Monitoring
Compliance
inline finds the third-party providers your code actually sends data to, checks them against the agreements you have signed, and raises a compliance finding for anything uncovered.
Uploading agreements and turning monitoring on are admin tasks. Everyone with compliance access can read the coverage and the compliance findings.
#Uploading an agreement
Agreements is the list of your signed Business Associate Agreements. Upload the document and inline reads it, pulling out which services it covers, the conditions attached, when it expires and the nuances that decide whether a given use is actually covered.
That extraction is what makes the coverage check work: an agreement covering three named services does not cover a fourth, and inline knows which three.
#Reading the coverage
Compliance
Coverage of the third-party providers your code uses against the agreements you've signed. Uncovered providers are verified by an agent for actual data flow before they're flagged.
Active agreements
6
Providers detected
11
Open findings
2
Assessment spend
$•.••
Provider coverage
6/11 covered
Provider coverage lists each provider inline detected in your code with a badge saying where it stands, and the counter beside the card gives you the covered total against the detected total.
| Badge | What it means |
|---|---|
| Covered | An active signed agreement covers this provider for how you use it. |
| Not covered | The provider is used and no agreement covers it. |
| No BAA available | The provider does not offer one, so the exposure is structural. |
| Partial coverage | An agreement covers some of what you send, and not all of it. |
| Unknown vendor | Detected, and inline has yet to place it. |
| Checking… | The data-flow check is still running. |
#Compliance findings
A provider without cover becomes a compliance finding only once inline has confirmed your code sends data to it. A dependency that is imported and never called does not become one.
That check is why the Compliance Findings page is short enough to work through. Active agreements, Providers detected and Open findings at the top of the Compliance Overview are the three numbers to watch as your code changes.
#Turning it on
The Compliance Settings tab has three switches. Enable compliance monitoring is the master switch, Check pull requests looks at incoming changes for a provider your agreements do not cover, and Email alerts decides whether compliance findings also arrive by email.
Check pull requests is the one that changes behaviour rather than reporting: it catches a new provider while someone is still adding it, which is the easiest moment to have the conversation.
Compliance is included with Enterprise. See Plans and billing.