compliance-scanner

name	compliance-scanner
description	Surface-level compliance risk assessment for Make.com scenarios. Checks GDPR, Quebec Law 25, PCI-DSS, and HIPAA. NOT legal advice — flags risks for human review.

Skill: compliance-scanner

Performs surface-level compliance risk assessment on Make.com scenarios. NOT legal advice. Flags risks for human review.

When to Run

• During audit (scenario-auditor calls this per scenario)
• On demand when user asks "is this compliant?"
• Automatically when scenario-reader detects personal/payment/health data

Frameworks Assessed

See frameworks.md for the full checklist for each framework (GDPR, Quebec Law 25, PCI-DSS, HIPAA).

Output Format

## Compliance Surface Assessment

**Frameworks assessed:** {list}
**Assessment date:** {timestamp}
**Status:** {risks-found | clean}

### Risks Found

#### [RISK TITLE]
**Framework:** {GDPR / Quebec Law 25 / PCI-DSS / HIPAA}
**Severity:** {Critical / High / Medium / Low}
**Scenario:** {scenario name}
**Description:** {plain-language risk description}
**Recommendation:** {specific action to take}
**References:** {relevant article/section}

### Clean Areas
{What was assessed and found compliant}

---
**Disclaimer:** This assessment is a surface-level automated scan, not legal advice.
Consult a qualified privacy lawyer before making compliance decisions.
In Quebec: contact Commission d'accès à l'information for guidance.
In the EU: contact your Data Protection Officer (DPO) or national supervisory authority.

Severity Definitions

Critical: Likely violation in progress. Stop and fix before next run. Example: Payment card numbers flowing through Make.com logs.

High: Probable violation if not addressed within 30 days. Example: Personal data transferred to US service without standard contractual clauses.

Medium: Risk area — review and document mitigation. Example: No documented legal basis for processing marketing email data.

Low: Best practice not followed — low immediate risk. Example: No explicit data retention policy defined for this automation's data.

Save Output

Save to .make/compliance/{timestamp}-{scenario-id}-compliance.md. Append summary to workspace-level compliance overview at .make/compliance/overview.md.