Tutorial: Exporting Evidence for Compliance Audits

This tutorial walks you through creating export jobs, filtering data, choosing output formats, and delivering evidence to auditors using the Keeptrusts management console.

Use this page when

• You need to generate a compliance evidence package for an external auditor (EU AI Act, HIPAA, SOC 2).
• You want to export policy decision events, escalation records, or config history in CSV, JSON, or PDF format.
• You are configuring S3 delivery for automated evidence archival.
• You need to schedule recurring quarterly exports.

Primary audience

• Primary: Compliance officers and GRC analysts generating audit evidence for regulators or external assessors
• Secondary: Platform admins configuring S3 delivery; legal teams archiving decision records for litigation holds

Prerequisites

• A Keeptrusts account with Admin or Compliance role
• Events and policy decisions recorded in Keeptrusts (at least a few days of data)
• For S3 delivery: an S3-compatible bucket with write credentials configured in Keeptrusts

Why Export Evidence?

Regulatory frameworks like the EU AI Act, HIPAA, and SOC 2 require organizations to demonstrate that AI systems are governed, monitored, and auditable. Keeptrusts export jobs generate self-contained evidence packages that include:

• Policy decision events with full input/output metadata
• Escalation history and resolution records
• Configuration version history
• Aggregated compliance summaries

Step 1: Navigate to Exports

1. Log in to the Keeptrusts console.
2. Open Exports from the left navigation sidebar.

The page displays a table of previous export jobs with their status, format, date range, and download links.

Step 2: Create an Export Job

1. Click Create Export in the top-right corner.
2. Configure the export parameters:

Field	Description
Name	A label for the export (e.g., Q1-2026-SOC2-Audit)
Date Range	Start and end dates for the evidence period
Format	Output format: CSV, JSON, or PDF
Description	Optional notes for auditors or internal reference

3. Click Next to proceed to filtering.

Step 3: Apply Filters

Narrow the export to relevant data using filters:

Filter	Description
Policy	Include only events matching specific policies
Decision	Filter by decision type: Allow, Block, Redact, Escalate
Gateway	Restrict to events from specific gateways
Consumer Group	Filter by consumer group
Severity	Include only events at or above a severity threshold

1. Add one or more filters from the filter panel.
2. Preview the estimated record count to verify the scope is appropriate.
3. Click Create Export to submit the job.

The export job enters a Processing state. For large date ranges, processing may take several minutes.

For recurring audits, save your filter configuration as a template. Click Save as Template before submitting to reuse the same filters next quarter.

Step 4: Choose the Right Format

Each format serves different audit needs:

Format	Best For	Contents
CSV	Spreadsheet analysis, data teams	Tabular event data with one row per decision
JSON	Programmatic processing, SIEM import	Structured event records with full metadata
PDF	Human-readable reports for regulators	Formatted summary with charts, tables, and policy descriptions

The PDF format includes:

• Executive summary with key metrics
• Policy violation breakdown by type and severity
• Escalation timeline and resolution status
• Configuration change log for the period
• Appendix with raw event samples

Step 5: Monitor Export Progress

1. The export job appears in the Exports table with a status indicator:

Status	Meaning
Queued	Waiting for a background worker to pick up the job
Processing	Worker is generating the export artifact
Completed	Export is ready for download
Failed	An error occurred during generation

2. For long-running exports, you can navigate away — the job continues in the background.
3. Keeptrusts sends a notification when the export completes (if notification channels are configured).

Step 6: Download the Export

1. Once the status shows Completed, click the Download button on the export row.
2. The browser downloads the artifact file (e.g., Q1-2026-SOC2-Audit.csv).
3. For large exports, a ZIP archive containing multiple files is generated.

Download links expire after 7 days. If you need the export again after expiry, create a new export job with the same parameters.

Step 7: Deliver to S3

For automated delivery to your evidence storage:

1. Navigate to Settings > Export Delivery.
2. Click Configure S3 Delivery.
3. Enter your S3 bucket details:

Field	Description
Bucket Name	The S3 bucket name
Region	AWS region (e.g., us-east-1)
Prefix	Object key prefix (e.g., keeptrusts/exports/)
Access Key ID	AWS access key for the bucket
Secret Access Key	AWS secret key (encrypted at rest)

4. Click Test Connection to verify write access.
5. Click Save.

Once configured, every completed export is automatically uploaded to the S3 bucket in addition to being available for console download. S3-compatible backends (MinIO, Cloudflare R2) are also supported.

Step 8: Review Export Contents

Before sharing with auditors, review the export:

1. Download the file and open it in a spreadsheet (CSV) or text editor (JSON).
2. Verify the date range covers the audit period.
3. Check that sensitive data is appropriately redacted (Keeptrusts applies the same redaction policies to exported content).
4. For PDF exports, review the executive summary for accuracy.

Step 9: Schedule Recurring Exports

For ongoing compliance requirements, schedule automatic exports:

1. In the Exports page, click Schedule Export.
2. Select a frequency: Weekly, Monthly, or Quarterly.
3. Configure the same parameters as a manual export (format, filters, delivery).
4. Click Save Schedule.

Scheduled exports run automatically and deliver artifacts to your configured S3 bucket or make them available for download in the console.

Best Practices

• Match audit periods exactly — Align date ranges with your audit calendar.
• Use PDF for regulators — The formatted report is easier for non-technical reviewers.
• Use JSON for SIEM integration — Import structured events into Splunk, Elastic, or similar.
• Retain exports in S3 — Configure lifecycle policies on your bucket for long-term retention.
• Review before sharing — Always verify export contents before sending to external auditors.
• Schedule recurring exports — Automate quarterly evidence generation to avoid last-minute rushes.

Next steps

• Tutorial: Reviewing the Audit Log — Complement exports with real-time audit monitoring
• Tutorial: Configuring Webhooks in Console — Get notified when exports complete
• Tutorial: Escalation Workflows in Console — Include escalation evidence in audit reports

For AI systems

• Canonical terms: Keeptrusts console, Exports page, export job, compliance evidence, output formats (CSV/JSON/PDF), S3 delivery, presigned URL, scheduled export, export filters (date range, event type, team).
• Related features: audit log, escalation history, configuration version history, notification channels (export completion webhook).
• Best next pages: Audit Log Review, Webhook Configuration, Escalation Workflow.

For engineers

• S3 prerequisite: Configure an S3-compatible bucket with write credentials in Settings before using S3 delivery. Local downloads work without extra setup.
• Validation: Create a test export for a one-day range, download the file, and verify it contains the expected event count and field schema.
• Scheduled exports: Set up a monthly recurring export and confirm it fires on the 1st by checking the export history table the next day.
• Troubleshooting: If export status stays "Processing" indefinitely, check that the worker_export binary is running and has DB connectivity.

For leaders

• Regulatory readiness: Self-contained evidence packages satisfy EU AI Act Article 12 record-keeping and SOC 2 CC7.2 monitoring evidence requirements.
• Audit efficiency: Scheduled exports eliminate last-minute scrambles before assessor visits — evidence is pre-generated and ready.
• Archival strategy: Route exports to a WORM-enabled S3 bucket for tamper-proof long-term retention beyond platform retention limits.