Compliance Disclosures and Guardrails
The API enforces a set of minimum disclosures before every publication. This guide explains what they are and how to fill them in.
This portal is a demonstration environment. The notes below describe the API's behavior and are not a substitute for legal advice.
Compliance Certification
Anyone registering an agent deployment must state the figures from its compliance certification. When publishing, the API checks these fields on the agent deployment:
| Field | Required | Example |
|---|---|---|
compliance_certification.cert_type | yes | SOC2, ISO27001, GDPR or HIPAA |
compliance_certification.data_classification_level | yes | confidential |
compliance_certification.guardrail_policy_attached | yes | pii-redaction-v3 |
compliance_certification.reviewer | for restricted classification | governance-board |
compliance_certification.valid_until | yes | 2027-04-30 |
An expired valid_until results in 422 with reason: "expired". For a sandbox-only or internal-pilot agent, set compliance_certification.exemption: "pilot_program" instead; the other fields are then not required.
Chargeback Disclosure
Under an internal cost-recovery principle, the chargeback rate must appear in the catalog entry, and can't exceed the owning department's approved budget cap.
{
"chargeback": {
"rate_percent": 3.5,
"cost_center": "CC-4821",
"note": "applied monthly, based on metered token usage"
}
}
If rate_percent exceeds the approved cap for the cost center, publication is rejected with code: "chargeback_rate_invalid".
Other Minimum Disclosures
The disclosures section of the response from GET /catalog-entries/{id} lists the full checked set:
- Agent type and owning team, stated as precisely as is customary
- Model/provider and hosting region
- Deployment tier and integration count
- Available-from / rollout date
- Name of the accountable governance owner
Access-Request Data and Retention Periods
Access-request data is personal data. For every request, the API therefore tracks a retention_until, set automatically at creation:
| Situation | Default period |
|---|---|
| Request with no further activity | 6 months from the last activity |
| Evaluation session took place | 12 months from the session |
| Budget disclosure provided | 12 months, then mandatory deletion |
| Rollout approved | Extended, per applicable record-keeping requirements |
After expiry, records are anonymized nightly: name, team and contact details are removed, statistical attributes are kept.
You act on a deletion request immediately with:
curl -X POST https://api.nexora.example/v1/requests/req_71ab/deletion \
-H "apikey: $NEXORA_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "reason": "data_subject_request", "source": "email dated 2026-08-18" }'
Only request a budget disclosure once an evaluation session is confirmed. Before that, collecting the data usually isn't necessary - and anything that's never collected doesn't need to be protected or deleted either.