Skip to content
Sign in

How-to

Export evidence for an auditor

Updated

On this page

Give an auditor a sealed record of how your changes were checked, decided and approved, and the audit log behind it. It takes about 5 minutes.

Build a Secure SDLC pack

  1. Open Compliance and choose the Exports tab.
  2. Under Secure SDLC Pack, keep the last 30 days, or choose Pick pull requests and tick the ones the auditor asked about.
  3. Click Generate. The pack downloads when it is ready.

The pack holds the policy versions, release decisions, Zof's decision records, approvals and sealed engine evidence for each change, with a sha256 for the whole pack. It is all or nothing: if Zof can't read the decision record of a pull request you picked, no pack is built and nothing is saved.

Check that it worked

The pack is listed under Export history as "Ready", with its sha256. Download gives you the same file again, exactly as sealed, so the auditor can check it against the hash you sent.

Export the audit log

Only company admins can see and export the audit log. Open Admin › Audit and data › Audit log. The log is also the Audit Log tab on Compliance.

  1. Set Type, Actor, From and To to what the auditor asked for, and click Apply.
  2. Click Export CSV. The file holds every event the filters show.

For a longer range or several event types at once, use Custom Audit Export on Compliance › Exports: click Configure, choose the dates and event types, then Export CSV. It exports up to 50,000 events. A file cut short is named -partial and says why.

Sealed evidence for each run

Admins can see every evidence bundle the Verification engine published in Admin › Audit and data › Evidence, newest first, each with its sha256. Use the download button on a row to save that bundle exactly as sealed. Generate pack there takes you to Compliance › Exports.

Next steps