Compliance

UltimateTeam.ai is built compliance-first. Every external action — every email, SMS, voice call, content publish, vendor payment — passes through a compliance pipeline before it leaves the platform. This page describes the controls that exist in the shipped code today, with the honest status of each framework. It does not claim a certification the platform has not obtained.

Public evidence

The Trust portal at app.ultimateteam.ai/trust is live and requires no login:

Route	What it shows
`/trust`	Compliance badge grid; each badge links to the evidence section on this page or to the in-app viewer
`/trust/eu-ai-act`	Signed EU AI Act conformity pack (SHA-256 + Ed25519 signature block, PDF download)
`/trust/transparency`	Public Merkle root history for the agent-action transparency log, with verification instructions
`/trust/agent/{cert_id}`	Per-agent certificate detail with client-side Web Crypto verification

The backend endpoints behind these pages are GET /api/v1/trust/eu-ai-act/json, GET /api/v1/trust/eu-ai-act/pdf, GET /api/v1/trust/transparency/merkle-roots, and GET /api/v1/trust/agent-certificates/{cert_id}.

SOC 2 Type II

Status: in progress — evidence automation built; no SOC 2 report has been issued.

What is implemented:

37 controls across the five Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy) are defined in a single controls-mapping document that the platform parses at runtime. The control list is not hard-coded; the mapping document is the source of truth.
Daily evidence collection. A collector runs each control’s evidence command once per day and stores the result as a JSON artifact in Google Cloud Storage under soc2/{yyyy}/{mm}/{dd}/{control_id}.json.
Hash-chained storage. Every artifact carries a previous_hash / entry_hash pair computed with the same algorithm as the tenant audit trail, so a tampered or missing artifact breaks the chain.
Drift detection. A failing control emits a compliance.drift.detected event; the drift policy maps the control’s criterion prefix to a severity and a required autonomy level (Security controls always require a human).
Dashboard and report. GET /api/v1/compliance/soc2/status returns per-control status (passing, failing, stale, no_data); GET /api/v1/compliance/soc2/report renders an auditor-ready PDF for a date window; POST /api/v1/compliance/soc2/verify-chain re-walks the evidence chain and reports the first broken link, if any.
All SOC 2 evidence is platform-level (tenant_id="system"); it measures the operational posture of UltimateTeam.ai itself, not any tenant.

What is not yet true: the evidence bucket must be provisioned per environment (the status endpoint returns 503 until SOC2_EVIDENCE_BUCKET is set), and no independent auditor has issued a Type I or Type II report. Treat the “SOC 2 Type II” badge on /trust as “evidence collection in progress”.

Status: data-subject rights and isolation controls implemented.

Tenant isolation. Every table carries tenant_id; every repository query filters on it; row-level security is enforced in PostgreSQL.
Data-subject rights as authenticated API endpoints under /api/v1/export:
- Art. 15 access — POST /access
- Art. 16 rectification — PUT /rectify (applied across all tenant tables by the enforcement middleware)
- Art. 17 erasure — POST /erase (asynchronous; a fixpoint deletion walks every tenant-referencing column discovered from the live database catalog, verifies no rows remain, and purges the tenant’s Redis keys; audit_log is retained as required by law)
- Art. 18 restriction — PUT /restrict (blocks agent task execution while the restriction flag is active)
- Art. 20 portability — POST /portable, then GET /{export_id} and GET /{export_id}/download
- Art. 21 objection — POST /object (blocks specific processing types)
- CCPA equivalents — GET /inventory and POST /ccpa-delete
Restriction and objection flags are checked by every agent before any LLM processing begins, not only at the API layer.
Breach notification. A breach service computes wall-clock deadlines from the jurisdiction rule files (GDPR: 72 hours to the supervisory authority), emits compliance.breach_registered, writes the audit trail, and tracks approaching deadlines and per-jurisdiction notifications sent.
Jurisdiction resolution. The tenant’s billing country selects which rule set applies (GDPR, CCPA, PIPEDA, LGPD, POPIA, APPI, Australian Privacy Act). Rules are YAML configuration, so regulatory changes ship without a code release.
Data residency for EU processing is an Enterprise option; contact us for a Data Processing Agreement.

CAN-SPAM

Status: enforced in code on every commercial email.

Before a commercial email is delivered, the communication compliance engine validates the message and blocks it on any violation:

AI-assistance disclosure present — injected automatically and not suppressible.
Physical mailing address present (from the tenant’s compliance profile).
A working unsubscribe mechanism present.
Deceptive subject-line heuristics (Re: / Fwd: on initial outreach) raise a warning.
Recipient is not on the tenant’s suppression list.

Unsubscribe links resolve to GET|POST /api/v1/compliance/email/unsubscribe, which needs no login. Processing adds the address to the suppression list immediately — well inside the statutory 10-business-day window — and the opt-out propagates to every agent through the event bus. These checks run at delivery time, independently of the Quality Gate, so an agent cannot label its way around them. Sending domains are verified (SPF, DKIM, DMARC) through the email provider before delivery is allowed.

TCPA

Status: enforced in code before every call and SMS.

Every outbound phone call and SMS passes these gates before it reaches the carrier:

Prior express consent. A consent record must exist for the number (check_consent); consent is recorded with type, source, and timestamp.
Do-not-call. The tenant’s internal do-not-call list is checked (check_do_not_call). The platform does not currently query the National Do Not Call Registry on your behalf; numbers you import as DNC are honored.
Calling hours. 8:00 AM – 9:00 PM in the recipient’s IANA timezone, computed at send time (check_calling_hours).
AI disclosure. Every call opens with the required AI-assistance disclosure naming the business.
STOP handling. An SMS reply of STOP revokes all active consent for the number and marks it do-not-call immediately (handle_stop_keyword).
FDCPA Regulation F. Collections communications are additionally capped at seven touches in any seven consecutive days across all channels; the gate reads the contact timeline and hard-blocks the eighth attempt even if event emission fails.

EU AI Act

Status: transparency and oversight obligations implemented; signed conformity pack published.

Mandatory AI disclosure on every outbound communication.
Human oversight via autonomy levels (Full Control, Guided, Supervised, Autonomous) with a per-agent kill switch and the ability to override any decision.
Immutable, hash-chained audit trail with full decision provenance (confidence, reasoning chain, data sources, expected outcome).
A per-tenant conformity pack (constitution, calibration outcomes, audit chain sample, decision provenance, data lineage) is generated only after the audit chain verifies, then signed and served at /trust/eu-ai-act.

ISO 42001

Status: not certified and not formally assessed.

UltimateTeam.ai has not undergone an ISO/IEC 42001 audit and does not hold a certificate. No formal clause-by-clause mapping document is published yet. The platform components that an AI management system assessment would examine are the ones described above: the agent constitution and autonomy levels (policy and human oversight), the decision provenance and calibration loop (performance evaluation), the hash-chained audit trail and transparency log (record-keeping), and the compliance rule engine and drift detection (continual improvement). When a mapping document is published it will be linked from this section; until then, the /trust badge should be read as “controls exist that are relevant to ISO 42001”, not as an attestation.