Compliance - Security Scanner

Your privacy and security guardian

Overview

Compliance is the security and privacy management app in General Bots Suite. Monitor data handling, manage consent, respond to data subject requests, and ensure your bots comply with regulations like LGPD, GDPR, and CCPA. Compliance helps you protect user data and maintain trust.

Features

Compliance Dashboard

The dashboard gives you an at-a-glance view of your compliance status:

Score Breakdown by Area:

• Data Protection
• Consent Management
• Access Controls
• Data Retention
• Breach Response
• Documentation

Score Meanings:

Security Scanner

Automatically scan your bots and data for compliance issues.

Running a Scan

1. Click Scan Now in the top right
2. Select scan type:
   • Quick - Basic checks (5 minutes)
   • Full - Complete audit (30 minutes)
   • Custom - Select specific areas
3. Choose scan targets:
   • All bots
   • Knowledge bases
   • User data
   • Conversation logs
   • External integrations
4. Click Start Scan

Scan Results

Results are categorized by severity:

Common Issues Found:

• Unencrypted PII in logs
• Consent records needing renewal
• Missing retention policies
• Missing privacy policy links

Data Subject Requests (DSR)

Handle user requests for their data rights.

Request Types

Processing a Request

1. Verify user identity
2. Review data found:
   • User Profile
   • Conversation History
   • Consent Records
   • Activity Logs
3. Generate data package (for access requests)
4. Send to user or complete deletion
5. Mark request as complete

Consent Management

Track and manage user consent.

Consent Types:

Consent Record Information:

• User ID and email
• Consent status (given/denied/withdrawn)
• Timestamp
• Collection method (web, chat, email)
• IP address and browser info

Data Mapping

See where personal data is stored:

Policy Management

Manage your compliance policies:

Policy Types:

• Privacy Policy
• Data Retention Policy
• Cookie Policy

Data Retention Rules:

Keyboard Shortcuts

Tips & Tricks

Staying Compliant

💡 Schedule regular scans - Weekly scans catch issues early

💡 Set up alerts - Get notified of critical issues immediately

💡 Document everything - Keep records of all compliance decisions

💡 Train your team - Everyone should understand data handling rules

Handling Requests

💡 Respond quickly - Start processing within 24 hours

💡 Verify identity - Confirm requestor is the data subject

💡 Be thorough - Check all data sources before responding

💡 Keep records - Document how each request was handled

Data Protection

💡 Minimize data collection - Only collect what you need

💡 Enable encryption - Protect data at rest and in transit

💡 Use anonymization - Remove PII when possible

💡 Regular audits - Review who has access to what data

Troubleshooting

Scan finds false positives

Possible causes:

1. Pattern matching too aggressive
2. Test data flagged as real PII
3. Encrypted data misidentified

Solution:

1. Review and dismiss false positives
2. Add test data locations to exclusion list
3. Configure scan sensitivity in settings
4. Report issues to improve detection

DSR deadline approaching

Possible causes:

1. Complex request requiring manual review
2. Data spread across multiple systems
3. Identity verification pending

Solution:

1. Prioritize the request immediately
2. Use automated data collection tools
3. Contact user if verification needed
4. Document reason if extension required

Consent not recording

Possible causes:

1. Consent widget not configured
2. JavaScript error on page
3. Database connection issue

Solution:

1. Check consent configuration in settings
2. Test consent flow in preview mode
3. Check error logs for issues
4. Verify database connectivity

Data not deleting automatically

Possible causes:

1. Retention policy not applied
2. Scheduled job not running
3. Data referenced by other records

Solution:

1. Verify policy is active and applied to bot
2. Check scheduled job status in settings
3. Review dependencies that prevent deletion
4. Manually delete if needed

BASIC Integration

Use Compliance features in your dialogs:

Check Consent

hasConsent = CHECK CONSENT user.id FOR "marketing"

IF hasConsent THEN
    TALK "I can send you our newsletter!"
ELSE
    TALK "Would you like to receive our newsletter?"
    HEAR response AS BOOLEAN
    IF response THEN
        RECORD CONSENT user.id FOR "marketing"
        TALK "Great! You're now subscribed."
    END IF
END IF

Request Data Access

TALK "I can help you access your personal data."
HEAR email AS EMAIL "Please confirm your email address"

IF email = user.email THEN
    request = CREATE DSR REQUEST
        TYPE "access"
        USER user.id
        EMAIL email
    
    TALK "Your request #" + request.id + " has been submitted."
    TALK "You'll receive your data within 15 days."
ELSE
    TALK "Email doesn't match. Please contact support."
END IF

Delete User Data

TALK "Are you sure you want to delete all your data?"
TALK "This action cannot be undone."
HEAR confirm AS BOOLEAN

IF confirm THEN
    request = CREATE DSR REQUEST
        TYPE "deletion"
        USER user.id
    
    TALK "Deletion request submitted: #" + request.id
    TALK "Your data will be deleted within 30 days."
ELSE
    TALK "No problem. Your data remains safe."
END IF

Log Compliance Event

' Log when sensitive data is accessed
LOG COMPLIANCE EVENT
    TYPE "data_access"
    USER user.id
    DATA_TYPE "order_history"
    REASON "User requested order status"
    BOT "support"

TALK "Here's your order history..."

API Endpoint: /api/compliance

The Compliance API allows programmatic access to compliance features.

Endpoints Summary

Authentication

All endpoints require API key authentication:

Authorization: Bearer your-api-key

Example: Check User Consent

GET /api/compliance/consent/usr_abc123

Response:
{
  "userId": "usr_abc123",
  "consents": [
    {
      "type": "terms_of_service",
      "status": "given",
      "timestamp": "2025-01-15T10:32:00Z"
    },
    {
      "type": "marketing",
      "status": "withdrawn",
      "timestamp": "2025-03-22T15:15:00Z"
    }
  ]
}

See Also

• Compliance API Reference - Full API documentation
• Analytics App - Monitor compliance metrics
• Sources App - Configure bot policies
• How To: Monitor Your Bot