---
title: "Data protection · intentic sandbox API"
description: "Where data can leave this sandbox, what protects it, and the documents that say so. Every route in the data protection group of the intentic sandbox API."
url: "https://intentic.dev/api/compliance/"
---

The sandbox itself

# Data protection

Where data can leave this sandbox, what protects it, and the documents that say so

**On this page (4 sections)**

- [Where data can leave, and what protects it](#compliance-report)
- [A data protection document, filled in from this sandbox](#compliance-document)
- [What the public-office preset would change](#compliance-preset)
- [Apply chosen items of the public-office preset](#compliance-applyPreset)

Every outbound path as configured right now, with its destination, whether personal data can travel on it and whether the privacy shield covers it; the technical and organisational measures and whether each is in place; a data protection document filled in from this sandbox; and what the public-office preset would change, with a way to apply it.

**GET`/compliance` Where data can leave, and what protects it**

Every outbound path as configured right now (model providers, mail, team chat, connectors, speech, the web, the platform, updates, analytics), each with its destination, whether personal data can travel on it and whether the privacy shield covers it; and the technical and organisational measures with whether each is in place.

### What you send

Nothing. Call it as it is.

### What comes back

| Field | Type |
| --- | --- |
| `generatedAt` When this was read, as an… | string |
| `flows` | object[] |
| `id` Stable id of this path, such… | string |
| `group` | "models" | "messaging" | "connectors" | "speech" … (8) |
| `kind` | "model-provider" | "model-endpoint" | "local-model" | "email-imap" … (18) |
| `name` The destination's own name, such as… | string |
| `hosts` The hosts data is sent to,… | string[] |
| `operator` Who runs the destination, where known | string |
| `region` Where it is processed, as far… | string |
| `thirdCountry` True when the operator processes the… | boolean |
| `active` Whether this path is in use… | boolean |
| `personalData` | "yes" | "possible" | "no" |
| `shield` | "masked" | "trusted" | "watched" | "local" … (6) |
| `switch` What opens or closes this path:… | string |
| `question` Set when the sandbox cannot tell… | string |
| `measures` | object[] |
| `id` | "privacy-shield" | "privacy-images" | "privacy-names" | "trusted-providers" … (25) |
| `category` | "confidentiality" | "minimisation" | "integrity" | "accountability" … (6) |
| `status` | "on" | "partial" | "off" | "unavailable" … (5) |
| `facts` The configured values behind the status,… | object |
| `preset` The public-office preset changes this measure | boolean |

Try it answered in this tab

curl

```bash
curl "$SANDBOX/compliance" \
 -H "x-intentic-control: $INTENTIC_TOKEN"
```

TypeScript

```typescript
import { sandbox } from "@intentic/sandbox-client";

const result = await sandbox.compliance.report();
```

**GET`/compliance/document` A data protection document, filled in from this sandbox**

The record of processing activities entry, the data protection impact assessment draft, or the list of technical and organisational measures, in Polish or English, as Markdown or a Word document. What the sandbox knows is filled in; what only the office can say is left as a marked blank.

### What you send

| Field | Type | Where |
| --- | --- | --- |
| `kind` required ropa: the record of processing activities… | "ropa" | "dpia" | "toms" | query |
| `language` pl or en | "pl" | "en" | query |
| `format` md for Markdown text, docx for… | "md" | "docx" | query |

### What comes back

| Field | Type |
| --- | --- |
| `filename` | string |
| `mediaType` | string |
| `encoding` utf8 for Markdown, base64 for a… | "utf8" | "base64" |
| `content` | string |

Try it answered in this tab

curl

```bash
curl "$SANDBOX/compliance/document?kind=ropa" \
 -H "x-intentic-control: $INTENTIC_TOKEN"
```

TypeScript

```typescript
import { sandbox } from "@intentic/sandbox-client";

const result = await sandbox.compliance.document({
 "kind": "ropa"
});
```

**GET`/compliance/preset` What the public-office preset would change**

Each stricter setting the preset proposes, with the value this sandbox has now beside it. Reading it changes nothing.

### What you send

Nothing. Call it as it is.

### What comes back

| Field | Type |
| --- | --- |
| `items` | object[] |
| `id` | string |
| `group` | "privacy" | "retention" | "audit" | "analytics" … (8) |
| `current` | string |
| `proposed` | string |
| `changes` Applying it would change something; false… | boolean |
| `available` It can be applied here | boolean |
| `owner` Only the owner may apply it,… | boolean |

Try it answered in this tab

curl

```bash
curl "$SANDBOX/compliance/preset" \
 -H "x-intentic-control: $INTENTIC_TOKEN"
```

TypeScript

```typescript
import { sandbox } from "@intentic/sandbox-client";

const result = await sandbox.compliance.preset();
```

**POST`/compliance/preset` Apply chosen items of the public-office preset**

Applies only the items named, each to its proposed value, and leaves everything else as it is. An item already at its value, or one this sandbox cannot take (a name model that is not installed), is skipped and said so.

### What you send

| Field | Type | Where |
| --- | --- | --- |
| `items` required The ids of the items to… | string[] | body |

### What comes back

| Field | Type |
| --- | --- |
| `applied` | string[] |
| `skipped` | object[] |
| `id` | string |
| `reason` | "unknown" | "unavailable" | "unchanged" | "owner" |

Try it answered in this tab

curl

```bash
curl -X POST "$SANDBOX/compliance/preset" \
 -H "x-intentic-control: $INTENTIC_TOKEN" \
 -H "content-type: application/json" \
 -d '{"items":["…","…"]}'
```

TypeScript

```typescript
import { sandbox } from "@intentic/sandbox-client";

const result = await sandbox.compliance.applyPreset({
 "items": [
 "…",
 "…"
 ]
});
```

More in The sandbox itself

[Previous ← Audit trail](https://intentic.dev/api/audit/)[Next Logs →](https://intentic.dev/api/logs/)