diff --git a/.gitignore b/.gitignore
index 268a395..e21a645 100644
--- a/.gitignore
+++ b/.gitignore
@@ -589,4 +589,7 @@ tmp
 compliance_keypair.txt
 backend/files
 *.db-wal
-*.db-shm
\ No newline at end of file
+*.db-shm
+
+!scripts/offline_python_linux_amd64/venv_linux_amd64/venv/
+!scripts/offline_python_linux_amd64/venv_linux_amd64/venv/lib
\ No newline at end of file
diff --git a/backend/services/main/routes/envelope_messaging.py b/backend/services/main/routes/envelope_messaging.py
index e7e48b7..eb1b833 100644
--- a/backend/services/main/routes/envelope_messaging.py
+++ b/backend/services/main/routes/envelope_messaging.py
@@ -501,7 +501,7 @@ async def extract_message_for_compliance(
         "data": compliance_data,
         "instructions": [
             "Transfer this data to an air-gapped machine",
-            "Use compliance_decryption.py decrypt --input-file <json_file>",
+            "Use scripts/compliance/decryption/main.py decrypt --input-file <json_file>",
             "Keep the compliance private key offline at all times"
         ]
     }
diff --git a/docs/COMPLIANCE_DECRYPTION.md b/docs/COMPLIANCE_DECRYPTION.md
index 9ca77fb..7f42c05 100644
--- a/docs/COMPLIANCE_DECRYPTION.md
+++ b/docs/COMPLIANCE_DECRYPTION.md
@@ -29,7 +29,7 @@ The application uses client-server encryption for direct messages (DMs). While r
 ### 3. Files Required
 
 - `compliance_keypair.txt` - Contains compliance X25519 keypair
-- `compliance_decryption.py` - Decryption script
+- `scripts/compliance/decryption/main.py` — decryption tool entrypoint
 - Message data extracted from the server
 
 ## Step-by-Step Instructions
@@ -70,11 +70,11 @@ The application uses client-server encryption for direct messages (DMs). While r
 
 1. Ensure you have the required files:
   - `compliance_keypair.txt` (compliance private key)
-  - `compliance_decryption.py` (decryption script)
+  - `scripts/compliance/decryption/main.py` (decryption tool)
   - `compliance_MESSAGE_ID.json` (extracted message data)
 2. Run the decryption:
   ```bash
-   python compliance_decryption.py decrypt --input-file compliance_MESSAGE_ID.json
+   python scripts/compliance/decryption/main.py decrypt --input-file compliance_MESSAGE_ID.json
   ```
 3. The script will output the decrypted message:
   ```
@@ -177,7 +177,7 @@ Response: JSON with encrypted message data
 ### Decryption Script
 
 ```bash
-python compliance_decryption.py decrypt --input-file <json_file>
+python scripts/compliance/decryption/main.py decrypt --input-file <json_file>
 ```
 
 **Requirements:**
diff --git a/scripts/compliance-decryption/assets/report.css b/scripts/compliance/decryption/assets/report.css
similarity index 100%
rename from scripts/compliance-decryption/assets/report.css
rename to scripts/compliance/decryption/assets/report.css
diff --git a/scripts/compliance-decryption/assets/report.js b/scripts/compliance/decryption/assets/report.js
similarity index 100%
rename from scripts/compliance-decryption/assets/report.js
rename to scripts/compliance/decryption/assets/report.js
diff --git a/scripts/compliance-decryption/bundle_decrypt.py b/scripts/compliance/decryption/bundle_decrypt.py
similarity index 100%
rename from scripts/compliance-decryption/bundle_decrypt.py
rename to scripts/compliance/decryption/bundle_decrypt.py
diff --git a/scripts/compliance-decryption/bundle_extract.py b/scripts/compliance/decryption/bundle_extract.py
similarity index 100%
rename from scripts/compliance-decryption/bundle_extract.py
rename to scripts/compliance/decryption/bundle_extract.py
diff --git a/scripts/compliance-decryption/cli.py b/scripts/compliance/decryption/cli.py
similarity index 100%
rename from scripts/compliance-decryption/cli.py
rename to scripts/compliance/decryption/cli.py
diff --git a/scripts/compliance-decryption/crypto.py b/scripts/compliance/decryption/crypto.py
similarity index 100%
rename from scripts/compliance-decryption/crypto.py
rename to scripts/compliance/decryption/crypto.py
diff --git a/scripts/compliance-decryption/http_client.py b/scripts/compliance/decryption/http_client.py
similarity index 100%
rename from scripts/compliance-decryption/http_client.py
rename to scripts/compliance/decryption/http_client.py
diff --git a/scripts/compliance-decryption/main.py b/scripts/compliance/decryption/main.py
similarity index 86%
rename from scripts/compliance-decryption/main.py
rename to scripts/compliance/decryption/main.py
index 9820c68..8da56ba 100644
--- a/scripts/compliance-decryption/main.py
+++ b/scripts/compliance/decryption/main.py
@@ -3,7 +3,7 @@
 FromChat compliance decryption tool entrypoint.
 
 Run:
-    python scripts/compliance-decryption/main.py <command> ...
+    python scripts/compliance/decryption/main.py <command> ...
 """
 
 from __future__ import annotations
diff --git a/scripts/compliance-decryption/report_assets.py b/scripts/compliance/decryption/report_assets.py
similarity index 96%
rename from scripts/compliance-decryption/report_assets.py
rename to scripts/compliance/decryption/report_assets.py
index fa0ae7c..db24a11 100644
--- a/scripts/compliance-decryption/report_assets.py
+++ b/scripts/compliance/decryption/report_assets.py
@@ -8,7 +8,7 @@ def assets_source_dir() -> Path:
     Directory that stores static templates (css/js) for report generation.
 
     Layout:
-        scripts/compliance-decryption/
+        scripts/compliance/decryption/
             main.py
             assets/
                 report.css
diff --git a/scripts/compliance-decryption/utils.py b/scripts/compliance/decryption/utils.py
similarity index 100%
rename from scripts/compliance-decryption/utils.py
rename to scripts/compliance/decryption/utils.py
diff --git a/scripts/generate_compliance_keypair.py b/scripts/compliance/keypair.py
similarity index 98%
rename from scripts/generate_compliance_keypair.py
rename to scripts/compliance/keypair.py
index 73c6550..25b5221 100644
--- a/scripts/generate_compliance_keypair.py
+++ b/scripts/compliance/keypair.py
@@ -7,7 +7,7 @@ The private key should be stored offline on an air-gapped machine.
 Only the public key is provided to the messaging service via COMPLIANCE_PUBLIC_KEY env var.
 
 Usage:
-    python3 scripts/generate_compliance_keypair.py
+    python3 scripts/compliance/keypair.py
 
 Output:
     - Prints the keypair to console
@@ -129,7 +129,7 @@ CONFIGURATION:
     # Handle file saving
     if args.save:
         script_dir = Path(__file__).parent
-        project_root = script_dir.parent
+        project_root = script_dir.parent.parent
         output_file = project_root / "compliance_keypair.txt"
         
         full_output = f"""COMPLIANCE SYSTEM X25519 KEYPAIR
diff --git a/scripts/compliance/offline-python3.12.tar.gz b/scripts/compliance/offline-python3.12.tar.gz
new file mode 100644
index 0000000..4080799
Binary files /dev/null and b/scripts/compliance/offline-python3.12.tar.gz differ
diff --git a/scripts/generate:env.sh b/scripts/generate:env.sh
index 2fcd2de..9d88f0f 100755
--- a/scripts/generate:env.sh
+++ b/scripts/generate:env.sh
@@ -169,7 +169,7 @@ _do_backup_copy() {
 run_gen_compliance() {
   local tmp
   tmp="$(mktemp "${TMPDIR:-/tmp}/fromchat-compliance.XXXXXX")"
-  "$VENV_PY" scripts/generate_compliance_keypair.py --emit-key-lines </dev/null >"$tmp"
+  "$VENV_PY" scripts/compliance/keypair.py --emit-key-lines </dev/null >"$tmp"
   {
     IFS= read -r _COMPLIANCE_PRIVATE_B64
     IFS= read -r _COMPLIANCE_PUBLIC_B64