Compliance Center

Your privacy, security, and data governance guardian

Overview

Compliance Center is the comprehensive security, privacy, and data governance app in General Bots Suite. Monitor data handling, manage consent, respond to data subject requests, prevent data loss, manage legal holds, classify sensitive information, and ensure your bots comply with regulations like LGPD, GDPR, HIPAA, and CCPA.

Key Capabilities:

• DLP (Data Loss Prevention) - Detect and prevent sensitive data leaks
• eDiscovery - Legal holds, content search, and case management
• Information Protection - Classify and protect sensitive documents
• Compliance Scanning - Automated regulatory compliance checks
• Data Subject Requests - Handle GDPR/LGPD rights requests

Features

Compliance Dashboard

The dashboard gives you an at-a-glance view of your compliance status:

Score Breakdown by Area:

• Data Protection
• Consent Management
• Access Controls
• Data Retention
• Breach Response
• Documentation

Score Meanings:

Data Loss Prevention (DLP)

Automatically detect and prevent sensitive data from being shared inappropriately.

Sensitive Data Types Detected

DLP Policies

Create policies to control how sensitive data is handled:

Policy Actions:

Example Policy:

Name: Block Credit Cards in External Emails
Data Types: Credit Card
Scope: Outbound emails
Action: Block
Severity Threshold: High

DLP Scanning Integration

DLP scans are integrated with:

• Mail - Inbound and outbound email scanning
• Drive - File upload scanning
• Chat - Message content scanning
• Social - Post content scanning

eDiscovery

Manage legal holds, search content, and export data for legal proceedings.

Case Management

Create and manage legal cases:

1. Create Case - Name, description, matter ID
2. Add Custodians - Users whose data to preserve
3. Apply Legal Hold - Prevent data deletion
4. Search Content - Find relevant documents
5. Review & Tag - Mark documents as relevant
6. Export - Generate production packages

Legal Hold

Legal holds prevent data deletion for specified users:

What’s Preserved:

• Emails and attachments
• Chat messages
• Drive files
• Calendar events
• Social posts
• Conversation logs

Content Search

Search across all data sources:

Search Operators:

Export Formats

Information Protection

Classify and protect documents based on sensitivity levels.

Sensitivity Labels

Auto-Labeling Rules

Automatically classify documents based on content:

Protection Actions

Based on label, apply protections:

Label Inheritance

• Files inherit labels from parent folders
• Attachments inherit labels from emails
• Exports maintain original labels

Security Scanner

Automatically scan your bots and data for compliance issues.

Running a Scan

1. Click Scan Now in the top right
2. Select scan type:
   • Quick - Basic checks (5 minutes)
   • Full - Complete audit (30 minutes)
   • Custom - Select specific areas
3. Choose scan targets:
   • All bots
   • Knowledge bases
   • User data
   • Conversation logs
   • External integrations
4. Click Start Scan

Scan Results

Results are categorized by severity:

Common Issues Found:

• Unencrypted PII in logs
• Consent records needing renewal
• Missing retention policies
• Missing privacy policy links

Data Subject Requests (DSR)

Handle user requests for their data rights.

Request Types

Processing a Request

1. Verify user identity
2. Review data found:
   • User Profile
   • Conversation History
   • Consent Records
   • Activity Logs
3. Generate data package (for access requests)
4. Send to user or complete deletion
5. Mark request as complete

Consent Management

Track and manage user consent.

Consent Types:

Consent Record Information:

• User ID and email
• Consent status (given/denied/withdrawn)
• Timestamp
• Collection method (web, chat, email)
• IP address and browser info

Data Mapping

See where personal data is stored:

Policy Management

Manage your compliance policies:

Policy Types:

• Privacy Policy
• Data Retention Policy
• Cookie Policy

Data Retention Rules:

Keyboard Shortcuts

Tips & Tricks

Staying Compliant

💡 Schedule regular scans - Weekly scans catch issues early

💡 Set up alerts - Get notified of critical issues immediately

💡 Document everything - Keep records of all compliance decisions

💡 Train your team - Everyone should understand data handling rules

Handling Requests

💡 Respond quickly - Start processing within 24 hours

💡 Verify identity - Confirm requestor is the data subject

💡 Be thorough - Check all data sources before responding

💡 Keep records - Document how each request was handled

Data Protection

💡 Minimize data collection - Only collect what you need

💡 Enable encryption - Protect data at rest and in transit

💡 Use anonymization - Remove PII when possible

💡 Regular audits - Review who has access to what data

Troubleshooting

Scan finds false positives

Possible causes:

1. Pattern matching too aggressive
2. Test data flagged as real PII
3. Encrypted data misidentified

Solution:

1. Review and dismiss false positives
2. Add test data locations to exclusion list
3. Configure scan sensitivity in settings
4. Report issues to improve detection

DSR deadline approaching

Possible causes:

1. Complex request requiring manual review
2. Data spread across multiple systems
3. Identity verification pending

Solution:

1. Prioritize the request immediately
2. Use automated data collection tools
3. Contact user if verification needed
4. Document reason if extension required

Consent not recording

Possible causes:

1. Consent widget not configured
2. JavaScript error on page
3. Database connection issue

Solution:

1. Check consent configuration in settings
2. Test consent flow in preview mode
3. Check error logs for issues
4. Verify database connectivity

Data not deleting automatically

Possible causes:

1. Retention policy not applied
2. Scheduled job not running
3. Data referenced by other records

Solution:

1. Verify policy is active and applied to bot
2. Check scheduled job status in settings
3. Review dependencies that prevent deletion
4. Manually delete if needed

BASIC Integration

Use Compliance features in your dialogs:

Check Consent

hasConsent = CHECK CONSENT user.id FOR "marketing"

IF hasConsent THEN
    TALK "I can send you our newsletter!"
ELSE
    TALK "Would you like to receive our newsletter?"
    HEAR response AS BOOLEAN
    IF response THEN
        RECORD CONSENT user.id FOR "marketing"
        TALK "Great! You're now subscribed."
    END IF
END IF

Request Data Access

TALK "I can help you access your personal data."
HEAR email AS EMAIL "Please confirm your email address"

IF email = user.email THEN
    request = CREATE DSR REQUEST
        TYPE "access"
        USER user.id
        EMAIL email
    
    TALK "Your request #" + request.id + " has been submitted."
    TALK "You'll receive your data within 15 days."
ELSE
    TALK "Email doesn't match. Please contact support."
END IF

Delete User Data

TALK "Are you sure you want to delete all your data?"
TALK "This action cannot be undone."
HEAR confirm AS BOOLEAN

IF confirm THEN
    request = CREATE DSR REQUEST
        TYPE "deletion"
        USER user.id
    
    TALK "Deletion request submitted: #" + request.id
    TALK "Your data will be deleted within 30 days."
ELSE
    TALK "No problem. Your data remains safe."
END IF

Log Compliance Event

' Log when sensitive data is accessed
LOG COMPLIANCE EVENT
    TYPE "data_access"
    USER user.id
    DATA_TYPE "order_history"
    REASON "User requested order status"
    BOT "support"

TALK "Here's your order history..."

API Endpoint: /api/compliance

The Compliance API allows programmatic access to compliance features.

Endpoints Summary

Authentication

All endpoints require API key authentication:

Authorization: Bearer your-api-key

Example: Check User Consent

GET /api/compliance/consent/usr_abc123

Response:
{
  "userId": "usr_abc123",
  "consents": [
    {
      "type": "terms_of_service",
      "status": "given",
      "timestamp": "2025-01-15T10:32:00Z"
    },
    {
      "type": "marketing",
      "status": "withdrawn",
      "timestamp": "2025-03-22T15:15:00Z"
    }
  ]
}

API Endpoints Summary

DLP Endpoints

eDiscovery Endpoints

Information Protection Endpoints

See Also

• Compliance API Reference - Full API documentation
• Analytics App - Monitor compliance metrics
• Dashboards App - Create compliance dashboards
• Sources App - Configure bot policies
• How To: Monitor Your Bot