Enterprise Compliance Modules
Relevant source files
The following files were used as context for generating this wiki page:
The Enterprise Compliance Modules system in Comply-Quick provides specialized, industry-specific legal shields and operational checklists for high-regulation environments. These modules extend the core compliance package by adding protective clauses and validation steps for specific standards such as HIPAA, PCI-DSS, SOC 2, and ADA/WCAG. Sources: src/components/EnterpriseModules.tsx:1-8, src/components/ClauseEngine.tsx:280-283
Integrated into the Enterprise Tier, these modules allow developers and agencies to shift liability and establish technical guardrails when handling sensitive healthcare data, payment card information, or ensuring accessibility for users with disabilities. Sources: src/app/dashboard/DashboardWizard.tsx:490-502, src/components/EnterpriseModules.tsx:10-40
Architecture and Data Flow
The Enterprise Modules operate as a plugin-style extension to the core ClauseEngine. When a user selects specific modules during the Dashboard Wizard process or via API request, the engine invokes generateModuleOutputs to fetch specialized content. Sources: src/components/ClauseEngine.tsx:279-284, src/components/EnterpriseModules.tsx:238-241
Module Integration Flow
The following diagram illustrates how Enterprise Modules are processed within the compliance package generation pipeline.
The ClauseEngine validates module keys against a strictly defined set of allowed strings before merging the output into the final CompliancePackage. Sources: src/components/ClauseEngine.tsx:343-348, src/app/api/v1/compliance/route.ts:55-61
Supported Modules
Comply-Quick supports four primary enterprise modules, each targeting a specific regulatory domain. Sources: src/components/EnterpriseModules.tsx:12
| Module ID | Label | Purpose | Key Focus Areas |
|---|---|---|---|
hipaa | HIPAA | Healthcare Data | PHI encryption, BAA requirements, breach protocols. |
pci_dss | PCI-DSS | Payment Security | Tokenization, CDE scope, vulnerability management. |
ada_wcag | ADA / WCAG | Accessibility | Screen reader compatibility, keyboard navigation, VPAT. |
soc2 | SOC 2 | Trust Controls | Access controls, uptime, change management. |
Sources: src/components/EnterpriseModules.tsx:243-268, src/components/EnterpriseModules.tsx:42-230
HIPAA Compliance Shield
Focuses on the Health Insurance Portability and Accountability Act requirements. It generates clauses regarding Business Associate Agreements (BAA) and technical standards for Protected Health Information (PHI). Sources: src/components/EnterpriseModules.tsx:43-69
PCI-DSS Payment Security Shield
Addresses Payment Card Industry Data Security Standard (v4.0). It emphasizes limiting the Cardholder Data Environment (CDE) and implementing payment tokenization (e.g., via Stripe Elements) to ensure raw card data never touches merchant servers. Sources: src/components/EnterpriseModules.tsx:82-113
Data Structures
The system uses specific TypeScript interfaces to ensure strict type compliance across the generation and testing phases. Sources: src/components/EnterpriseModules.tsx:14-25
export type ComplianceModule = "hipaa" | "pci_dss" | "ada_wcag" | "soc2";
export interface ComplianceModuleOutput {
moduleName: string;
summary: string;
clauses: ModuleClause[];
checklistItems: string[];
}
Sources: src/components/EnterpriseModules.tsx:14-25
Logical Evaluation
The calculateComplianceScore function integrates these modules into the regulatoryBreadth and privacyCoverage scores. Each added module provides a bonus to the overall package score, reflecting the increased depth of legal and technical coverage. Sources: src/components/ClauseEngine.tsx:313-315, src/components/ClauseEngine.tsx:321-323
Implementation Details
Modules are retrieved through a record-based lookup and validated to prevent injection of unsupported module types. Sources: src/components/EnterpriseModules.tsx:232-241
export function generateModuleOutputs(modules: ComplianceModule[]): ComplianceModuleOutput[] {
validateModules(modules);
return modules.map((mod) => MODULE_OUTPUTS[mod]);
}
Sources: src/components/EnterpriseModules.tsx:238-241
Integration in API
The API endpoints (/api/v1/compliance and /api/compliance) explicitly check for these modules in the request body. If present, the metadata for the response is upgraded to tier: "enterprise". Sources: src/app/api/v1/compliance/route.ts:55-61, src/app/api/compliance/route.ts:145-149
Conclusion
The Enterprise Compliance Modules provide a specialized layer of protection for complex technical environments. By automating the generation of high-stakes documentation like BAAs and PCI-DSS checklists, the system enables developers to maintain a consistent compliance posture while shifting the ultimate legal burden of ongoing maintenance to the merchant. Sources: src/components/EnterpriseModules.tsx:43-60, src/components/ClauseEngine.tsx:280-283, src/app/dashboard/DashboardWizard.tsx:490-498