Compliance evidence exports

Definite's audit trail — signed receipts, the per-tenant Merkle ledger, policy version snapshots, checkpoint chains, and signing-key history — can be assembled into a signed evidence pack mapped to a named compliance framework. Auditors get one ZIP whose crosswalk tells them which file addresses which control.

What an evidence pack contains

Each export is a deterministic, byte-reproducible ZIP assembled for one tenant, one framework, and one time window:

manifest.json            signed export metadata
events/YYYY-MM-DD.jsonl  ledger events, one file per UTC day
policy_snapshots/        the versioned policies in force during the window
checkpoint_chain.jsonl   the Merkle checkpoint sequence
key_history.json         signing-key lifecycle for signature chain-of-custody
event_proof_index.jsonl  per-event Merkle inclusion index
framework_mapping.json   the control-to-evidence crosswalk for the framework
signatures.json          the signature over the manifest

Re-running the same export parameters reproduces the same bytes, so an auditor can verify reproducibility independently. Events carry hashes and identifiers, not raw sensitive values.

Available framework mappings

Evidence packs are assembled by Definite operators on request. Framework mappings currently ship for:

Field	Type	Required	Description
SOX-for-AI (ITGC) and SOX §302/§906	US	sox_ai, sox_extended	IT general controls over signing keys, change management, audit-trail completeness; officer attestation coverage.
SEC Rule 17a-4(f) / FINRA 17a-4 & 4511	US	sec_17a4f, finra_17a4	Electronic records retention: non-rewriteable storage, serialized indexing, audit system.
OCC 2011-12 / Fed SR 11-7	US	occ_sr_11_7	Model risk management: governance, monitoring, validation evidence.
OSFI E-23	CA	osfi_e23	Model risk management for Canadian FRFIs.
GDPR and CCPA/CPRA	EU / US-CA	gdpr, ccpa	Integrity, accountability, records of processing, and data-subject request evidence.
EU AI Act	EU	eu_ai_act_article_12, eu_ai_act_extended	Article 12 automatic logging plus Articles 13-16 transparency and oversight evidence.
ISO/IEC 42001:2023	ISO	iso_42001, iso_42001_extended	AI management system clauses 5-10.
NIST AI RMF 1.0	US	nist_ai_rmf	GOVERN / MAP / MEASURE / MANAGE functions mapped to ledger evidence.
HIPAA (partial)	US	hipaa_partial	Technical safeguards and retention evidence.
Additional AI-governance frameworks	Global	aiuc1, oecd_ai_principles, unesco_ai_ethics, singapore_imda_mgf, australia_ai_ethics, brazil_pl_2338, canada_aida, colorado_sb_205, nyc_ll144, ftc_section_5	Retained mappings for AI-governance and consumer-protection regimes.

Each framework_mapping.json is honest about coverage: controls resolve to a shipped evidence type or are labelled with the gap. Where a control needs records Definite does not produce for your tenant, the mapping says so rather than implying coverage.

How to request one

Evidence-pack assembly is an operator action, not tenant self-service: contact Definite with the framework, tenant, and time window, and you receive the signed ZIP plus its manifest hash out of band. Day-to-day audit needs are usually better served by the self-service surfaces: receipts, ledger proofs, and SIEM export for continuous delivery into your own retention systems.