The problem

‍

Security teams need to show that policy ran — without storing every prompt in a SIEM. Regulated buyers need residency, subprocessors, and audit trails without turning Blekline into another data lake.

‍

‍

What we store (default)

‍

FieldExamplekindtool_call_enforcementactionallow / mask / blockentitiesMasked3riskTierlow / medium / highmcpToolNamewrite_fileclientSurfacecursor, sdkrequestIdUUID

No raw prompt text. No full tool argument bodies in default configuration.

‍

‍

How Blekline handles it

‍

• Workspace Activity + CSV — export for security and compliance review.
• SIEM forward — JSON / CEF (Governance+).
• NHIM audit SARIF / JSON — staging cluster evidence from Track 0 CLI.
• EU AI Act mapping doc — evidence input for your program, not certification.
• DPA + subprocessors pack — enterprise procurement.

‍

‍

NHIM audit (Track 0)

‍

npx @blekline/nhim-audit audit --profile generic --plain --json -o nhim-audit.json

Vendor-neutral static scan — no Blekline account required. Maps findings to OWASP ASI tags for audit trails.

‍

‍

Data residency

‍

Default SaaS: EEA-first — Frankfurt compute, Ireland database. US-primary and EEA Processing Confirmation addenda available for enterprise customers.

‍

‍

Honest scope

‍

Blekline audit artifacts support your security and compliance program — they do not replace DPIA, conformity assessment, or legal sign-off. See DPA summary and contact enterprise@blekline.com for executed agreements.