[warp-agent-staging]

Summary

Remove only HIPAA from the existing Enterprise plans compliance bullet. The requester clarified: "wait why are you removing so much SOC2 and ZDR stuff, just remove the HIPAA stuff that’s all i asked". All other public content is restored to the base wording, including SOC 2, ZDR, caching, telemetry, credentials, and data-transit language. This correction needs no content design plan or shipped-version summary.

Changes

• Change one public line in src/content/docs/enterprise/team-management/admin-panel.mdx: "SOC 2, HIPAA, and custom data handling agreements" becomes "SOC 2 and custom data handling agreements". No other public page differs from the base.
• Save the canonical rule in .agents/references/compliance-claims-policy.md; bind standing instructions, all eight writing skills, the shared drafting workflow, the docs-risk policy, and review instructions to it. Unsupported promises must be omitted, not left behind a public VERIFY marker.
• Companion factory PR #35 binds the foreman, implementation, and review prompts and shared docs-quality skill to the same policy. Versioned instructions are durable repository guidance; no platform-managed Agent Memory write surface was available.

Provenance

The HIPAA bullet originated in gitbook PR #437, Enterprise Docs, commit 3e7fcb2, on March 3, 2026, in the Enterprise Admin Panel article. The unrelated warpdotdev/docs PR #437 is not the source.

Triage examined the complete introducing diff, 8 issue comments, 32 reviews, and 79 inline comments. The PR cites an Enterprise Docs Content Plan and positioning/style guidance and says Oz drafted new articles; that does not establish compliance approval. It also introduced SOC 2 Type II, blanket provider ZDR/caching coverage, Enterprise UGC-disable, and token no-storage/logging promises.

The discussion challenged code-never-leaves claims, confirmed server indexing, and recorded correction f330775. BYOLLM review also acknowledged transit through US Warp servers rather than full residency. The exact HIPAA generation source and independent verification remain unknown; follow-on PR #530 and PR #534 were not fully examined. Private support-email evidence is not published here.

Unverified claims

• HIPAA support is explicitly rejected by the requester. The original claim's generation source and any claimed approval are unknown; the public benefit is removed.
• SOC 2, ZDR, and all other non-HIPAA baseline wording are retained under the requester's clarified public-edit scope, not independently revalidated by this revision. Historical audit questions about attestation scope, provider/model retention and caching, telemetry, credential storage, and data transit remain internal review notes only; they are not public deletions or findings that the underlying claims are false.

Documentation risk

Risk: engineering-review-required
Rationale: Removes a HIPAA compliance claim and adds durable compliance-approval instructions; all non-HIPAA public wording remains at baseline.
Source files consulted: existing docs at aa38334; gitbook PR #437 and commit 3e7fcb2; requester correction.
Requested engineering reviewers: none — no single Security or Legal owner resolved with certainty.
Engineering review status: pending
Docs override: none

Verification

• Passed again on the revision: npm run typecheck (0 errors/warnings; 7 existing hints), npm run test:heading-vars (5 tests), npm run build, npm run test:heading-tocs (3,589 entries, 419 HTML files), and npm run test:homepage-json-ld.
• python3 .agents/skills/style_lint/style_lint.py --changed --output /tmp/docs-compliance-revision-style.json exited 0 for the one changed page with 17 existing warnings (callout density, screenshot width, and glossary terms); none is introduced by removing HIPAA. python3 .agents/skills/check_for_broken_links/check_links.py --internal-only passed (4,941 links, 0 broken), as did git diff --check.
• Byte comparison against the PR base proved exactly one public page differs, and its only edit is the HIPAA phrase and list punctuation. Policy/skill bindings and the companion factory head are unchanged from the previously reviewed delivery. Revision self-review and deletion-only cut pass kept the requested one-line scope; no behavior tests added for copy-only changes.
• python3 .agents/skills/doc_quality_policy/check_compression_contract.py src/content/docs/enterprise/team-management/admin-panel.mdx --content-type feature-doc reports the existing overage: 2,404 words and 5 callouts (base: 2,405 words/5 callouts). No unrelated page restructuring is included.
• trunk check and trunk fmt could not run because Trunk is not installed. External-link HTTP validation was not run. Dependency installation warned about the existing Node/Babel engine and Starlight patch-version mismatch; the build still succeeded.
• Linux Chromium rendered the final Enterprise plans section normally, including "Advanced compliance - SOC 2 and custom data handling agreements". Only local Vercel analytics/speed-insights script 404s appeared. The screenshot below replaces the obsolete broader-edit captures.
• Delivery remains draft pending follow-up review and automatic attribution. The artifact tool supplied no canonical managed attribution-comment block, and neither PR has one; no markup was fabricated.

Computer-use screenshots (1)

Final Enterprise plans copy.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 11, 2026 8:08pm UTC