Compliance
OrchestrAi is positioned for regulated enterprises — Indian FSI (RBI FREE-AI, SEBI) and EU AI Act primary; SOX-defensible pipeline for public-market customers. Per CLAUDE.md "Buyer DNA (D-7)".
Frameworks Covered
| Framework | Region | Status | Detail page |
|---|---|---|---|
| RBI FREE-AI Directive | India (FSI — primary ICP) | Architecture aligned; gap analysis PROPOSED | Detail page queued (D.3) |
| EU AI Act | EU (Aug 2026 deadline — secondary) | Architecture aligned; high-risk-system classification IN-DESIGN | Detail page queued (D.3) |
| SOX (Sarbanes-Oxley) | US (public markets) | C-366 SOX-defensible pipeline CANDIDATE | Detail page queued (D.3) |
| SEBI | India (capital markets) | Architecture aligned; vertical pages PROPOSED | Detail page queued (D.3) |
How We Comply — Structural, Not Marketing
Every compliance claim on this site is backed by a constitutional artifact. We do not say "SOX-compliant" — we cite the SOX-defensible pipeline (C-366), the hash-chained audit (C-362), and the per-row terminal-proof citation that makes every revenue/expense decision re-traceable.
- Per-decision terminal-proof — every claim cites
cvo_claims.claim_idoraudit_id. - Hash-chained audit trail — C-362 provides cryptographic continuity over decision history.
- Constitutional Guard — C-361 enforces brand-voice + compliance-language at emission time, not post-hoc.
- Sovereign self-host — data residency under customer control for RBI FREE-AI mandates.
- L-418 — no credentials ever in committed files; CISO-defensible by construction.
Data Residency
| Deployment | Data plane | Control plane | Suitable for |
|---|---|---|---|
| Customer self-host | Customer infra | Customer infra | FSI / Public sector / RBI FREE-AI / SEBI |
| OrchestrAi cloud (regional) | Customer region | Customer region | EU AI Act high-risk / EEA buyers |
| OrchestrAi cloud (global) | Global | Global | Lower-regulation pilots |
Honest-tense (Law #19): Frameworks are architecturally aligned; formal third-party audits (SOC 2 Type II, ISO 27001) are POST-GO-LIVE per D-2 counsel-deferred. We do not claim certified-compliance today; we claim constitutionally-designed-for-compliance with auditable evidence.