Compliance evidence export

Choose an export based on the question the recipient needs to answer. One session may explain a decision; a broader review may need evidence from several applications.

Available actions depend on your role and the scope you can access. Start with the export guide for portal instructions.

Choose the scope

Review need	Starting point	Check before sharing
One recorded decision	Session evidence export	Session ID, application, decision, and included integrity records
Several applications	Scoped application evidence pack	Selected applications and any framework restriction
An auditor engagement	Evidence available within the engagement	Recipient access, assigned scope, and included records
A data subject	Subject-scoped evidence workflow	Subject identity, authorized purpose, and sensitive contents

The application export dialog can receive a framework scope from the workflow that opened it. It shows the selected applications before download. Check that summary rather than assuming every visible record or page filter will be included.

Review the export request

Confirm the application or engagement first. Then check the selected evidence and any stated period or framework restriction.

Scoped application exports use the latest available compliance evidence. Do not describe a package as a historical snapshot unless its contents support that description.

Where a cover-note draft is available, review its claims against the evidence before including it. A generated note is not an approval or a completeness check.

An export can contain framework-scoped evidence without satisfying every requirement of that framework. The responsible reviewers determine whether the package is sufficient.

Check the downloaded package

Open the package before sending it. Confirm:

The application and session identifiers match the request.
The contents support the period and scope described to the recipient.
Missing evidence, unevaluated rules, and unresolved findings remain visible.
Attachments and sensitive fields are appropriate for the recipient.
Integrity material identifies the selected proof provider and its verification result.

A completed download confirms file delivery, not evidence completeness. If preparation or download fails, resolve that result before treating the export as available.

Attachments and screen captures

Session evidence PDFs can render supported PNG and JPEG attachments. The attachment manifest records the file hash, masking status, step association, and export handling.

Bounded originals are embedded when export policy permits. Other media receives a scoped retrieval reference and an explanation in the PDF.

Inspect the manifest as well as the image. A screen capture provides visual context; it does not, by itself, prove that a business action completed. See computer-use evidence for capture and outcome-verification guidance.

Verify integrity separately

Use the package’s Solana or Azure SQL Ledger information to check its integrity through the supported verification workflow. Keep the verification result with the package. A recorded anchor status alone is not independent verification.

Integrity checks can detect changes to protected evidence. They do not establish that the original inputs were true or that a decision met a legal requirement.

Prepare the handoff

Add the policies, system descriptions, incident records, or other materials required for the review. Explain which requirement each artifact supports and identify any remaining gaps.

Share only the required evidence through an approved channel. Export permission does not authorize disclosure outside the recipient’s scope.

For automated exports, use the documented Customer Portal API. Confirm the endpoint’s scope, authorization, and response format before building a recurring workflow.

Export compliance evidence: find records and download an available package.
Verify exported evidence: check integrity with the supported verifier.
EU AI Act evidence walkthrough: assemble supporting materials for a defined review.