# My Compliance Citadel (My-CC)

> My-CC is a governance layer for AI agents. It checks every tool call before it runs, sends risky actions to a named human reviewer, and records everything in a tamper-evident audit chain. Built for regulated organizations.

## Who it is for
Regulated organizations, including healthcare, mental health, financial services, legal, real estate and children's toys. Views for governance leads, business users, engineering, legal counsel and InfoSec.

## What it does
- Pre-execution enforcement: PreToolUse and PostToolUse hooks check each tool call against policy before it runs.
- Human review: risky actions go to a named reviewer.
- Tamper-evident audit chain: every event is Ed25519-signed and SHA-256 hash-linked.
- PII Shield: classifies and redacts before anything leaves your environment.
- Versioned compliance packs (pin a version), and a State AI Law tracker with effective dates.
- Per-regulator compliance reports from your own audit chain, exportable as PDF or CSV.
- [TAC Score](https://my-cc.io/docs/trust-score.html) (Trusted Agent Citascore): each agent is scored 0 to 1000. Bands: Gold 750-1000, Silver 600-749, Bronze below 600; a public band issues after 90 days sustained in-band.

## Runtimes
- Agent
- Project
- Desk
- Humanoids & Toys (on-device, beta)

## Deployment
- Self-hosted Docker container, a Connector SDK wrapper, or a URL swap to proxy.my-cc.io.
- Claude Code users get hook-based enforcement with no code change.
- Model providers: Anthropic, OpenAI, Amazon Bedrock, Azure OpenAI, Google Gemini, DeepSeek, Replicate and HuggingFace inference endpoints.

## Frameworks covered
151 compliance packs, including HIPAA, SOC 2, ISO 27001, ISO 42001, GDPR, UK GDPR, EU AI Act, NIST AI RMF, DORA, PCI DSS, SOX, COPPA, FCA AI guidance and FTC guidance. Packs map controls to these frameworks; they are not certifications of My-CC itself.

## Certifications
SOC 2 Type II and ISO 27001 certifications for My-CC are planned, not achieved. Status: https://my-cc.io/trust

## Pricing
See https://my-cc.io/pricing for current pricing.

## Docs
- [How it works](https://my-cc.io/docs/how-it-works.html)
- [Compliance packs](https://my-cc.io/docs/compliance-packs.html)
- [Getting started](https://my-cc.io/docs/getting-started.html)
- [Install the runtime](https://my-cc.io/docs/install-runtime.html)
- [Register an agent](https://my-cc.io/docs/register-agent.html)
- [Integrations](https://my-cc.io/docs/integrations.html)
- [API reference](https://my-cc.io/docs/api-reference.html)

## For buyers
- [For the C-suite](https://my-cc.io/for-c-suite)
- [Pricing](https://my-cc.io/pricing)
- [Trust Center](https://my-cc.io/trust): security posture, certification status, subprocessors.

## Research
- [Regulated Data in Orbit](https://my-cc.io/whitepapers/regulated-data-in-orbit): white paper by Thomas McShane (July 2026, revised October 2026) on HIPAA, GDPR, FedRAMP and related obligations for orbital data paths.

## About
- [About My-CC](https://my-cc.io/about): My Compliance Citadel, LLC
- Contact: thomas@my-cc.io
- General inbox: info@my-cc.io
- Book a briefing: https://my-cc.io/#briefing