2 Type II Trust Service Criteria
│   └── hipaa          # HIPAA Security and Privacy Rules
├── reports/           # Report generation
│   ├── generator      # ReportGenerator, ComplianceReport
│   └── templates      # ReportTemplate, ReportSection, section generators
└── utils/             # Utility functions
    └── helpers        # Period formatting, statistics, JSON serialization

Supported Compliance Frameworks

Framework Description Categories
EU AI Act European Union AI regulation (2024) Transparency, oversight, risk management, documentation, security
SOC2 Type II AICPA Trust Service Criteria Security, availability, processing integrity, confidentiality, privacy
HIPAA Health data protection (US) Access control, audit, integrity, authentication, transmission, privacy

Key Features

Privacy Modes

Choose the right privacy level for your compliance requirements:

  • Hash-Only Mode (default): Store SHA-256 hashes of inputs/outputs for verification without exposing content
  • Encrypted Mode: Store encrypted content when you need full audit trails with data protection
  • Plaintext Mode: Store content as-is for internal development environments

Storage Backends

Flexible storage options for different deployment scenarios:

  • FileStorage: Local JSONL files with automatic rotation
  • S3Storage: AWS S3 for cloud-native deployments with lifecycle management
  • MemoryStorage: In-memory storage for testing and development

Report Formats

Generate compliance reports in multiple formats:

  • Markdown: Human-readable documentation
  • JSON: Machine-readable for integration
  • HTML: Standalone reports for stakeholders

Use Cases

Enterprise AI Governance

Track all AI interactions across your organization with centralized audit logging, ensuring consistent compliance with internal policies and external regulations.

Healthcare AI Applications

Meet HIPAA requirements for AI systems processing Protected Health Information (PHI) with encryption, access controls, and comprehensive audit trails.

EU AI Act Compliance

Prepare for EU AI Act requirements with built-in checks for transparency, human oversight, risk management, and technical documentation.

SOC2 Audits

Demonstrate operational effectiveness of security controls for AI systems with audit logs and compliance reports suitable for SOC2 Type II audits.