ComplyAssistant

Choose which application evidence reports ComplyAssistant receives and when VeriProof sends them. The integration uses the evidence API. It does not read ComplyAssistant documents or assessments.

Access

Administrators manage connections with permission to manage integrations. Administrators and Compliance Officers manage reports with compliance access and evidence export permission, within their authorized application scope. Automatic delivery also requires report scheduling permission.

Other users may see a permitted connection summary. They cannot use the report catalog, PDF previews, or delivery history. Custom roles, demo sessions, sandbox previews, and role previews cannot manage report delivery. Auditors continue to use their authorized Compliance exports.

Connect the receiving account

1. Open Settings → ComplyAssistant in VeriProof.
2. Select Connect account, or Configure connection for a saved connection.
3. Select Destination environment: QA sandbox or Customer production.
4. Enter the approved Instance URL and account Access token.
5. Select Save connection for a new account, or Save token and destination for a saved account.

In ComplyAssistant, select your user name in the header. Find Access Token near the bottom of your account settings. Use the token from the account that will receive the reports.

The QA instance is https://veriproof.complyassistantqa.com. Each production customer uses a dedicated approved URL and its own token. Each production destination requires separate report mapping qualification. QA acceptance does not qualify a customer account.

Saving a connection sends no report and enables no schedule. A confirmed first delivery establishes evidence-write acceptance for that report scope.

QA document types

VeriProof files each report in the QA account under the document type with this exact name:

Names must match, including spaces and capitalization. Configure missing types in Account Settings → Dynamic Fields → Document Types in ComplyAssistant. Reports without a document type here stay preview-only and can’t be sent. A mapping routes the PDF. It does not qualify every report’s content, establish compliance, or prove production acceptance. HIPAA delivery still requires a real saved assessment and separate content and provider verification.

Choose applications and reports

Select Applications and save the applications that may be included in reports. All listed applications selects the current listed population. New applications are not added automatically. The inventory includes selected suspended applications.

Open a report row to see its delivery state, timing, and source requirements. Reports start in Manual mode:

More options lets you change supported delivery frequency or use a report-specific application selection. Runtime reports also support a preview reporting period. Inventory and exceptions reports describe their state when generated. The governance summary covers the preceding seven days and excludes applications without activity in that period.

Preview and send

1. Open a report row.
2. For an assessment report, select one application with a saved assessment.
3. Select Preview and send and review the exact PDF, application names, evidence period, recorded outcomes, gaps, and destination.
4. Select Send report.
5. Open Delivery history to check the receipt. Inspect the received document in ComplyAssistant.

A connected destination can support local Preview report when delivery of that report is not qualified. Its Send report action remains unavailable.

The submitted PDF is the PDF you previewed. An expired preview or changed destination requires a new preview. Preview same report reuses a current PDF prepared for another GRC provider. Each destination requires separate delivery authorization.

Manual assessment reports retain pending reviews, adverse findings, evidence gaps, and original assessment periods. They cover represented requirements, rather than the complete framework. Outcome, review, and evidence summaries report separate recorded facts. Completed collection checks do not mean requirements were met. Organization assertion counts are part of required outcome totals. Their document requirement counts are part of evidence totals. VeriProof reports supporting HIPAA runtime evidence. It cannot establish organizational requirements that need customer documents. Organization document intake is not available; those requirements remain disclosed as evidence gaps. Exporting does not run a new assessment or establish HIPAA, HITRUST, or NIST compliance.

Current previews can include declared application, model, and rule names, current user display names, and approved public links. Ownership, assignment, revision, review state, and dates describe the recorded sources. Display names reflect user records at export. They do not identify a user’s role at a past decision. Current previews exclude email fields, raw content, credential fields, private review rationale, and free-text notes. Review included names before authorizing delivery; they can contain sensitive customer text. PDFs prepared under an earlier content policy remain read-only. Their recorded policy describes the fields retained in those PDFs.

Received by ComplyAssistant means ComplyAssistant acknowledged the report and VeriProof retained the receipt. It does not mean provider review, approval, or compliance. Each report and application scope has its own document history. Retries retain the same delivery identity and PDF. New PDFs have a Document ID that stays the same across providers. Delivery ID and receipts identify each destination’s submission. Exports display UTC timestamps. Period reports include exact start and end boundaries; as-of reports use the frozen export time. Saved assessment evaluation times remain in the PDF and differ from the export time.

Send automatically

Send and confirm the first report for every selected report scope. An assessment needs a separate first receipt for each application. Then turn on Send automatically and confirm the named destination, applications, report, and timing.

Subsequent deliveries within that authorization need no repeated approval. After report sharing fields change, automatic delivery pauses. Review a new PDF, confirm its receipt, and authorize automatic delivery again. Automatic assessments use new saved revisions with completed required reviews; they do not run reassessments or redate old evidence.

Change applications, reports, or destination to review the affected authorization again. Changed scopes need a confirmed first receipt before automatic delivery can resume. Select Pause automatic delivery in a report panel, or Pause all automatic delivery for this provider. Manual delivery remains available when permitted.

Resolve a delivery result

Open the report’s delivery details to review its exact status, attempts, receipt, and permitted action. Select View PDF to read a retained report. Review and send resumes an eligible prepared report with its saved PDF. Expired and received PDFs remain read-only. Download PDF saves the exact retained report.

An unresolved delivery keeps its destination fixed. Do not create another connection to bypass it. Renewing a token for that same account preserves document history and approved schedules; it sends no report. Retry the retained report only when its delivery state permits it.

Disconnect

Open Configure connection and select Disconnect ComplyAssistant. Disconnecting stops future delivery and clears the locally stored token. Delivery history remains in VeriProof. Received documents remain under the customer’s ComplyAssistant retention and access controls. Manage those documents and revoke provider access through ComplyAssistant when needed.