Console Guides

Compliance

GDPR self-service export/erasure, on-demand SOC 2 / ISO 27001 access review reports, a GDPR Article 30 data processing record generator, and a compliance status overview — all scoped to your organization.

Find it

Compliance is in the sidebar under the Operations group. Only org owners and admins can load it.

Compliance page with Export Report button, Status and GDPR cards, Data processing record and Access review report generators with date pickers, and a Security event log card
Status and Security event log are empty here — see the note below on why
  1. Opens a modal to generate a broader compliance export report for the organization.
  2. Meant to list per-control status rows (SOC 2 controls, GDPR articles) for the org. On this build it reads "No compliance status items were included in the summary response" — see the note below.
  3. Export my data downloads a JSON dump of the signed-in user's own account data; Erase my data requests permanent erasure of it (with a confirmation dialog first) — both call the platform-wide /api/users/me/* endpoints, not anything project-scoped.
  4. Pick a record date (defaults to today, UTC) and click Generate record to download a GDPR Article 30 "processing activities" record for the organization as a JSON file — this is a real, working generator, not a stub.
  5. Pick a start and end date (defaults to the trailing 3 months) and click Generate access review to download a report listing the org's users and API keys as of that period — useful evidence for a SOC 2 or ISO 27001 access-review control.
  6. Meant to list recent security-relevant events (failed logins, permission changes, etc.) pulled from the same summary response as Status above. Reads "No security events were included in the compliance summary" here — see the note below.
Warning
Status and Security event log render empty on every organization in this build, not just this test project — a real, current data-shape mismatch, not a seeding gap. The summary endpoint (GET /api/compliance/summary, backed by complianceService.generateComplianceSummary) returns evidence-file counts nested as data.controls.soc2 / data.controls.gdpr objects and a data.evidenceCounts.securityEventLogs count (or null) — the console's parser instead looks for a top-level status array, or nested objects at data.soc2 / data.gdpr / data.security.events directly. Neither shape lines up with what the API actually returns, so both cards fall through to their empty state regardless of what compliance evidence actually exists for the org. The data processing record and access review generators above are unaffected — they call separate endpoints and work correctly.