> For the complete documentation index, see [llms.txt](https://codemash.gitbook.io/codemash/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://codemash.gitbook.io/codemash/cloud/account/compliance.md).

# Compliance

Set the regulations, data retention windows, consent purposes and legal holds of a project, and read its audit log.

**Where:** avatar menu → **Compliance** · `/account/compliance`

**Compliance** is the data-controller toolkit of one project. Pick the project in the **Project** box on the top right, then use the five tabs: **Regulatory regimes**, **Retention windows**, **Consent purposes**, **Legal holds** and **Audit log**. Every change saves at once.

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-7a8afe2d12676f8e025329f5b05613c6649f2d79%2Fcompliance-1.png?alt=media" alt="Compliance screen for Acme Store, Regulatory regimes tab with GDPR, HIPAA, PCI and CCPA and an Assign button each"><figcaption><p>Regulatory regimes of Acme Store.</p></figcaption></figure>

## Before you start

* The project exists ([Create a project](/codemash/cloud/project/create.md)).
* You need an account role that may manage the project's settings (for example **Account Administrator**).

## Steps

1. Pick the project in **Project** — for example `Acme Store`.
2. **Regulatory regimes** — press **Assign** next to each regulation that applies: **GDPR** (EU General Data Protection Regulation), **HIPAA** (US health data), **PCI** (payment cards; no card data is stored) or **CCPA** (California). You can assign several; the strictest rule wins for each kind of data. An assigned regime shows the **Assigned** badge and a **Remove** button.

   <figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-f86b124d86f00a5d9af868af8536c1bb807763e2%2Fcompliance-2.png?alt=media" alt="GDPR with the Assigned badge and a Remove button"><figcaption><p>GDPR assigned.</p></figcaption></figure>
3. **Retention windows** — under **Add or update retention window** pick the **Data kind**, the **Days** to keep it and what happens **On expiration**, then press **Save window**:

   | Field         | Required | What it does                                                                                | Example     |
   | ------------- | -------- | ------------------------------------------------------------------------------------------- | ----------- |
   | Data kind     | yes      | `User`, `Contact`, `Order`, `OrderLine`, `FileResource` or `AuditEntry`.                    | `User`      |
   | Days          | yes      | How long the data is kept. It is checked against the legal minimum of the assigned regimes. | `730`       |
   | On expiration | yes      | `Anonymize`, `Delete` or `Archive`.                                                         | `Anonymize` |

   <figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-67be0e8ddadaeed074cbacaf4d0a6dcd91badf9b%2Fcompliance-4.png?alt=media" alt="Retention windows table with User, 730, Anonymize and the add form"><figcaption><p>A retention window for users.</p></figcaption></figure>
4. **Consent purposes** — under **Define consent purpose** fill in the form and press **Define purpose**:

   | Field                         | Required | What it does                              | Example                     |
   | ----------------------------- | -------- | ----------------------------------------- | --------------------------- |
   | Key (dotted-lowercase)        | yes      | The id your app uses.                     | `marketing.newsletter`      |
   | Name                          | yes      | The name end users see.                   | `Newsletter`                |
   | Channel                       | yes      | `Marketing`, `Transactional` or `System`. | `Marketing`                 |
   | Mapped tags (comma separated) | yes      | The message tags this purpose covers.     | `newsletter, weekly-digest` |
   | Description (optional)        | no       | A longer text.                            | —                           |
   | Legal basis                   | yes      | The regimes the purpose relies on.        | `GDPR`                      |

   <figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-bf05cb369f06a58f08e4d9e9c8cf19c8fadb0da7%2Fcompliance-5.png?alt=media" alt="Define consent purpose form filled with marketing.newsletter"><figcaption><p>A new consent purpose.</p></figcaption></figure>
5. **Legal holds** — to freeze one person's data, pick the **Subject kind** (`Contact`, `User`, `Order` or `FileResource`), paste the **Subject id** (for example `ct_…`), write a **Reason** and press **Place hold**. While the hold is active, every notification to that subject is blocked and deleting it is refused.

   <figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-e7a76b2decc3ee91babdb073c085b01cde89b87f%2Fcompliance-7.png?alt=media" alt="Legal holds tab: No active legal holds and the Place legal hold form"><figcaption><p>Legal holds.</p></figcaption></figure>

## Result

Each tab shows the new state right away: the **Assigned** badge, a row in the retention table, a row in the consent table with the status **Active**. The **Audit log** tab lists every blocked notification, legal hold and erasure decision of the last 30 days (latest 100) — the evidence a regulator asks for.

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-494fd00ca60e97dc79e1fbb0eb9fc2d25c61fd1c%2Fcompliance-6.png?alt=media" alt="Consent purposes table with marketing.newsletter, Newsletter, Marketing, tags, GDPR, Active and Deprecate"><figcaption><p>The new purpose is Active.</p></figcaption></figure>

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-f4db7d4968a6433eacdedab05845e3572143b49b%2Fcompliance-8.png?alt=media" alt="Audit log tab: No audit entries in the last 30 days"><figcaption><p>Audit log of a new project.</p></figcaption></figure>

## Change or remove it later

* **Regime** — **Remove** next to it.
* **Retention window** — save the same data kind again to change it, or press **Remove** in its row.
* **Consent purpose** — press **Deprecate**. A purpose with consent records can only be deprecated, never deleted.
* **Legal hold** — release it in its row on **Legal holds**.

## Do it from code

```ts
await norbix.hub.compliance.saveRetentionWindow({ dataKind: 'User', days: 730, action: 'Anonymize' });
const { settings } = await norbix.hub.compliance.getComplianceSettings();
console.log(settings.regimes, settings.retentionWindows); // ["GDPR"] [{ dataKind: "User", days: 730, action: "Anonymize" }, …]
```

```sh
norbix hub compliance retention window save --dataKind Contact --days 365 --action Delete
```

The client setup is on the [Account page](/codemash/cloud/account.md#use-it-from-code). API: the compliance endpoints have no generated reference page yet; see the [Account API](/codemash/api-reference/account.md) and the SDK's `norbix.hub.compliance` methods.