# Audit packs

An audit pack is a report over one project, environment, set of agents and period, for an auditor. Generate it in the console under **Review → Audit packs**. It comes as a self-contained HTML page (print it to save as PDF) and a JSON twin with the same data. Audit packs are on the Enterprise plan.

This report is evidence for an auditor. It is not a certification.

## What it contains

| section | what it shows |
|---|---|
| Scope and period | organization, project, environment, agents, period |
| Records | decisions, outcomes and notes per agent, and how many have content stored with the service |
| Verification | the result of the full verifier over every record in the period, check by check |
| Chain integrity | agent and batch chains, rejected conflicts, late records, rejected requests |
| Anchoring | batches and records whose public timestamp is confirmed or pending (anchored and confirming, or waiting for the hourly anchor), as of the moment the report was made |
| drand | batches carrying a drand round, and the BLS signature check |
| Keys | service keys, agent keys and their validity, API keys, rotation and revocation history |
| Retention | how long the service keeps records, the oldest record held, hash-only versus stored content |
| Access | auditor links issued, exports and earlier audit packs |

The verification runs server-side with the service's own registry of service and agent keys, so it is not independent, and its headline says how many checks passed, which are pending and that the check is the service's own, for example `PASS: 11 of 12 checks passed, 1 pending (public timestamp)` with "checked by the service with its own key registry, so this is not an independent check". Each report ends with the command for an independent check: download the verification pack for the same scope, get `agent-keys.json` from the customer (`signafaide keys export`) and their `.signafaide/head.json` saved as `head.json`, and run `npx signafaide verify pack.json --keys <service>/.well-known/signafaide-keys.json --agent-keys agent-keys.json --head head.json`. An auditor link whose scope covers a report shows it to the auditor, with the same command.

A report is a snapshot. It says the moment it was made ("as of") and the public timestamp status at that moment; records that were pending then usually confirm within a few hours. The console's list shows each report's status then and the same scope's status now, and **Regenerate** makes it again; the auditor view has the same button. A report's period never ends in the future: a later end is taken as the moment the report is made.

On Solo and Team, **Review → Verification report** makes the slim version for a period: scope, counts, the verification result line, chain integrity, the timestamp status as of that moment and the verify command, with no control mapping.

## Control mapping

Each section lists the controls it is evidence relevant to. It never states that a control is met: that is the auditor's judgement.

| framework | controls |
|---|---|
| EU AI Act | Article 12 (record-keeping), Article 19 (automatically generated logs), Article 26(6) (deployers keep logs for at least six months) |
| ISO/IEC 42001:2023 | Annex A.6.2.8 (AI system recording of event logs), clause 9.1 (monitoring, measurement, analysis and evaluation) |
| SOC 2 Trust Services Criteria | CC7.2 (monitoring for anomalies), CC7.3 (evaluation of security events) |

## Hash-only records

For hash-only records the service holds hashes, signatures and receipts, which is what the report checks. The content itself stays with you in `.signafaide/chain`. Keeping it for the period your obligations require is up to you; the report says how many records in the period are hash-only.