​

Trust Center evidence pack

​

What the pack is, and what it aggregates

• Audit ledger — the append-only chain that backs CC/controls counting. A generation replays the chain as a pre-check; a break raises the tamper-alert banner the recipient reads before any evidence row.
• SIEM sinks — the configured destinations (Splunk, Datadog, S3, an HTTPS drain). Aggregate sink counts enter the SOC 2 monitoring rows, never the destinations’ credentials.
• Audit export — the bounded, provable slices of the ledger, with chain verification and daily Merkle roots; the binder declares that integrity surface in its header summary.
• Archival export — the WORM-grade retained-record copies your retention policy produces; binder sections cite that posture rather than shipping raw records.
• DSAR queue — GDPR Art. 15 and Art. 17 rows count the queue’s status totals and medians.
• Privacy register (ROPA + DPIA) — supplies Art. 30 categories and Art. 35 DPIA posture for GDPR.

​

Which endpoints post-generation touches

​

Worked curl — frameworks, generate, poll

curl -X GET "https://api.orbit.devotel.com/api/v1/compliance/binder/frameworks" \
  -H "X-API-Key: dv_live_sk_..."

{
  "data": {
    "frameworks": [
      {
        "id": "soc2",
        "name": "SOC 2 (AICPA Trust Services Criteria)",
        "scope": "Vendor security questionnaires",
        "authority": "AICPA",
        "control_count": 9
      }
    ]
  }
}

curl -X POST "https://api.orbit.devotel.com/api/v1/compliance/binder/generate" \
  -H "X-API-Key: dv_live_sk_..." \
  -H "Content-Type: application/json" \
  -d '{"orgId": "org_...", "framework": "soc2", "format": "pdf"}'

{ "data": { "jobId": "binder_...", "status": "pending", "dedup": false } }

curl -X GET "https://api.orbit.devotel.com/api/v1/compliance/binder/binder_..." \
  -H "X-API-Key: dv_live_sk_..."

{
  "data": {
    "id": "binder_...",
    "organization_id": "org_...",
    "framework": "soc2",
    "format": "pdf",
    "status": "completed",
    "requested_by_user_id": "user_...",
    "requested_by_role": "owner",
    "download_url": "https://storage.googleapis.com/...?X-Goog-Signature=...",
    "download_object_key": "binder/org_.../binder_....pdf",
    "download_expires_at": "2026-09-22T14:00:00.000Z",
    "download_size_bytes": 1048576,
    "download_sha256": "9f8e7d6c5b4a...",
    "evidence_summary": { "audit_rows_replayed": 12543, "verified_chain_segments": 12 },
    "tamper_alert": false,
    "error_message": null,
    "attempt_count": 1,
    "started_at": "2026-09-21T13:59:55.112Z",
    "completed_at": "2026-09-21T14:00:01.641Z",
    "created_at": "2026-09-21T13:59:55.102Z",
    "updated_at": "2026-09-21T14:00:01.641Z"
  }
}

​

Schema of a completed job — which fields proved what

• Encryption-at-rest — the binder narrative states Google-managed AES-256 encryption across Cloud SQL and Cloud Storage as a platform-fixed posture, identical across workspaces, with envelope encryption over sensitive application fields; the workspace-derived rows count your API keys and contact aggregates over it, not the key material.
• BYOK status — customer-managed encryption keys register against your own KMS as a separate setting; the binder states which posture your org adopted, verbatim from the platform narrative, not from whatever a ticket thread negotiated.
• HIPAA BAA hook — the HIPAA binder reads hipaa_enabled, baa_signed_at, and retention_days straight out of organizations.settings.hipaa at generation time; the BAA execution date you set in Settings → Compliance → HIPAA is the same ISO date it shows.

​

Forwarding checklist — getting the packaged artifact to the assessor

1. Pull the file inside the signed window. Complete the generation, then pull download_url within its 24-hour signed envelope. The recipient ends up holding the document itself, free of the expiry.
2. Attach, do not link. Deliver the PDF (or ZIP contents) over whatever channel the assessor provisions — questionnaire portal, GRC import, email with attachment — and include the recorded download_sha256 in the covering note or the questionnaire’s notes field.
3. Verify at the boundary. Re-hash the copy you are about to forward (sha256sum, or Get-FileHash -Algorithm SHA256 on Windows) against the download_sha256 recorded at generation. A mismatch means the file moved; do not forward it.
4. Tag the shelf with its own retention. Add each completed binder to the organization shelf you already keep for procurements — the file name, its SHA-256, and the generation timestamp (created_at) make the packet searchable later without reading the file.
5. Expire on your own schedule. Deleting the shelf entry is a retention-policy call your organization makes after the procurement closes; the binder’s download_expires_at field expires only the URL lease, never your shelf. If a procurement asks for history, a ZIP of past generations is still enumerated under GET /api/v1/compliance/binder?page=....

​

Evidence vs promise — what the Trust Center requests

• Open evidence — published for anyone, no form. The subprocessor register, the data-residency disclosure, and the SOC 2 control-mapping table. Point your buyer at these first; most security questionnaires clear a third of their rows from the open sections alone.
• Gated evidence — issued under NDA after an access review. The counter-signed DPA, answered security questionnaires (CAIQ, SIG-Lite), the penetration-test summary, and certifications where available. The Request the trust pack form at the bottom of the Trust Center is the intake for exactly these items: full name, work email, optional company — the trust desk replies to that email with the access link, typically within one business day. The email handles only that reply; there is no marketing list behind it.

​

Per-framework checklist — what to pre-build

• SOC 2 — the default for North-American SaaS procurement. The pack walks the AICPA Common Criteria CC1.0–CC9.0 and pairs each section’s platform policy narrative with evidence rows counted from your audit chain.
• ISO 27001 — the default for European and enterprise buyers, and for certification-driven asks. The pack covers Annex-A categories plus the individually numbered clauses procurement teams ask about most. Platform-fixed rows (hosting region, encryption posture, hosting attestation) look identical across every workspace; workspace-derived rows (API key counts, contact-record aggregates) come from your tenant at generation time.
• GDPR — for supervisory authorities, DPOs, and privacy teams. The pack maps the articles those reviews ask about: lawful basis (Art. 6), access and erasure (Art. 15/17), sub-processors (Art. 28), records of processing (Art. 30), security (Art. 32), breach notification (Art. 33), and DPIA posture (Art. 35).
• HIPAA — for healthcare buyers. The pack reads back whatever you set under Settings → Compliance → HIPAA: HIPAA mode, BAA execution date, the Security Officer contact, your retention window, and PHI access events. Bring those settings current before you generate — the pack states what you configured, verbatim.

​

Refresh cadence and the 24-hour signed link

• SOC 2 — regenerate quarterly, aligned to your internal access-review cadence, and again on the day a live procurement review opens.
• ISO 27001 — quarterly. Platform-fixed rows change only on a platform change; the move-detection rule below tells you when one happened.
• GDPR — monthly when you run an active DSAR queue, so the Art. 15/17 status counts and completion medians reflect current posture; otherwise quarterly.
• HIPAA — regenerate the same day any HIPAA settings value changes (BAA execution, retention window, Security Officer); the pack reads those values back as-of generation.

​

Procurement sequence — generate, hand, verify

1. Generate. Open Settings → Compliance → Binder, pick the framework, choose PDF for a human packet or ZIP for a GRC import, and select Generate. The dashboard shows the job move from Pending → Generating → Completed; repeated clicks re-show the in-flight job instead of queueing a duplicate.
2. Record the checksum first. Open the completed job and copy download_sha256 (also returned by the status endpoint over the API). Store it where your procurement case file lives — a deal-room note, the questionnaire’s notes field, a GRC ticket. Deterministic output is what makes this checksum meaningful: two generations over unchanged data are byte-identical.
3. Download and hand the file. Deliver the PDF or ZIP itself within the 24-hour link window; the recipient now holds the document independently of link expiry.
4. Verify by checksum equality. The recipient re-hashes the file (sha256sum on Linux/macOS, Get-FileHash -Algorithm SHA256 on Windows) and compares it against the download_sha256 you recorded. Equality proves the document they received is the document you generated — no content review loop needed.
5. Detect scope drift between generations. Regenerate on your cadence and compare the new checksum against the stored one. An equal checksum across the shelf means nothing changed — for ISO binders whose platform-fixed rows dominate, that means no relevant platform change; a changed checksum means a workspace-derived row moved, and a ZIP diff narrows it to the exact control file.
6. Handle a tamper banner before anything ships. If a generation completed with a tamper-alert banner (the audit-chain replay flagged an issue), hold the binder internally and follow the binder runbook before routing it to anyone external.

​

Boundary — the binder reflects what you configured

• The binder is a mirror, not an inventory. It reflects what you configured and what your workspace produced. HIPAA mode left off renders as HIPAA mode: off. A BAA date never set renders as unset. If your shelf misleads, the fix is in the source settings, not the document.
• An empty register exports an empty binder. The same boundary holds across the evidence family: a SIEM sink with no configured destinations streams nothing; an archival export policy disabled by default archives nothing until you opt in; a privacy register with no entries yields empty GDPR Art. 30 rows. Configure the register first, then generate — a shelf of empty binders decays into expired links anyway.

​

Related

• Evidence binder — the generator this page sequences; framework scope, formats, tamper flags, and worked examples
• Audit log export — bounded, provable slices of the audit ledger with chain verification and daily Merkle roots
• Immutable archival export — WORM-grade copies of retained records for books-and-records obligations
• SIEM sinks — continuous audit delivery to Splunk, Datadog, S3, or an HTTPS drain
• HIPAA onboarding — the order to bring HIPAA settings current before generating the HIPAA pack