DLP and audit export

FluxyChat ships built-in data loss prevention (DLP) for chat content plus admin audit log export for compliance workflows. Use the dashboard SOC 2 page or the Worker REST APIs below.

Happy path (15 minutes)

1. Sign in to the dashboard and paste an admin JWT from Projects.
2. Open SOC 2 → Refresh to load control counts.
3. Run a DLP scan on sample text containing a test SSN or card number.
4. Export audit log (last 24h JSON) for your auditor pack.
5. Export SOC 2 evidence JSON from the same page.
6. Generate ops evidence pack to record what the governed agents actually did (runs, approvals, incidents).

SDK — local PHI/PCI detection

Use createDlpDetector() in middleware or before sending agent prompts:

import { createDlpDetector } from "@fluxy-chat/sdk";

const dlp = createDlpDetector();
const result = dlp.scanText("msg-1", "Patient SSN 123-45-6789 paid with 4111 1111 1111 1111");

console.log(result.safe);       // false when critical matches
console.log(result.matches);    // phi + pci entities
console.log(result.redacted);   // redacted text when action is redact

Default patterns include US SSN (PHI), credit card (PCI), email, and phone.

Worker — scan before persist

Admin JWT required.

curl -X POST "$WORKER_URL/enterprise/dlp/scan" \
  -H "Authorization: Bearer $ADMIN_JWT" \
  -H "Content-Type: application/json" \
  -d '{"text":"Card 4111111111111111","roomId":"room_demo","messageId":42}'

Response:

{
  "matches": [{ "type": "credit_card", "severity": "high" }],
  "matchCount": 1,
  "redactedText": "Card [REDACTED]"
}

Custom DLP rules

# List rules
curl "$WORKER_URL/enterprise/dlp/rules" -H "Authorization: Bearer $ADMIN_JWT"

# Create regex rule
curl -X POST "$WORKER_URL/enterprise/dlp/rules" \
  -H "Authorization: Bearer $ADMIN_JWT" \
  -H "Content-Type: application/json" \
  -d '{"name":"Internal ID","pattern":"EMP-\\d{6}","action":"redact","severity":"medium"}'

Audit log export

Query events or download a time-window stream:

# Filtered events (JSON)
curl "$WORKER_URL/admin/audit-export/events?limit=100&severity=high" \
  -H "Authorization: Bearer $ADMIN_JWT"

# Stream export (last 24h default)
curl "$WORKER_URL/admin/audit-export/stream?format=json" \
  -H "Authorization: Bearer $ADMIN_JWT" \
  -o audit-export.json

# Stats for dashboard widgets
curl "$WORKER_URL/admin/audit-export/stats" \
  -H "Authorization: Bearer $ADMIN_JWT"

Scheduled exports: POST /admin/audit-export/schedules with frequency, format, and optional webhook destination.

SOC 2 evidence pack

Dashboard SOC 2 page calls:

• GET /api/soc2/dashboard — control, risk, and incident counts
• GET /api/soc2/evidence — downloadable evidence bundle
• POST /api/soc2/reports/evidence — build an operations evidence pack (markdown) from live data: incidents and MTTR, governed agent runs, approvals, and the tool and policy controls in force. The document is stored as an soc2_reports row (reportType: audit) and returned in the response; the SOC 2 page exposes it as Generate ops evidence pack.

curl -X POST "$WORKER_URL/api/soc2/reports/evidence" \
  -H "Authorization: Bearer $ADMIN_JWT" \
  -H "Content-Type: application/json" \
  -d '{"days": 90}'

Counts are read from live tables at generation time (no estimates), so the pack can be handed to an auditor or pasted into a security questionnaire.

Saved reports are listed on the same page (Saved reports): view the markdown inline, download it as a file, and promote a draft report to final with PATCH /api/soc2/reports/:id (status: draft | final | archived). Every report write is scoped to the project that created it.

Combine with audit export and DLP scan history (GET /admin/dlp-integrations/scans) for a complete auditor handoff.

HIPAA PHI logging

For regulated workloads, log PHI access and detections:

• POST /api/hipaa/phi/access — access audit trail
• POST /api/hipaa/phi/detections — detection events
• GET /api/hipaa/phi/detections — review queue

See SAML signature verification for signature verification when SSO is enabled alongside compliance exports.

For BAA tracking and the readiness checklist, use dashboard Settings → HIPAA and the SOC 2 / HIPAA runbook.