> ## Documentation Index
> Fetch the complete documentation index at: https://docs.exterview.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Governance

> Governance controls in Exterview including roles and permissions, competency frameworks, retention and consent policies, human review, audit trails, and knowledge base setup.

<Info>
  **Applies to Enterprise.** Governance is part of the full configuration set,
  guided during Enterprise onboarding. Starter and Growth don't configure this,
  see [Configure Overview](/configure/overview).
</Info>

## Purpose

Governance defines who can do what, how data is handled, and how oversight works, so evaluations stay controlled, private, and auditable. It's the final stage of setup, wrapping the [Foundation](/configure/foundation) and [Operations](/configure/operations) you've configured before everything is signed off and frozen.

## What Governance covers

<CardGroup cols={2}>
  <Card title="Locations & Regions" icon="globe">
    Used for routing, data residency, and operational context.
  </Card>

  <Card title="Users & Roles" icon="user-gear">
    Roles and permissions, who can configure, run, and review.
  </Card>

  <Card title="Compliance Frameworks" icon="scale-balanced">
    Only confirmed or correctly labeled frameworks (see status below).
  </Card>

  <Card title="Data Privacy & Retention" icon="lock">
    Consent, retention, deletion, and residency controls.
  </Card>

  <Card title="Human Review" icon="user-check">
    No fully autonomous adverse decisions, a person approves.
  </Card>

  <Card title="Audit Trails" icon="clipboard-list">
    Reviewability and traceability of every action and result.
  </Card>

  <Card title="Knowledge Base" icon="book">
    Your policies, templates, and approved reference material.
  </Card>
</CardGroup>

## Compliance framework status

Frameworks are shown with accurate, current status, never as unconfirmed claims:

| Framework     | Status      |
| ------------- | ----------- |
| SOC 2 Type II | In progress |
| ISO 27001     | In progress |
| ISO 42001     | In progress |

<Info>
  This is a summary. For the full certifications table, current evidence pack,
  and any region-specific requirements, see [Compliance
  FAQs](/trust/compliance-faqs) or contact your Customer Success representative.
</Info>

<Note>
  Some of the roles and access, and audit-trail capabilities described on this
  page are still being finished and rolled out. Your Customer Success contact
  can confirm what's live for your setup today.
</Note>

## FAQs

<AccordionGroup>
  <Accordion title="Can Exterview make an adverse decision on its own?">
    No. Human review applies to outcomes; no fully autonomous adverse decision is made.
  </Accordion>

  <Accordion title="How is access controlled?">
    Through roles and permissions scoped to your organization, configuration,
    running, and review are separate permissions.
  </Accordion>

  <Accordion title="Where is our data stored?">
    Data residency is set by your locations and regions during setup. Retention
    and deletion follow your configured policy.
  </Accordion>

  <Accordion title="What goes in the Knowledge Base?">
    Your approved policies, templates, and reference material, used to keep evaluations grounded in your own guidance.
  </Accordion>
</AccordionGroup>

## Related

<CardGroup cols={2}>
  <Card title="Trust & Compliance" icon="shield-check" href="/trust/security">
    The full security, privacy, and responsible-AI posture.
  </Card>

  <Card title="Go-Live Readiness" icon="circle-check" href="/configure/go-live-readiness">
    Confirm governance before you deploy.
  </Card>
</CardGroup>