Compliance
FAQ
Common questions about Compliance, known limits and what is not built yet.
Is Compliance a separate app?
No. Compliance currently runs inside the Core app (app.marsstein.ai). Sign-in, organisation, roles and the AI agent are the ones described in Core. There is no second login and no separate address.
Does the AI decide on compliance?
No. The agent reads, analyses and drafts. It does not replace a legal review. A checklist created by the agent is marked "Created by the agent" until you edit it or confirm it in the session, and a document only counts as approved after the approvers you chose have signed it.
Which regulations are covered?
The GDPR (DSGVO). The checklists are gap analysis, TOM (Art. 32), ROPA (Art. 30), DSAR (Art. 15) and DPIA (Art. 35), plus domain checklists. The template catalogue also holds one template for the Fundamental Rights Impact Assessment (FRIA) under the AI Act. No other regulation has its own checklists today.
What does "Created by the agent" versus "Validated" mean?
A checklist the agent filled in carries the notice "Created by the agent". You validate it by editing it or by confirming it in the session. The checklist then shows "Validated".
Why is a checklist locked?
The checklists after the first one say "Complete Gap Analysis first". Finish the gap analysis and they open.
What happens when a checklist says its package is not installed?
Checklists come from packages. If the package is not installed for your organisation, the checklist shows the notice "This checklist's package isn't installed for this organisation." and nothing you type is saved. An administrator can install it under Settings, Plugins.
Can I delete a checklist?
Yes. Delete removes all gap-analysis data and answers of that checklist for good, after a confirmation. If your agent rules say "ask before deleting", the agent asks first when it wants to delete checklist data.
Who may sign a document?
You choose the approvers. Internal approvers are members of your organisation. External approvers are clients or partners and receive a magic link by email that opens the signing page for exactly that document. Submitting a document for approval needs the right to submit documents.
Can I change the approvers after sending?
Yes, but it cancels the pending invitations and invalidates the existing magic links, and you place the signature boxes again. If someone has already signed, removing their field invalidates that signature and they are notified by email.
What is encrypted?
The data of your organisation is stored encrypted under a key per organisation. Settings, Encryption shows by area what is sealed. The report is read-only.
Where do I see who did what?
In Settings, Audit Log. It lists app events and access checks, with filters, and can verify the integrity of the chain.
What can I not do yet?
Compliance has no frameworks beyond the GDPR checklists, no control or evidence library of its own, and no audit-planning module. Tasks can carry evidence files and risks can be linked to tasks, but a formal audit workflow does not exist.