---
title: "Compliance Disclosures and Guardrails"
description: "What a catalog entry must contain, and how long access-request data may be retained."
url: "https://nexora.apim.eu/guides/compliance-guardrails"
image: "https://nexora.apim.eu/_og/d/c_Ocean.takumi,title_Compliance+Disclosures+and+Guardrails,description_~V2hhdCBhIGNhdGFsb2cgZW50cnkgbXVzdCBjb250YWluLCBhbmQgaG93IGxvbmcgYWNjZXNzLXJlcXVlc3QgZGF0YSBtYXkgYmUgcmV0YWluZWQu,props_eyJ0aGVtZSI6eyJtb2RlIjoiZGFyayIsImNvbG9ycyI6eyJwcmltYXJ5IjoiIzM5RkYxNCJ9fX0,p_Ii9ndWlkZXMvY29tcGxpYW5jZS1ndWFyZHJhaWxzIg,s_bc3O_L7s3xkLRCId.png"
---

## Compliance Disclosures and Guardrails

The API enforces a set of minimum disclosures before every publication. This guide explains what they are and how to fill them in.

This portal is a demonstration environment. The notes below describe the API's behavior and are not a substitute for legal advice.

## [Compliance Certification](#compliance-certification)

Anyone registering an agent deployment must state the figures from its compliance certification. When publishing, the API checks these fields on the agent deployment:

| Field                                              | Required                      | Example                       |
| :------------------------------------------------- | :---------------------------- | :---------------------------- |
| compliance_certification.cert_type                 | yes                           | SOC2, ISO27001, GDPR or HIPAA |
| compliance_certification.data_classification_level | yes                           | confidential                  |
| compliance_certification.guardrail_policy_attached | yes                           | pii-redaction-v3              |
| compliance_certification.reviewer                  | for restricted classification | governance-board              |
| compliance_certification.valid_until               | yes                           | 2027-04-30                    |

An expired `valid_until` results in `422` with `reason: "expired"`. For a sandbox-only or internal-pilot agent, set `compliance_certification.exemption: "pilot_program"` instead; the other fields are then not required.

## [Chargeback Disclosure](#chargeback-disclosure)

Under an internal cost-recovery principle, the chargeback rate must appear in the catalog entry, and can't exceed the owning department's approved budget cap.

```json
{
  "chargeback": {
    "rate_percent": 3.5,
    "cost_center": "CC-4821",
    "note": "applied monthly, based on metered token usage"
  }
}
```

If `rate_percent` exceeds the approved cap for the cost center, publication is rejected with `code: "chargeback_rate_invalid"`.

## [Other Minimum Disclosures](#other-minimum-disclosures)

The `disclosures` section of the response from `GET /catalog-entries/{id}` lists the full checked set:

-   Agent type and owning team, stated as precisely as is customary
-   Model/provider and hosting region
-   Deployment tier and integration count
-   Available-from / rollout date
-   Name of the accountable governance owner

## [Access-Request Data and Retention Periods](#access-request-data-and-retention-periods)

Access-request data is personal data. For every request, the API therefore tracks a `retention_until`, set automatically at creation:

| Situation                        | Default period                                       |
| :------------------------------- | :--------------------------------------------------- |
| Request with no further activity | 6 months from the last activity                      |
| Evaluation session took place    | 12 months from the session                           |
| Budget disclosure provided       | 12 months, then mandatory deletion                   |
| Rollout approved                 | Extended, per applicable record-keeping requirements |

After expiry, records are anonymized nightly: name, team and contact details are removed, statistical attributes are kept.

You act on a deletion request immediately with:

```bash
curl -X POST https://api.nexora.example/v1/requests/req_71ab/deletion \
  -H "apikey: $NEXORA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "reason": "data_subject_request", "source": "email dated 2026-08-18" }'
```

Only request a budget disclosure once an evaluation session is confirmed. Before that, collecting the data usually isn't necessary - and anything that's never collected doesn't need to be protected or deleted either.