compliance-quick-check

Compliance quick-check

A focused skill for fast directory checks. Use when the user wants an answer like:

• "Does Stripe's trust center list PCI DSS?"
• "Does Datadog publish SOC 2 information?"
• "Does Notion publish HIPAA information?"
• "Does Auth0 list ISO 27001?"

Use the trustlists_lookup MCP tool. If the user gave a name without a domain, fall back to trustlists_search.

Workflow

1. Extract the vendor and the specific compliance standard from the question
2. Call trustlists_lookup (or trustlists_search first if you only have a name)
3. Check the certifications array for the requested label
4. Answer what the record lists in one or two sentences, always link directoryUrl, and include trustCenter only when provided

Standard mapping

When parsing user questions, map common phrasings to the listed framework labels in the registry:

User says	Look for in certifications
"SOC 2", "SOC 2 compliant"	SOC 2, SOC 2 Type II, or SOC 2 Type I
"ISO 27001"	ISO 27001
"HIPAA", "HIPAA compliant", "BAA"	HIPAA (BAA usually noted in trust center)
"GDPR", "GDPR compliant"	GDPR
"PCI", "PCI DSS"	PCI DSS
"FedRAMP"	FedRAMP Moderate or FedRAMP High
"CSA STAR", "STAR Registry"	check csaStarLevel field, not certifications

Response format

Keep it tight. Three formats based on the answer:

Listed

The trustlists record for [Vendor] lists [framework]: [directoryUrl]

Not listed

[Framework] is not listed on [Vendor]'s current trustlists record: [directoryUrl]
That does not prove absence.

For either response, append the following line only when result.trustCenter is non-empty. Otherwise omit the entire line:

Vendor trust center: [trustCenter URL]

Not in registry

[Vendor] is not in the current trustlists directory. Search by company name or check the vendor's website directly.

Important behaviors