Skip to content

Docs

Enterprise

Compliance evidence

Produce the evidence an auditor asks for, on demand: a point-in-time access review of who can do what, signed off by a named reviewer, and a downloadable evidence pack for SOC 2, ISO 27001, HIPAA or PCI. Everything is gathered from data you already have — no separate bookkeeping.

Access reviews

Generate review freezes an immutable snapshot of every member and their effective access: role, effective permissions and high-risk capabilities, MFA status, last sign-in, and active just-in-time grants.

  • The snapshot is immutable — it's the auditable record of exactly what access existed at that moment.
  • Attest it to record a named sign-off (who reviewed it, when, with an optional note) — the evidence that a human reviewed access.
  • Export CSV of the members × access table.

Evidence pack

Pick a framework and a date range and export a single ZIP an auditor can open and cross-check. Open index.html for readable report pages — a cover with the integrity proof and a per-framework control-coverage map — with the machine-readable source kept alongside under raw/:

index.html             start here — cover, control coverage, links
access-review.html     members × effective access
activity-log.html      the audit log for the period (with seq + sealed)
sessions.html          SSH + database session inventory
access-grants.html     active just-in-time grants
configuration.html     guardrail rules + RBAC roles
raw/                   the same data as CSV / JSON (manifest, integrity proof)
README.txt             what each file is
The manifest carries an integrity proof: the result of verifying the tamper-evident audit chain (see Tamper-evident audit) plus the head hash — so the exported activity log is provably the real, unaltered one. The framework you pick frames the manifest/README; the underlying evidence is shared (the frameworks overlap on access-control and audit controls).

Permissions

compliance.read compliance.manage

compliance.read views and exports reviews + packs; compliance.manage generates and attests reviews. Both are owner/admin-level.