Compliance
Set rules that detect confidential information before it goes to cloud models or the web search.
Compliance policies protect confidential information such as names, e-mail addresses or account numbers from leaving the LOKI appliance unnoticed. To do this, LOKI checks everything that goes outside:
- Web search and web page fetching: the search terms and addresses that LOKI sends.
- Conversations with cloud models: the content that goes to a cloud provider.
Compliance does not check what stays on the appliance, that is, chats with the local model Loki; this is not necessary there.
Only administrators manage compliance. As long as no policy is active, LOKI does not check anything.
Creating a policy
Open the form
Under Compliance › Policies, click New policy.
Name and description
Give the policy a Name and optionally a Description, such as “HR personal data”.
Choose the action
Under Action on flagged content, you set what happens when LOKI detects something:
| Action | Effect |
|---|---|
| Ask the user (send / redacted / cancel) | For the web search, the person decides in the chat (see Compliance check). For cloud models, content is redacted. |
| Always send redacted | Detected information is replaced by a placeholder before sending. |
| Always block | Calls and conversations containing detected information are refused. |
What to detect
Under Detected entity types, tick which kinds of information LOKI should look for. Nothing is ticked in a new policy; without a selection, it detects nothing.
| Type | Detects |
|---|---|
| PERSON | Names of people |
| EMAIL_ADDRESS | E-mail addresses |
| PHONE_NUMBER | Phone numbers |
| LOCATION | Places and addresses |
| IBAN_CODE | IBANs |
| CREDIT_CARD | Credit card numbers |
| IP_ADDRESS | IP addresses |
| DATE_TIME | Dates and times |
| URL | Web addresses |
| NRP | Nationality, religion, political affiliation |
Further types are in the list; some of them, such as US_SSN, mainly concern US data.
Custom patterns (optional)
Under Custom regex rules, technically skilled people add their own search patterns, for example for internal staff or project numbers. Each rule has a Label, a Pattern and a Score.
Fine-tuning
- Confidence threshold: how certain LOKI must be before it flags something, between 0.0 and 1.0. The default is 0.95. Higher means fewer false alarms, but also more missed information.
- Languages: which languages LOKI searches in; German and English are preset.
- Groups: the policy applies only to members of the ticked groups. If you leave them all unticked, it applies to everyone.
Activate and save
Tick Active; new policies are inactive at first. Click Save.
If several policies are active, LOKI combines them and applies the strictest rule in each case.
The policy list
Under Policies, you see each policy with its action, entity types, groups (“Everyone” if none are selected) and status. In the Active column, you switch a policy on or off with one click. You delete it with the bin icon.
The log
Under Compliance › Logs, every call and every conversation that an active policy checked is listed: Time, User, Tool (for cloud models “Conversation (external model)”), Findings and Decision. If you expand an entry, you see the policy applied, each finding and what was actually sent.
| Decision | Meaning |
|---|---|
| Passed (no findings) | Nothing detected, sent normally |
| User sent original | The person sent it unchanged |
| User sent redacted | The person sent it redacted |
| User cancelled | The person cancelled the call |
| Redirected to local model | The person switched to the local model |
| Auto-redacted (policy default) | Redacted automatically |
| Auto-blocked (policy default) | Blocked automatically |
The log contains the original information
So that you can trace decisions, the log also stores the original, unredacted content. It is visible only to administrators.
Limitations
Detection works automatically and is not error-free: it can miss information and flag harmless passages. Compliance policies are therefore an additional safeguard, not a substitute for deciding whether cloud models and web search are suitable for your content at all.
If there is no active policy, content goes to cloud models unchecked, including content from e-mails and databases.