> ## Documentation Index
> Fetch the complete documentation index at: https://docs.modulex.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance

> ModuleX's compliance posture in plain language: the privacy laws it works under (GDPR, CCPA/CPRA), how your data is handled and retained, its stance on regulated-industry use, and how to request the certification status for your review.

export const MediaEmbed = ({id, type = 'screenshot', caption = '', ext, ratio = '16 / 9'}) => {
  const isVideo = type === 'video' || type === 'app_video';
  const resolvedExt = ext || (isVideo ? 'mp4' : type === 'screenshot' ? 'webp' : 'svg');
  const src = 'https://media.modulex.dev/' + id + '.' + resolvedExt;
  const [status, setStatus] = useState('loading');
  const [isDev, setIsDev] = useState(false);
  const [inView, setInView] = useState(false);
  const boxRef = useRef(null);
  useEffect(() => {
    if (typeof window === 'undefined') return;
    const h = window.location.hostname;
    setIsDev(h === 'localhost' || h === '127.0.0.1' || h.endsWith('.mintlify.app'));
  }, []);
  useEffect(() => {
    if (inView) return;
    if (typeof IntersectionObserver === 'undefined') {
      setInView(true);
      return;
    }
    const el = boxRef.current;
    if (!el) return;
    const io = new IntersectionObserver(entries => {
      if (entries.some(e => e.isIntersecting)) {
        setInView(true);
        io.disconnect();
      }
    }, {
      rootMargin: '300px'
    });
    io.observe(el);
    return () => io.disconnect();
  }, [inView]);
  if (status === 'missing') {
    if (!isDev) return null;
    return <div style={{
      display: 'flex',
      flexDirection: 'column',
      justifyContent: 'center',
      gap: '0.4rem',
      padding: '1rem 1.25rem',
      margin: '1.25rem 0',
      width: '100%',
      aspectRatio: ratio,
      boxSizing: 'border-box',
      border: '1px dashed rgba(128,128,128,0.45)',
      borderRadius: '0.75rem',
      background: 'rgba(128,128,128,0.06)',
      color: 'currentColor',
      fontSize: '0.85rem',
      lineHeight: 1.45
    }}>
        <div style={{
      display: 'flex',
      alignItems: 'center',
      gap: '0.5rem',
      opacity: 0.75
    }}>
          <span aria-hidden="true">🎬</span>
          <code style={{
      fontSize: '0.75rem'
    }}>{id}</code>
          <span style={{
      fontSize: '0.65rem',
      textTransform: 'uppercase',
      letterSpacing: '0.04em',
      padding: '0.1rem 0.4rem',
      borderRadius: '0.4rem',
      background: 'rgba(128,128,128,0.18)'
    }}>
            {type}
          </span>
        </div>
        <div style={{
      opacity: 0.9
    }}>{caption || 'Media not uploaded yet.'}</div>
        <div style={{
      fontSize: '0.7rem',
      opacity: 0.5
    }}>
          Upload to R2 as <code>{id}.{resolvedExt}</code> — preview only, hidden in production.
        </div>
      </div>;
  }
  const mediaStyle = {
    display: status === 'loaded' ? 'block' : 'none',
    width: '100%',
    height: 'auto',
    borderRadius: '0.75rem'
  };
  const media = isVideo ? <video src={inView ? src : undefined} autoPlay loop muted playsInline preload="metadata" onLoadedData={() => setStatus('loaded')} onError={() => setStatus('missing')} style={mediaStyle} /> : <img src={inView ? src : undefined} alt={caption} onLoad={() => setStatus('loaded')} onError={() => setStatus('missing')} style={mediaStyle} />;
  return <figure style={{
    margin: '1.25rem 0'
  }}>
      <div ref={boxRef} style={status === 'loaded' ? {
    width: '100%'
  } : {
    width: '100%',
    aspectRatio: ratio,
    borderRadius: '0.75rem',
    background: 'rgba(128,128,128,0.06)'
  }}>
        {media}
      </div>
      {status === 'loaded' && caption ? <figcaption style={{
    marginTop: '0.5rem',
    textAlign: 'center',
    fontSize: '0.85rem',
    opacity: 0.7
  }}>
          {caption}
        </figcaption> : null}
    </figure>;
};

Compliance is about being clear, in writing, on how ModuleX handles your data and the laws it operates under. This page is the plain-language summary. It covers the privacy rights you have, how data is processed and kept, where ModuleX stands on regulated industries, and how to get the current status of any certification before you rely on it.

For how the product is engineered to protect data, see the [Security overview](/security/overview). For data handling and retention in context, see [Trust & compliance](/security/trust). For the third parties that may process data on ModuleX's behalf, see [Sub-processors](/security/sub-processors).

<Note>
  This page describes ModuleX's compliance posture. It is a summary, not a legal document. The binding terms are the published Terms of Service and Privacy Policy. Where the two differ, the published legal documents govern.
</Note>

## Certifications: confirm the current status

ModuleX does not publish a list of completed third-party security certifications in these docs. Treat every certification below as **not yet confirmed here** until ModuleX gives you its current status in writing.

<Warning>
  Do not assume any certification is in place. SOC 2, ISO 27001, HIPAA, and similar attestations are **TBD** in this documentation. If you need to verify the current status of a certification or report for a security review, contact sales or email `security@modulex.dev` and ask for the latest. Do not rely on a certification that has not been confirmed to you in writing.
</Warning>

<CardGroup cols={2}>
  <Card title="SOC 2" icon="clipboard-check">
    Status not confirmed in these docs. **TBD — contact sales** for the current report or attestation status.
  </Card>

  <Card title="ISO 27001" icon="globe-lock">
    Status not confirmed in these docs. **TBD — contact sales.**
  </Card>

  <Card title="HIPAA" icon="stethoscope">
    ModuleX is **not designed for regulated regimes** (see below). **TBD — contact sales** before any healthcare use.
  </Card>

  <Card title="Other frameworks" icon="list-checks">
    For any other standard or questionnaire, **contact sales** for the current position.
  </Card>
</CardGroup>

## Regulated industries: read this first

ModuleX's Terms of Service state plainly that the service is **not designed for use under regulated regimes** such as HIPAA, GLBA, and PCI-DSS, unless ModuleX agrees to it in writing.

<Warning>
  You may not use ModuleX in a way that would require HIPAA, GLBA, PCI-DSS, or similar compliance unless you have a written agreement from ModuleX that expressly permits it. If your use case falls under one of these regimes, contact sales before you build on ModuleX. See [Contact sales](/enterprise/contact-sales).
</Warning>

This is a posture, not a gap to work around. If you handle protected health information, regulated financial data, or cardholder data, start the conversation early so the right agreement is in place first.

## Privacy laws ModuleX works under

ModuleX is operated by ModulexAI, LLC, which acts as the **data controller** for your account data under the GDPR. The privacy program is built around two major frameworks plus a range of US state laws.

<CardGroup cols={2}>
  <Card title="GDPR" icon="shield-check">
    For the EEA, UK, and Switzerland. ModuleX honors the data-subject rights below and relies on the European Commission's Standard Contractual Clauses for cross-border transfers.
  </Card>

  <Card title="CCPA / CPRA" icon="map-pin">
    For California residents: the right to know, delete, correct, and opt out of the sale or sharing of personal information.
  </Card>

  <Card title="Other US state laws" icon="landmark">
    Residents of many other US states (including Virginia, Colorado, Connecticut, Utah, and Texas) have similar rights under their own privacy laws.
  </Card>

  <Card title="PCI-DSS (payments)" icon="credit-card">
    ModuleX does not store your payment card details. Card data goes directly to the payment processor, which adheres to PCI-DSS.
  </Card>
</CardGroup>

### Your privacy rights

If you are in the EEA, UK, or Switzerland, you can exercise the following rights over the personal information ModuleX holds. ModuleX may ask you to verify your identity first.

<CardGroup cols={3}>
  <Card title="Access, update, delete" icon="file-pen">
    See, correct, or remove the information ModuleX holds about you.
  </Card>

  <Card title="Rectification" icon="check">
    Have inaccurate or incomplete information corrected.
  </Card>

  <Card title="Object" icon="hand">
    Object to ModuleX processing your personal information.
  </Card>

  <Card title="Restriction" icon="circle-pause">
    Ask ModuleX to limit how it processes your information.
  </Card>

  <Card title="Data portability" icon="download">
    Receive your data in a structured, machine-readable, commonly used format.
  </Card>

  <Card title="Withdraw consent" icon="rotate-ccw">
    Withdraw consent where processing relied on it.
  </Card>
</CardGroup>

California and other US-state residents can request the same kinds of access, deletion, and correction, and can opt out of any sale or sharing of personal information. ModuleX states that it does **not** sell personal information for money and does **not** share it for cross-context behavioral advertising, and that it recognizes the **Global Privacy Control (GPC)** browser signal as a valid opt-out.

To exercise any of these rights, use the in-app settings or email `privacy@modulex.dev`. You also have the right to complain to your local data protection authority.

## How your data is handled

A few principles sit at the center of ModuleX's data handling. Each links to the page with the full mechanics.

<CardGroup cols={2}>
  <Card title="Encrypted in transit and at rest" icon="lock" href="/security/data-encryption">
    Data is encrypted in transit over TLS/HTTPS and at rest (AES-256 where applicable). Connected-service credentials are encrypted before they are stored.
  </Card>

  <Card title="Your work stays in your organization" icon="box" href="/security/org-context">
    Every resource belongs to exactly one organization, and ModuleX checks your membership on each request. One organization's data does not reach another.
  </Card>

  <Card title="Not used to train AI models" icon="brain">
    Your prompts, workflow content, and connected-service data are not used to train AI models. AI processing is real-time and ephemeral; nothing is kept for training.
  </Card>

  <Card title="Access controls and monitoring" icon="eye">
    Role-based access with least privilege, multi-factor authentication for employee accounts, and security event monitoring and logging.
  </Card>
</CardGroup>

<Accordion title="What happens to data sent to AI providers?">
  When you use ModuleX-managed models, your content is processed by AI providers (such as OpenAI, Anthropic, and Google Gemini) only to run your workflow, and is not used to train their models under their published API customer commitments. When you [bring your own key](/integrations/llm-providers/overview), your data goes directly to that provider under your own account and terms. ModuleX does not use customer content to train any model, its own or a third party's.
</Accordion>

<Accordion title="What about data from connected services like Google or Microsoft?">
  Data ModuleX receives from a connected service is used only to deliver the workflow features you ask for. For Google data, ModuleX affirms it follows the Google API Services User Data Policy, including the Limited Use requirements: no advertising use, no sale, no use for training generalized AI/ML models. The same Limited Use commitments apply to other connected services, including Microsoft Graph, Meta, and LinkedIn data. See [Credentials & OAuth2](/concepts/credentials-oauth) for how these connections are stored and scoped.
</Accordion>

<MediaEmbed id="MX-MEDIA-4270" type="image" caption={"A skimmable compliance posture card grid summarizing the frameworks ModuleX works under and the certifications marked TBD."} />

## How long ModuleX keeps data

ModuleX states that it keeps data only as long as needed for the purpose it was collected for. The published retention windows are:

| Data                | Retention                                                                                    |
| ------------------- | -------------------------------------------------------------------------------------------- |
| Account data        | Kept while your account is active, plus 30 days after a deletion request                     |
| Usage logs          | 90 days for analytics; up to 1 year for security investigations                              |
| Transaction records | Up to 7 years for legal and tax compliance                                                   |
| Google API data     | Kept while the feature is in use, plus 7 days after you revoke access or delete your account |

When you revoke access, delete your account, or stop using a feature, ModuleX removes the associated data within these windows. You can request deletion through in-app settings or by emailing `privacy@modulex.dev`.

<Note>
  ModuleX also keeps an internal audit-log retention policy of 365 days for its own operational records. This is separate from the customer-facing retention windows above. Detailed self-hosted logging and retention controls are documented for engineers in [Data security & encryption](/security/data-encryption).
</Note>

## Where your data is processed

ModuleX processes data in the **United States**. If you are outside the US and provide information, it is transferred to and processed in the United States, where data-protection laws may differ from those in your own jurisdiction.

For transfers from the EEA, UK, or Switzerland, ModuleX relies on the **Standard Contractual Clauses** approved by the European Commission.

<Warning>
  Specific data-residency options (for example, hosting in a particular region or country) are **TBD** in this documentation. If you have a residency requirement, contact sales to confirm what is available before you commit.
</Warning>

## Reporting a security issue

ModuleX runs a vulnerability disclosure policy covering the `modulex.dev` website, the ModuleX web application, and the ModuleX API services. Email security reports to `security@modulex.dev`; ModuleX acknowledges receipt within three business days, and reports can be submitted anonymously.

If you become a customer and need a security or compliance review, that same address is the place to request the current status of any certification, report, or questionnaire.

## Get the current status

Because certifications change over time, this page does not assert any of them. Get the current position directly before you rely on it.

<CardGroup cols={2}>
  <Card title="Talk to sales" icon="phone" href="/enterprise/contact-sales">
    For certification status, data-residency options, a data processing agreement, or regulated-industry use, contact the ModuleX team.
  </Card>

  <Card title="Email security" icon="mail">
    Reach the security team at `security@modulex.dev` for security reviews, questionnaires, and vulnerability reports.
  </Card>
</CardGroup>

## Related pages

<CardGroup cols={3}>
  <Card title="Trust & compliance" icon="badge-check" href="/security/trust">
    How ModuleX handles, retains, and protects data, in context.
  </Card>

  <Card title="Sub-processors" icon="building" href="/security/sub-processors">
    The third parties that may process data on ModuleX's behalf.
  </Card>

  <Card title="Security overview" icon="shield" href="/security/overview">
    How the product is built to protect your data, credentials, and access.
  </Card>
</CardGroup>