Compliance evidence bundle

When an auditor asks how you govern your AI agents, the evidence bundle is the answer: a one-click zip, assembled live from your control plane, that an auditor can verify offline without an AxioRank account. Every artifact is mapped to SOC 2 (Trust Services Criteria) and ISO/IEC 27001:2022 Annex A controls in the bundled CONTROLS.md.

The bundle is a point-in-time snapshot. Activity counts cover the trailing 90 days; the integrity artifacts cover the audit ledger's entire checkpoint history. Everything in it is already redacted and safe to leave the platform: the governance config carries no secrets, and the ledger artifacts are signatures and hashes.

Generate it

Download it from Dashboard → Zero Trust Maturity (/maturity) or Dashboard → Audit Integrity (/integrity), or hit the route directly:

GET /api/compliance/evidence-bundle

This is a dashboard route authenticated by your signed-in session (it is a download link, not an API-key endpoint). The response is application/zip, named axiorank-evidence-YYYY-MM-DD.zip from the generation date.

Contents

Verify offline

The integrity/ artifacts are designed so an auditor needs nothing but the published public key:

1. Signature: the signed tree head's Ed25519 signature verifies against a key in integrity/jwks.json. Pin the JWKS out of band (or refetch it from /api/v1/audit/public-key) so verification does not trust the bundle itself.
2. Chain: each entry in integrity/checkpoints.json links to the previous via prevHash, so any altered, deleted, inserted, or reordered row breaks the chain from that point forward.
3. Per-row proof: any individual audit row can be proven with a verifiable receipt against the tree head in this bundle.

The open-source verifier runs entirely offline:

npm install @axiorank/audit-verify

import { verifyReceipt } from "@axiorank/audit-verify";

const result = verifyReceipt(receipt, jwks); // jwks pinned out of band
console.log(result.ok, result.checks); // leaf, inclusion, sthSignature, provenance

pip install "axiorank[verify]"

from axiorank import verify_receipt

assert verify_receipt(receipt, jwks) is True

The bundled VERIFY.md walks your auditor through the same steps, so they can verify without ever reading these docs.

Use cases

• Auditor handoff: drop one zip into the evidence request portal instead of screenshotting a dozen dashboards.
• Quarterly access review: access/access-review.json is a member, role, MFA, and SSO snapshot you can archive and sign off each quarter.
• Vendor questionnaires: the scorecard and control mapping answer most "how do you govern agent actions?" questions verbatim.

Next steps

• Audit integrity: how sealing, tree heads, and receipts work.
• Config as code: the export behind governance/config.json.
• Privacy & data rights: the retention policy the bundle reports.