Compliance map
The regimes that put residency and retention duties on you.
Every row is sourced from our regulatory research and mapped to our offer. Where a regime requires retention, we sell configurable retention. Where it demands residency, we sell a named region. Where it demands proof, we sell evidence.
European Union
EU duties land on the buyer and the supplier chain.
| Regime | Status | What it requires | Why it creates a buyer for us |
|---|---|---|---|
| EU AI Act | High-risk Annex III duties apply 2 Aug 2026; GPAI obligations live since 2 Aug 2025 | Risk-based compliance for deployers; transparency obligations and prohibited-practice screening | EU deployers need a supplier whose service carries transparency, screening and upstream GPAI documentation flow-down as contract |
| Cyber Resilience Act | Reporting duties 11 Sep 2026; full compliance 11 Dec 2027 | Essential cybersecurity requirements for products with digital elements | Buyers integrating inference into products need a supplier with a security posture and attestation evidence |
| DORA | Live since 17 Jan 2025; enforcement active | ICT risk management, fourth-party and sub-processor visibility, register of information | Financial buyers must map sub-processors and concentration — our bounded provider set and region pinning are the compliance artifact |
| NIS2 | Transposition due 17 Oct 2024; member states finalizing into 2025–26 | Supply-chain and incident-reporting duties for essential and important entities | Buyers must show supplier management — the DPA and sub-processor transparency answer the vendor leg |
| Data Act | Applies since 12 Sep 2025 | Data access and sharing duties for connected-product makers, including non-EU makers selling into the EU | Connected-product vendors need residency and retention determinism in their inference processing |
United States
Fragmented duties, one shared need: vendor evidence.
| Regime | Status | What it requires | Why it creates a buyer for us |
|---|---|---|---|
| GLBA | In force; FTC and parallel agencies enforce | Written security program, designated qualified individual, risk assessment, encryption in transit and at rest, MFA, incident response plan | Precisely our DPA schedule posture plus attestation — the designated-official buyer needs vendor evidence |
| SEC cyber-disclosure | In force; SEC cyber-disclosure rules live (Release 33-11216) | 8-K incident reporting within four business days; risk and governance disclosures | Public-company buyers need documented incident notification and control evidence |
| CMMC | Effective 10 Nov 2025, phased to ~2028 | Defense supply-chain contractors must hold CMMC certification | Defense-adjacent buyers need vendor security attestation; our posture is the vendor leg. Defense buyers may prefer US-sovereign stacks — qualifying, not primary |
| 17a-4 | In force; SEC broker-dealer record-keeping | Mandatory retention of records for prescribed periods | Blanket ZDR conflicts with the law — the honest pitch is configurable retention with region pinning |
GDPR-like privacy law, globally
The GDPR baseline has global analogues with their own teeth.
| Regime | Status | What it requires | Why it creates a buyer for us |
|---|---|---|---|
| LGPD | Sanctions since Aug 2021 | Processing in Brazil, targeting Brazilian individuals, or data collected in Brazil | Up to 2% of Brazilian revenue, capped at R$50M per violation — compliance evidence is a precondition |
| PIPL | Effective 1 Nov 2021 | Extraterritorial where targeting China; closed list of lawful bases, no legitimate-interest catch-all | RMB 50M or 5% of prior-year turnover for grave violations — residency-sensitive buyers pre-commit |
| DPDP | Enabling sections in force 3 Jan 2025; substantive duties pending rules | Digital data in India or services offered to Indian principals; negative-list export regime | Fixed Schedule penalties up to ₹250 crore — Indian fintechs under RBI residency pressure pre-buy |
| PDPA | Fully effective 1 Jun 2022 | GDPR-style extraterritorial reach: offering goods or services or monitoring behavior | Administrative fines to THB 5 million, criminal exposure for serious breaches — the closest structural mirror of the GDPR |
| CPRA | California Privacy Rights Act (CPRA) applies to for-profit businesses processing California residents' personal information | Maintain a configurable-retention capability for record-keeping sectors | California operators need a vendor whose processing terms map to CPRA audit and deletion obligations |
| nFADP | In force since 1 Sep 2023 | GDPR-aligned but principles-based: no 72-hour breach clock, representative duty only on foreign controllers, criminal enforcement | The Swiss baseline is our own — a gap analysis of the deltas covers the local regime |
Crypto markets
Mid-term demand from regulated halves of the market.
| Regime | Status | What it requires | Why it creates a buyer for us |
|---|---|---|---|
| MiCA | In force 30 Dec 2024; transition to 1 Jul 2026 | ICT and data requirements on EU CASPs; DPA fits the compliant posture | Regulated CASPs need ZDR plus a contract — the crypto half of the market buys compliance, not features |
| NYDFS | In force; 23 NYCRR Part 200 | Third-party provider policy: encryption in transit and at rest, event notice, data return or destruction on termination | Our DPA and security schedules answer the NYDFS third-party rules for licensed crypto firms |
Other markets
The S13 shortlist, one line each.
UK UK GDPR and DPA 2018 still in force; mature GDPR-style buyers with live ICO enforcement.
India DPDP Act 2023 plus RBI payment-data residency; fintech pre-buying residency.
Singapore MAS and PDPC double layer; buys residency evidence and sub-processor visibility.
Hong Kong HKMA outsourcing discipline drives third-party evidence demand.
South Africa POPIA operator agreements and breach duties; DPA is a procurement precondition.
Brazil LGPD mid-market with active ANPD fining; region is a differentiator, not a blocker.
Japan APPI 2022 with extraterritorial reach; compliance-first buyers.
South Korea PIPA 2023 with surcharges; active PIPC enforcement.
Turkey KVKK with sectoral residency pressure in banking and insurance.
Australia Privacy Amendment Act 2024: statutory tort, higher penalties, ADM transparency.
Chile Law 21.719 effective Dec 2026 — pre-buy window open now.
Malaysia 2024 amendment with direct processor liability.
Nigeria Cybersecurity Act 2024 localization — watch for crystallization.
Egypt PDPL 151/2020 regulations still pending.
Region catalog
Promised regions and candidates.
| Regime | Status |
|---|---|
| European Union | Promised region |
| United States | Promised region |
| Switzerland | Promised region |
| w5a_region_qa | Promised region |
| India | Custom candidate |
| Türkiye | Custom candidate |
| Nigeria | Custom candidate |
| Russia | Skip-listed |
| China | Skip-listed |
| Iran | Skip-listed |
| North Korea | Skip-listed |
| Syria | Skip-listed |
| Cuba | Skip-listed |
| Venezuela | Skip-listed |
| Belarus | Skip-listed |
| Kazakhstan | Skip-listed |
Refused jurisdictions
Some jurisdictions are never served.
Hard localization and sanctions regimes mean these jurisdictions are excluded at every layer of the platform and can never be selected:
- Russia
- China
- Iran
- North Korea
- Syria
- Cuba
- Venezuela
- Belarus
- Kazakhstan
Status figures are statutory ceilings and schedules as of the underlying research; re-verified before any sales quotation.