title: Compliance report export description: Export PDF/JSON evidence from the Compliance Dashboard mapped to SOC 2, Law 25, PIPEDA, CPCSC, and OSFI clauses. audience: Compliance officers and auditor liaisons timeEstimate: 15 minutes prerequisites:

Shadow discovery running with selected compliance packs
Gap report available for the target environment

Compliance report export

Use the Compliance Dashboard to produce auditor-ready PDF and JSON packages that map shadow evidence and control posture to regulatory clauses.

Export from the Compliance Dashboard

Open Compliance & Gaps (/compliance) for the target environment (sandbox first).
Select packs and time window (for example last 48 hours).
Run Executive / Integrity report (or POST /v1/compliance/reports/run).
Choose Export → PDF for board/auditor packages, or Export → JSON for SIEM / GRC tooling.
Attach the export to your change record; retain per your evidence retention policy.

# JSON export via API
curl -X POST "$PAP_API/v1/compliance/reports/run?environment=sandbox" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"regulation_pack_ids":["soc2_tsc","osfi_b13","pipeda_bill_c27"],"window_hours":48,"format":"json"}' \
  -o compliance-report.json

# PDF (when enabled on your tier)
curl -X POST "$PAP_API/v1/compliance/reports/run?environment=sandbox" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"regulation_pack_ids":["soc2_tsc","osfi_b13"],"window_hours":48,"format":"pdf"}' \
  -o compliance-report.pdf

JSON includes pack observations (PASS / FAIL / CANNOT_ASSESS), shadow event counts, fingerprint coverage, and clause mapping ids. PDF renders the same sections for human review.

Troubleshooting: If export is empty, confirm packs are selected and SSIE/gap cache has at least one cycle. CANNOT_ASSESS rows still appear — they are evidence of missing PIP coverage, not export failures. See Gap report.

Clause mapping

Framework clause	What Control Core evidence shows	Typical artifacts
SOC 2 CC6.1 — Logical access security	Shadow `SHADOW_WOULD_DENY` / enforce deny decisions; activated controls bound to resources; PIP-backed identity attributes	Audit `audit_logs`, compliance JSON, control versions
Law 25 §12 — Accountability (Québec)	Documented controls for PI processing; residency / purpose observations from packs; export timestamps + actor	PDF executive report, pack `pipeda`/`law25` observations
PIPEDA 4.7 — Safeguards	Encryption-in-transit posture notes + access controls preventing unauthorized disclosure; mask/deny obligations in enforce	Decision logs with non-PII reasons, gap remediations
CPCSC L2 — Cyber security certification (CA)	Identity assurance + access monitoring; CCCP/CPCSC pack scores; OPAL sync proof of control distribution	`/health/opal-bridge`, pack observations, SBOM/deploy refs (ops)
OSFI B-13 §3 — Technology / cyber risk (access)	Wire/privileged-path shadow gaps; HR termination revoke evidence; AI prompt clearance when packs selected	Gap cache, `SHADOW_WOULD_DENY` samples, promote change record

Cross-link related packs on Compliance packs and the framework matrix.

Next steps: Generate controls from gaps · Upgrade to enforce