> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blindsight.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance & reports

> Generate auditor‑ready reports against SOC 2, ISO 27001, HIPAA, and GDPR. Tailor depth and format, ship via shareable link or PDF, and standardize with templates.

Compliance Mode turns Blindsight's scan findings and activity logs into
auditor‑ready reports. The Compliance page (`/compliance`) is also
your at‑a‑glance view of workspace posture. The feature is gated
behind the `FEATURE_COMPLIANCE_REPORTS` license flag (see
[Settings & licensing](/data-integrity/settings)).

## What the Compliance page shows

When you open `/compliance` you get four panels:

| Panel                 | What it shows                                                                                          |
| --------------------- | ------------------------------------------------------------------------------------------------------ |
| **Posture overview**  | Counts of `HEALTHY` / `UNHEALTHY-` / `UNHEALTHY+` / `CRITICAL` across all datasets.                    |
| **Attention queue**   | Datasets that need review: flagged issues, failing scans, missing reports.                             |
| **Activity timeline** | Every compliance‑relevant action, time‑filtered: uploads, scans, healing, deletes, permission changes. |
| **KPIs**              | Total datasets, active scans, failed scans, critical changes, total reports.                           |

## Supported standards

You can generate reports tailored to four standards. Each one ships
with the right cover page, the right framing of controls, and a
mapping from Blindsight concepts to that standard's vocabulary.

| Standard      | Code       | Focus                                                        |
| ------------- | ---------- | ------------------------------------------------------------ |
| **SOC 2**     | `soc2`     | Controls, change management, access, monitoring.             |
| **ISO 27001** | `iso27001` | Information security management.                             |
| **HIPAA**     | `hipaa`    | Protected health information handling.                       |
| **GDPR**      | `gdpr`     | Personal data handling, right to erasure, data minimization. |

## Report depth and format

Each report can be generated at one of three depths and in one of
four formats.

| Depth          | Best for                                                           |
| -------------- | ------------------------------------------------------------------ |
| **Summary**    | Executive one‑pager with KPIs and severity rollups.                |
| **Detailed**   | Per‑dataset breakdowns, scan history, remediation actions.         |
| **Exhaustive** | Full per‑finding audit trail, parameter snapshots, lineage graphs. |

| Format   | Use it for                                               |
| -------- | -------------------------------------------------------- |
| **PDF**  | Auditor‑facing. Includes charts and a styled cover page. |
| **HTML** | Shareable link, lightweight, mobile‑friendly.            |
| **JSON** | Pipelines, downstream processing.                        |
| **ZIP**  | Bundle: PDF + raw data + artifacts + per‑finding CSVs.   |

## Generating a report

<Steps>
  <Step title="Pick a scope">
    Single dataset, single project, or the entire workspace. The
    smaller the scope, the faster the build.
  </Step>

  <Step title="Pick standard, depth, format">
    SOC 2 / ISO 27001 / HIPAA / GDPR × Summary / Detailed / Exhaustive
    × PDF / HTML / JSON / ZIP.
  </Step>

  <Step title="Set a time window">
    Activity, scans, and healings inside this window appear in the
    report. Pick a quarter for a quarterly review, or the whole
    workspace lifetime for a first‑time audit.
  </Step>

  <Step title="Generate">
    The report is queued. You get a notification when it's ready.
    Generated reports appear under **Reports** with a download link
    and a preview.
  </Step>
</Steps>

<Tip>
  Use the **Summary** depth for quick weekly check‑ins, **Detailed**
  for monthly reviews, and **Exhaustive** when an auditor asks for
  source material.
</Tip>

## Dataset lineage in reports

Every compliance report includes the dataset lineage graph for every
dataset in scope. Auditors typically ask "where did this training
corpus come from?", lineage is the single answer.

## Reports page (`/reports`)

The reports list shows every generated report with:

* Scope, standard, depth, format.
* Who generated it and when.
* A download link.
* A **preview** for HTML and PDF reports.
* Optional auto‑purge after a retention window (configured under
  **Settings → General**).

You can also produce **ad‑hoc** and **project‑level** reports from
this page, not just compliance ones.

## Report templates (`/reports/templates`)

Templates standardize how reports look across the team. A workspace
template covers the whole tenant; a project‑level template can
override it for one project.

You can edit:

| Section        | What you control                                                             |
| -------------- | ---------------------------------------------------------------------------- |
| **Cover page** | Logo, title, subtitle, prepared‑by name.                                     |
| **Sections**   | Include or exclude KPIs, findings, methodology, appendix, executive summary. |
| **Branding**   | Logo upload, accent color, footer text.                                      |
| **Filters**    | Which datasets, scans, or severities to include by default.                  |
| **Layout**     | Reorder and toggle visibility of each block.                                 |

Mark a project‑level template as **default** so every new report in
that project starts from it.

## Export templates (raw data)

Separate from report templates, **export templates** let you define
reusable CSV / JSON exports of scan results: which columns, which
filter, which sorting. Use the editor under
**Settings → Export templates** and apply them from any scan's
**Export** menu.

Export templates are gated behind `FEATURE_ADVANCED_EXPORTS`.

## Sharing

* Every generated report has a stable download link.
* HTML reports can be opened from a shareable link by anyone with the
  link. Treat the link like a secret; rotate by regenerating.
* Compliance reports include a **content preview JSON** so you can
  confirm contents before sharing.

## Common workflows

<AccordionGroup>
  <Accordion title="Prep for a SOC 2 audit">
    1. Make sure every dataset in scope is in a single project.
    2. Generate a **SOC 2 / Detailed / PDF** report scoped to that
       project, time window covering the audit period.
    3. Generate an additional **SOC 2 / Exhaustive / ZIP** as source
       material in case the auditor asks.
  </Accordion>

  <Accordion title="Weekly internal review">
    1. Generate a **Summary / HTML** at workspace scope every Monday
       (via a [scheduled report](/data-integrity/automation)).
    2. Share the link in your weekly channel.
  </Accordion>

  <Accordion title="Hand off a model to QA">
    1. Generate an **ad‑hoc / Detailed / PDF** report scoped to the
       training dataset.
    2. Attach it to the model card.
  </Accordion>
</AccordionGroup>