Select the data types and jurisdictions in one AI workflow. Get a conservative risk tier, frameworks to review, and safeguards to plan. Use the result to support a review, not replace one.
No signup. Selections never leave this page.
Select what the workflow touches. Guidance updates as you go and remains informational.
Select at least one data type to see your risk tier and recommended deployment patterns.
Every number this tool shows, and where it comes from.
Risk tiers. Standard 4-tier model (Public, Internal, Confidential, Restricted). The classifier returns the highest tier triggered by any selected data type, then maps jurisdiction overlays on top: EU citizen data with GDPR raises GDPR-specific obligations regardless of where the data sits.
Framework triggers. Each data type carries a static set of likely frameworks. Selecting PHI lights up HIPAA; payment card data lights PCI DSS v4.0; EU citizen data or the EU/EEA jurisdiction lights GDPR; California or Global lights CCPA; financial reporting data lights SOX; children’s data lights COPPA; education records light FERPA. SOC 2 and ISO 27001 light up for any Confidential or Restricted tier as the standard buyer-side audit baseline.
Deployment patterns. Green/amber/red ratings reflect what the upstream vendors themselves contract for. Anthropic’s public API and OpenAI’s public API do not sign HIPAA BAAs by default; their Bedrock and Azure-hosted equivalents do. Self-hosted open-weight on customer infra is the only fit for true air-gap requirements. Orbit defaults to Anthropic on Bedrock for our own client builds; the ratings here are vendor-neutral.
Protective practices. Drawn from OWASP’s LLM Top 10, NIST SP 800-53 Rev 5, ISO/IEC 27001:2022 controls, and Orbit’s shipped patterns.
What it doesn’t model. Sector-specific rules (FedRAMP, FINRA, GLBA in finance, state privacy laws beyond California). Cross-border transfer mechanics like Standard Contractual Clauses. Insurance and data-breach reporting timelines. Use this as a starting filter, not a final answer.
Mappings last reviewed 2026-05-06.
The rest of the toolkit runs in your browser too.
Orbit keeps approvals, autonomy controls, run logs, and a kill switch beside the work.
500 trial credits. Card required. $0 charged today.