Skip to main content

​
Compliance evidence binder

The evidence binder turns the compliance data your workspace already produces — audit logs, access reviews, consent records, retention settings, breach counts — into a single evidence pack mapped to a public framework, with one download to hand to an auditor or a buyer’s security review. Pick a framework, generate, download. Four frameworks are supported: Every generation is recorded in your audit log, only the workspace’s owner or admin roles can generate one, and the download is a signed link that expires after 24 hours.

​
Generate a binder from the dashboard

  1. Open Settings → Compliance → Binder.
  2. Choose the framework and the output format — a rendered PDF for humans, or a ZIP of per-control files for importing into a GRC tool.
  3. Select Generate. Generation runs in the background; the page shows the job move from Pending → Generating → Completed.
  4. When it completes, use the Download link on the job row. The link is valid for 24 hours; if it lapses until expiry, generate again or open the job to see a fresh link.
If a request is already in flight for the same framework, the dashboard shows that job again instead of queueing a duplicate — repeated clicks are safe. If the platform’s audit integrity check flagged anything while building the pack, the binder opens with a tamper-alert banner at the top. Treat a tamper-flagged binder as a signal to investigate before handing it to anyone external.

​
Generate from the API

The response is 202 with a job id:
Poll the job until it completes:
A completed job carries download_url (24-hour signed link), download_sha256 for file verification, download_size_bytes, and tamper_alert. List past generations with GET /api/v1/compliance/binder?page=1. The framework catalogue (names, scope text, control counts) is at GET /api/v1/compliance/binder/frameworks.

​
What the pack contains

The pack renders the framework’s control matrix, section by section:
  • Static narrative per control — the policy Orbit follows for that control, stated once.
  • Tenant evidence rows per control — aggregate counts and posture from your workspace (for example audit-log volume, team role distribution, breach-incident counts, configured retention).
  • Integrity summary — how many audit-chain rows were checked and whether the chain verified; a break turns into the tamper banner.
Evidence is redacted by construction: aggregate counts and hashed references only, never phone numbers, email addresses, customer names, message bodies, API keys, or webhook secrets. A binder is safe to forward to a buyer’s procurement team. Two generations over the same data produce byte-identical output, and completed packs carry a SHA-256 checksum — so an auditor can verify the file they received is the file you generated, and a re-generation months later is comparable line-for-line.

​
Auditing and access control

  • Generation requires the workspace owner or admin role; API keys follow the same role gate.
  • Every generation writes a compliance.binder_generated entry to your audit log with the framework, format, and requesting role; completion writes a second entry.
  • Failed generations land in the history with an error message instead of silently disappearing.