# Compliance and evidence · Neural Inverse Govern > Framework rule packs, checks against your organisation's records, hashed evidence records, decision records and project policies, each stating what it proves and what it does not. Source: https://neuralinverse.com/govern/compliance/ --- ![](/photos/facility.jpg) [Neural Inverse Govern / Compliance and evidence](https://neuralinverse.com/govern/) # Evidence toward your controls, without claiming more than it shows. Framework rule packs, checks against your organisation's records, hashed evidence records, decision records and project policies, each stating what it proves and what it does not. Frameworks SOC 2, ISO 42001, EU AI Act, GDPR, HIPAA and more Checks Against your organisation's own records Evidence Per control, content hashed Overrides Bound to break-glass, record only Standing Evidence toward, never certification Overview Govern keeps a catalogue of framework rule packs, runs their checks against what your organisation has actually recorded, and stores evidence and decision records for your assessor. Every check says what it counted, every evidence record carries a hash of its content, and every change is written to the audit log with the change. A pass means a check found what it looks for, not that a control is met. [What it does ↓](https://neuralinverse.com/#capabilities)[How it works ↓](https://neuralinverse.com/#workflow)[Enforced and recorded ↓](https://neuralinverse.com/#enforcement)[Where it runs ↓](https://neuralinverse.com/#where)[Get started ↓](https://neuralinverse.com/#get-started) What it does ## What compliance and evidence covers. Only what works today, and what each record does and does not prove. - **Framework rule packs:** A shared catalogue of rule packs with rules by control, for SOC 2, ISO/IEC 42001, the EU AI Act, GDPR, HIPAA, PCI DSS, FedRAMP and the NIST AI RMF. Packs and rules are published by your platform operators. - **Subscriptions:** An organisation subscribes to the packs it needs. Subscribing again refreshes the pack version and keeps the original subscription, with the time of the last check. - **Checks against your records:** A check runs every rule of a pack and stores one finding per rule: pass, fail or warn, with a sentence saying why. Policy, data and configuration checks each look at a stated record, such as MFA events or an active signing key. - **Honest results:** Checks count records; they do not assess a control. A control with nothing to count reports warn until someone records evidence for it, so a clean report cannot appear by default. - **Evidence records:** Documents and other evidence per framework and control, with the time they were collected. Each record carries a SHA-256 hash of its content that shows a later change to the stored content. It is a hash, not a signature. - **Audit package:** The findings and evidence of one framework for a period, as one JSON document with a hash over its contents. The hash shows the package is internally consistent, not who produced it. - **Signed evidence from the audit log:** Where you need signed evidence, an audit log export carries a manifest signed with Ed25519 that verifies offline against the keys your installation publishes. - **GDPR Article 22 decision records:** Records of automated decisions about people, with the decision type, the legal basis and whether a person reviewed it. Records cannot be changed once written. - **Break-glass overrides:** A time-boxed record that a compliance rule was overridden in an emergency, with a reason. It needs the person's own active break-glass activation and ends with it. It changes no enforcement. - **Encryption evidence:** On request, the AI Gateway's encryption posture (key state, rotation, FIPS mode, receipts) is stored as evidence records mapped to controls of HIPAA, PCI DSS, SOC 2 and ISO/IEC 27001. - **Detector findings:** Findings of the AI Gateway's governance detectors, such as sensitive data and prompt injection, feed compliance evidence alongside the audit log. - **Project policies:** Model allowlist, data residency and budget policies per project. In enforce mode the AI Gateway refuses a request that breaks one; in shadow mode it records the violation and lets the request through. - **Project governance map:** Every control that applies to a project and its state there: enforced, shadow, off or not scoped, so a reviewer sees the project's position in one place. - **Domain governance:** AI actions are evaluated per domain and tool. High-risk actions wait in a queue for an approver who is not the requester, and a domain can block actions outright. Evidence records and the audit package are reached through the API; they have no console page yet. Rule packs, subscriptions, decision records and overrides have console pages. How it works ## From a rule pack to a package for your assessor. 1. Subscribe Choose the framework rule packs that apply to your organisation. 2. Check Run a pack's checks; each rule records pass, fail or warn with its reason. 3. Record evidence A named person with permission to manage compliance records evidence for the controls a check cannot count. 4. Override In an emergency, record a break-glass override tied to your own activation. 5. Package Bundle a framework's findings and evidence for a period, or export the signed audit log. 6. Assess Your assessor decides what the evidence supports. Certification stays with you. Who uses it ## Built for every role that answers for AI. - **Compliance teams:** Subscribe to rule packs, run checks, record evidence and decision records, and prepare packages for assessors. - **Security teams:** Set project policies, run them in shadow mode before enforcing, and approve high-risk AI actions in their domain. - **Assessors and auditors:** Read findings, evidence, decision records and overrides, and verify signed audit exports offline. - **Platform operators:** Publish the rule packs and rules every organisation on the installation shares. Enforced and recorded ## Recorded with the change, or not changed at all. Compliance records are only useful if their own history is complete, so each one is written with its audit entry. Enforced - **Audit with every change:** Creating a pack, a rule, a subscription, a decision record or an override, and revoking an override, write the audit entry in the same transaction. If it cannot be written, the change is rolled back. - **Overrides need break-glass:** An override is refused unless it names the caller's own active break-glass activation, and it ends when that activation ends. - **Project policies:** In enforce mode, the AI Gateway refuses a request for a model outside the project's allowlist or residency, or beyond its budget. - **No self-approval:** A high-risk AI action held by domain governance cannot be approved by the person who asked for it. Recorded - **Findings:** Every check's findings by rule, with status and reason, readable by framework. - **Evidence:** Every evidence record with its content hash and collection time. - **Decisions and overrides:** Every GDPR decision record, and who created or revoked every override. The audit entry is the only record of who did so. - **Shadow violations:** Every request a shadow-mode project policy would have refused. Govern produces evidence toward the controls of these frameworks. It does not certify your organisation, and Neural Inverse holds no certification on your behalf. Where it runs ## Your evidence, in your installation. [Deployment options](https://neuralinverse.com/deployment/) - **Self-hosted and in your cloud:** Findings, evidence and decision records live in your own database, under the same tenant isolation as everything else. - **Air-gapped:** Checks read your installation's own records; nothing is sent to an outside service to run them. - **Verify offline:** Signed audit exports verify without network access, against keys your installation publishes. - **Hosted by us:** We run it for you, with the same controls and audit record. Get started ## Set it up with the documentation. - [Compliance rule packs](https://neuralinverse.com/docs/evidence/compliance/) - [Evidence](https://neuralinverse.com/docs/evidence/) - [Exports and the audit package](https://neuralinverse.com/docs/evidence/exports/) - [Verify offline](https://neuralinverse.com/docs/evidence/verify-offline/) - [Guardrails and detectors](https://neuralinverse.com/docs/govern/guardrails/) What's next ## Being built now. These are in development and not part of the product today. - **Automatic evidence collection:** Evidence gathered from the organisation's live state on a schedule, instead of recorded by hand. - **Evidence packs from live state:** Packs for SOC 2, ISO/IEC 27001 and the EU AI Act built from collectors over the organisation's own data. - **Framework reports:** Reports and control status for the EU AI Act and the NIST AI RMF generated from live data. - **Policy changes through Git:** Two-person review of policy changes kept in sync with a repository you name. - **Console pages for evidence:** Evidence records and the audit package in the console, beside rule packs and overrides. Related [Audit and evidence → A hash-chained audit log you can verify offline, and evidence toward your frameworks.](https://neuralinverse.com/govern/audit/)[Data protection and privacy → One DLP engine acting by classification, data subject requests, privacy settings and region-bound data.](https://neuralinverse.com/govern/dlp-privacy/)[Identity and access → Single sign-on, provisioning, least-privilege roles, just-in-time access and reviews.](https://neuralinverse.com/govern/identity/) ![](/photos/team.jpg) ## Talk to our team. Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation. [Request access](https://neuralinverse.com/contact/?topic=access)[Contact us](https://neuralinverse.com/contact/)