Compliance Tools
Generate auditor-grade compliance reports in HTML, Markdown, or PDF format. Each report follows the standard structure for its framework, with configurable redaction levels for different audiences.
Report structure
Every report includes these sections:
| Section | Content |
|---|---|
| Cover Page | Organisation name, report title, period, date, classification, document ID |
| Executive Summary | Overall posture score, key findings, controls assessed vs compliant |
| Scope | Systems assessed, time period, methodology, exclusions |
| Findings | Per-control: status, evidence count, details, recommendations |
| Appendix A: Evidence | Sampled evidence items (redacted for external reports) |
| Appendix B: Attestation | Management sign-off template with signature fields |
| Appendix C: Glossary | Definitions of AEE, AOCL, VOLT, WARD, HITL |
Supported frameworks
- SOC 2 Type II — Trust Services Criteria (CC6, CC7, CC8, PI, A1, A1.2/A1.3) + scope, attestation, type guidance
- ISO 27001:2022 — 93 Annex A controls with SoA reference
- GDPR — Article-by-article compliance with ROPA guidance, DSAR procedures (Art.15-21), Art.28 processor assessment
- HIPAA — Security Rule safeguards (Administrative, Physical, Technical) + BAA assessment + addressable guidance
- EU AI Act — Risk classification with Annex III/IV mapping, operator matrix, GPAI obligations, Art.17 QMS, classification memo
- ISO/IEC 42001:2023 — AI Management System (Clauses 4-10) + AI System Lifecycle Record
- NIST AI RMF 1.0 — Govern/Map/Measure/Manage with AI system profile and cross-framework mappings
Reports include 18+ helper sections beyond core findings: scope, attestation, typeGuidance, incidentResponse, dataSubjectRights, processorAssessment, legalBasisGuidance, ropaGuidance, internationalTransferAssessment, baaAssessment, addressableGuidance, operatorMatrix, gpaiObligations, universalObligations, qmsRequirements, classificationMemoTemplate, aiSystemLifecycleRecordGuidance, aiSystemProfile, crossReferences.
Redaction levels
Reports can be generated at three confidentiality levels:
| Level | What's included | Use case |
|---|---|---|
| Internal | Full detail, all evidence, no redaction | Internal review, management reporting |
| External | Secrets stripped, IPs redacted, evidence limited to 3 samples per control | Sharing with auditors, regulators |
| Public | Executive summary only, no evidence samples | Website, marketing, investor updates |
The redaction engine automatically strips:
- API keys (
sk-...) - Bearer tokens
- Passwords and secrets
- Internal IP addresses (10.x, 172.16-31.x, 192.168.x)
Export formats
- HTML — in-app preview with print-optimised CSS. Use your browser's Print → Save as PDF for immediate PDF output
- Markdown — portable, version-controllable text format
- JSON — structured data for integration with other systems
Document metadata
Every report carries:
- Document ID — unique identifier (e.g., RPT-SOC2-2026-04-a3f7)
- Version — for tracking revisions
- Classification — CONFIDENTIAL by default, configurable
- Generated timestamp — when the report was created
Frequently asked questions
What sections does every compliance report include?
Cover Page, Executive Summary, Scope, Findings, Appendix A: Evidence, Appendix B: Attestation, and Appendix C: Glossary.
What's the difference between the three redaction levels?
Internal gives full detail and all evidence, with no redaction, for internal review and management reporting. External strips secrets, redacts IPs, and limits evidence to 3 samples per control, for sharing with auditors and regulators. Public gives an executive summary only, with no evidence samples, for website, marketing, or investor updates.
How do we actually get a PDF out of this?
Generate the report in HTML, which gives an in-app preview with print-optimised CSS, then use your browser's Print function to save as PDF. Markdown and JSON are also available as export formats.
Which compliance frameworks can we generate reports for?
SOC 2 Type II, ISO 27001:2022, GDPR, HIPAA, EU AI Act, ISO/IEC 42001:2023, and NIST AI RMF 1.0.
Glossary
| Term | Definition |
|---|---|
| Redaction | Removing sensitive information from a report before sharing |
| Working Papers | The auditor's supporting documentation for their opinion |
| CUECs | Complementary User Entity Controls — controls the customer must implement |
| IPE | Information Produced by Entity — system-generated evidence that auditors must verify |