Policy Engine

The Policy Engine evaluates content delivered through supported configured proxy and API-gateway paths before that request is forwarded. Applications and transports outside those paths require separate controls and validation.

Data Categories

BitDrip detects these categories out of the box:

Category	Examples
PII	US Social Security numbers, phone numbers, dates of birth, passport numbers
PHI	Context-labeled medical record numbers
Financial	Payment card numbers (Luhn-validated), IBAN, US ABA routing numbers
Credentials	Documented provider API keys and tokens, PEM private-key headers, JWTs, credential-bearing database URLs
Network	IPv4 addresses
AI security	Deterministic direct-injection, encoded-injection, system-prompt extraction, and role-bypass signals
Proprietary	Administrator-defined keyword lists and bounded custom rules

Compliance Profiles

Each profile is a curated set of detection rules and actions aligned to a regulatory framework. Enable profiles in the Admin Dashboard → Policies → Compliance Profiles.

Profile	Blocks	Warns	Logs
GDPR	PII, special-category data	Contact info	All events
HIPAA	PHI	PII	All events
PCI DSS	Card numbers, CVV, PINs	Financial data	All events
SOC 2	Credentials, secrets	PII	All events
ISO 27001	Credentials	PII, proprietary	All events
CCPA	PII (California residents)	—	All events

BitDrip is designed to support compliance with these frameworks. Achieving certification requires additional organisational controls beyond what software alone can provide.

Policy Actions

When the Policy Engine detects content matching a rule, it returns one of three actions:

• block — content is prevented from being submitted; user sees the violation message
• warn — user sees a warning but may proceed; event is logged
• log — content is submitted silently; event is logged for audit

Built-in detectors have versioned Balanced, Strict, and Monitor-only defaults. The current dashboard exposes the effective block, warn, or log action for each rule. Automated staged promotion between Monitor, Warn, and Enforce is planned work and is not yet presented as an active workflow.

Custom Rules

Regex rules

1. Dashboard → Policies → Add Rule
2. Enter a name and a regex pattern
3. Set the action: block, warn, or log
4. Save — rules take effect immediately (no restart required)

{
  "name": "Internal project codes",
  "matchType": "regex",
  "pattern": "PROJ-[0-9]{4,6}",
  "category": "proprietary",
  "action": "warn"
}

Company Data Protection (keyword list)

Use the Company Data wizard to protect proprietary terms without writing a regex. The wizard walks you through three steps:

1. Dashboard → Policies → Company Data
2. Choose the data type: Project names / codenames, Customer names, Internal domain names, or Other
3. Enter your terms, one per line (up to 500 terms)
4. Set the action and save

The match is case-insensitive and substring-based — adding "Titan" will block any request that contains the word "titan" anywhere in the text.

{
  "name": "Project codenames",
  "matchType": "keyword_list",
  "keywords": ["ProjectAlpha", "Titan", "NexusCore"],
  "category": "proprietary",
  "action": "block"
}

Rule Library

Dashboard → Policies → Rule Library shows the versioned built-in detectors available to the deployment, including SSN, payment card, phone, provider credentials, IBAN, routing number, IP address, date of birth, passport, medical-record-number, and deterministic AI-security signals. Already-enabled rules are shown as such and cannot be duplicated. Built-in implementation patterns cannot be edited; create a Custom rule for organization-specific matching.

Audit Log

The Audit page in the Admin Dashboard has two tabs:

Policy Events

Validated audit configurations can record supported policy evaluations with:

• Timestamp (UTC)
• User identifier (hashed)
• Data category detected
• Action taken
• AI service targeted

Policy event logs are accessible in Admin Dashboard → Audit → Policy Events and exportable as CSV or JSON.

Vendor Actions

Supported privileged administrative operations can be recorded in a separate hash-chained log. Where deployed evidence confirms coverage, each chained entry links to the previous hash so modification is detectable when documented verification runs. Validate event coverage and verifier results before relying on this control.

Actions logged include:

• License issued, extended, suspended, or reactivated
• License tier changed
• Deployment revoked
• Admin note added to a customer record

The vendor actions log is accessible in Admin Dashboard → Audit → Vendor Actions. Its evidence can support an organization's evaluation of NIST AU-2 and AU-3 objectives; it does not establish compliance by itself.

Performance

Policy evaluation is designed for real-time use:

• Typical response time: < 100ms
• Redis caching for compiled rule sets
• Data-minimizing audit configurations can retain bounded violation metadata; confirm actual fields, logs, diagnostics, and retention for the deployed version