Policy Engine

The Policy Engine is BitDrip's decision core. Every piece of content — from the proxy daemon or the API gateway — passes through it before reaching an AI service.

Data Categories

BitDrip detects these categories out of the box:

Category	Examples
PII	Full names, email addresses, phone numbers, postal addresses, national ID numbers
PHI	Medical record numbers, health conditions, insurance IDs, treatment details
Financial	Credit card numbers (Luhn-validated), IBAN, bank account numbers
Credentials	API keys, passwords, private keys, bearer tokens, connection strings
Proprietary	Source code patterns, internal document markers (configurable)

Compliance Profiles

Each profile is a curated set of detection rules and actions aligned to a regulatory framework. Enable profiles in the Admin Dashboard → Policies → Compliance Profiles.

Profile	Blocks	Warns	Logs
GDPR	PII, special-category data	Contact info	All events
HIPAA	PHI	PII	All events
PCI DSS	Card numbers, CVV, PINs	Financial data	All events
SOC 2	Credentials, secrets	PII	All events
ISO 27001	Credentials	PII, proprietary	All events
CCPA	PII (California residents)	—	All events

BitDrip is designed to support compliance with these frameworks. Achieving certification requires additional organisational controls beyond what software alone can provide.

Policy Actions

When the Policy Engine detects content matching a rule, it returns one of three actions:

• block — content is prevented from being submitted; user sees the violation message
• warn — user sees a warning but may proceed; event is logged
• log — content is submitted silently; event is logged for audit

Custom Rules

Regex rules

1. Dashboard → Policies → Add Rule
2. Enter a name and a regex pattern
3. Set the action: block, warn, or log
4. Save — rules take effect immediately (no restart required)

{
  "name": "Internal project codes",
  "matchType": "regex",
  "pattern": "PROJ-[0-9]{4,6}",
  "category": "proprietary",
  "action": "warn"
}

Company Data Protection (keyword list)

Use the Company Data wizard to protect proprietary terms without writing a regex. The wizard walks you through three steps:

1. Dashboard → Policies → Company Data
2. Choose the data type: Project names / codenames, Customer names, Internal domain names, or Other
3. Enter your terms, one per line (up to 500 terms)
4. Set the action and save

The match is case-insensitive and substring-based — adding "Titan" will block any request that contains the word "titan" anywhere in the text.

{
  "name": "Project codenames",
  "matchType": "keyword_list",
  "keywords": ["ProjectAlpha", "Titan", "NexusCore"],
  "category": "proprietary",
  "action": "block"
}

Rule Library

Dashboard → Policies → Rule Library shows a catalogue of built-in detectors you can enable with one click: SSN, email, credit card, phone, API keys, IBAN, internal IPs, date of birth, and medical record numbers. Already-enabled rules are shown as such and cannot be duplicated.

Audit Log

The Audit page in the Admin Dashboard has two tabs:

Policy Events

Every policy evaluation is immutably logged with:

• Timestamp (UTC)
• User identifier (hashed)
• Data category detected
• Action taken
• AI service targeted

Policy event logs are accessible in Admin Dashboard → Audit → Policy Events and exportable as CSV or JSON.

Vendor Actions

All privileged administrative operations are recorded in a separate append-only log with SHA-256 hash chaining for tamper evidence. Each entry links to the previous entry's hash, making undetected modification of the log infeasible.

Actions logged include:

• License issued, extended, suspended, or reactivated
• License tier changed
• Deployment revoked
• Admin note added to a customer record

The vendor actions log is accessible in Admin Dashboard → Audit → Vendor Actions. This log satisfies NIST AU-2 and AU-3 requirements for audit event content.

Performance

Policy evaluation is designed for real-time use:

• Typical response time: < 100ms
• Redis caching for compiled rule sets
• No content is stored — only metadata about violations