Compliance pointers

Data map, retention, and security posture — not a certification claim.

See the data map in repo docs/DATA_MAP.md: what is KEEP vs DROP, encryption of connector secrets, and that session transcripts live in gateway SQLite. Product legal pages live on chazakah.com (privacy, terms, security).

OpenBot does not claim SOC2/HIPAA certification in these docs. Map controls to your own compliance program.