> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance evidence binder

> Generate a one-click evidence pack for SOC 2, ISO 27001, GDPR, or HIPAA — a signed, download-ready binder your auditor or a buyer's procurement team can read directly.

# Compliance evidence binder

The evidence binder turns the compliance data your workspace already produces — audit logs, access reviews, consent records, retention settings, breach counts — into a single evidence pack mapped to a public framework, with one download to hand to an auditor or a buyer's security review.

Pick a framework, generate, download. Four frameworks are supported:

| Framework                                 | Typical ask                                                                |
| ----------------------------------------- | -------------------------------------------------------------------------- |
| **SOC 2** (AICPA Trust Services Criteria) | Vendor security questionnaires and SOC 2 readinesss reviews                |
| **ISO 27001**                             | Annex-A control evidence for certification or contractual attestations     |
| **GDPR**                                  | Data-subject request history, breach counts, consent and retention posture |
| **HIPAA**                                 | PHI access logging, BAA posture, configured retention                      |

Every generation is recorded in your audit log, only the workspace's owner or admin roles can generate one, and the download is a signed link that expires after 24 hours.

## Generate a binder from the dashboard

1. Open **Settings → Compliance → Binder**.
2. Choose the framework and the output format — a rendered **PDF** for humans, or a **ZIP** of per-control files for importing into a GRC tool.
3. Select **Generate**. Generation runs in the background; the page shows the job move from *Pending* → *Generating* → *Completed*.
4. When it completes, use the **Download** link on the job row. The link is valid for 24 hours; if it lapses until expiry, generate again or open the job to see a fresh link.

If a request is already in flight for the same framework, the dashboard shows that job again instead of queueing a duplicate — repeated clicks are safe.

If the platform's audit integrity check flagged anything while building the pack, the binder opens with a **tamper-alert banner** at the top. Treat a tamper-flagged binder as a signal to investigate before handing it to anyone external.

## Generate from the API

```bash theme={null}
curl -X POST https://api.orbit.devotel.com/api/v1/compliance/binder/generate \
  -H "X-API-Key: dv_live_sk_..." \
  -H "Content-Type: application/json" \
  -d '{"orgId": "org_...", "framework": "soc2", "format": "pdf"}'
```

The response is `202` with a job id:

```json theme={null}
{
  "data": { "jobId": "binder_...", "status": "pending", "dedup": false }
}
```

Poll the job until it completes:

```bash theme={null}
curl https://api.orbit.devotel.com/api/v1/compliance/binder/binder_... \
  -H "X-API-Key: dv_live_sk_..."
```

A completed job carries `download_url` (24-hour signed link), `download_sha256` for file verification, `download_size_bytes`, and `tamper_alert`. List past generations with `GET /api/v1/compliance/binder?page=1`. The framework catalogue (names, scope text, control counts) is at `GET /api/v1/compliance/binder/frameworks`.

| Endpoint                                   | Purpose                               |
| ------------------------------------------ | ------------------------------------- |
| `GET /api/v1/compliance/binder/frameworks` | Framework catalogue for the chooser   |
| `POST /api/v1/compliance/binder/generate`  | Queue a generation (`202`)            |
| `GET /api/v1/compliance/binder/:jobId`     | Status, signed download URL, checksum |
| `GET /api/v1/compliance/binder?page=`      | Generation history                    |

## What the pack contains

The pack renders the framework's control matrix, section by section:

* **Static narrative** per control — the policy Orbit follows for that control, stated once.
* **Tenant evidence rows** per control — aggregate counts and posture from your workspace (for example audit-log volume, team role distribution, breach-incident counts, configured retention).
* **Integrity summary** — how many audit-chain rows were checked and whether the chain verified; a break turns into the tamper banner.

Evidence is redacted by construction: aggregate counts and hashed references only, never phone numbers, email addresses, customer names, message bodies, API keys, or webhook secrets. A binder is safe to forward to a buyer's procurement team.

Two generations over the same data produce byte-identical output, and completed packs carry a SHA-256 checksum — so an auditor can verify the file they received is the file you generated, and a re-generation months later is comparable line-for-line.

## Auditing and access control

* Generation requires the workspace **owner** or **admin** role; API keys follow the same role gate.
* Every generation writes a `compliance.binder_generated` entry to your audit log with the framework, format, and requesting role; completion writes a second entry.
* Failed generations land in the history with an error message instead of silently disappearing.

## Related

* [Compliance plugin marketplace](/compliance/plugin-marketplace) — browse evidence packs and activation bundles in one place
* [Legal](/legal/index)