Skip to main content

Generate compliance reports for SOC 2, HIPAA, and similar

Surfaces used: dashboard compliance reports + audit retention Modes supported: Hosted Hybrid Tiers: Solo (basic) Teams (full retention + export)

What you'll do​

Configure retention, pick a report template (SOC 2 CC-style, HIPAA-style, or custom), set a date range, and generate a packaged report containing the activity summary, policy inventory, incident log, and raw audit export. Hand to your auditor.

Why this is the right path for you​

  • If an auditor has asked "how do you control AI use of customer data?" and you need a document, not a conversation, this is the fastest path.
  • The complete audit trail records every decision and its event-level coverage. It distinguishes did not run from ran and found nothing, giving an auditor evidence that a control executed rather than an unexplained absence of findings.
  • If you do not yet have enforcement deployed, start there: gateway, browser extension, coding hooks, or an SDK.

When NOT to use this approach​

caution

If you need a SOC 2 Type II report of Control Zero itself (the product), that is a separate artifact. Contact us. This use case is about generating a report of your AI activity, governed by Control Zero.

5-minute setup​

  1. Dashboard -> Settings -> Retention. Set your retention window:
    • Solo: 30 days default, configurable up to 90.
    • Teams: 365 days. Longer on request.
  2. Dashboard -> Compliance -> New report. Pick:
    • Template: SOC 2-style, HIPAA-style, or Custom.
    • Date range.
    • Scope: all projects or selected.
  3. Click Generate. The report builds in seconds to minutes depending on volume, and produces:
    • A signed PDF summary (controls, counts, top rules, top denies, top users).
    • A CSV of every audit event in the range.
    • A JSON manifest with a hash of each artifact for tamper-evidence.
  4. Click Download or Share via signed link to hand to your auditor.

Verifying it's working​

  1. Open the generated PDF. The summary page should list:

    • Total requests governed in the window.
    • Breakdown by surface (gateway, hooks, extension, SDK).
    • Policy inventory with publish dates.
    • Top-10 deny reasons.
    • Incident log (any tamper alerts, quarantine events).

  2. Spot-check the CSV: count of rows should match the summary.

  3. Verify the manifest hash:

    sha256sum compliance-report-2026-Q2.pdf
    # Compare to the hash printed in the manifest.json

Common follow-ups​

  • "I need longer retention" -> Contact us for extended retention on Teams.
  • "I need to export events to my SIEM" -> pull the audit trail as ArcSight CEF or RFC 5424 syslog from the export endpoint, the formats Splunk, ArcSight, and QRadar ingest directly. Alert channels also ship individual events by webhook.
  • "I want a dashboard of ongoing posture" -> Analytics, Coverage.
  • "I need self-hosted retention" -> Self-Hosted.

Reference​