Skip to content

EU AI Act: high-risk (Annex III) obligations now apply from 2 December 2027 — Regulation (EU) 2026/1744 moved the original August 2026 date. See if you’re ready →

Execlave

§ PLATFORM / COMPLIANCE EVIDENCE

Compliance evidence an auditor can check without trusting you

Execlave turns what your AI agents did into evidence: a compliance report signed with RSA-PSS, an audit package with a SHA-256 package hash, and CSV or JSON exports. Your auditor can verify the report offline, with the steps below.

Start freeHow to verify a report

§ WHAT YOU HAND OVER

Four pieces of evidence, one source

All four are built from the same records: the hash-chained audit log, your policies, approvals and agent registry.

Four pieces of evidence, one source

01 / Artifact

Signed compliance report

One report per period and framework selection, as JSON, HTML or PDF. The JSON is signed with RSA-SHA256-PSS over its canonical form, and the public key travels inside the report. HTML and PDF show the signature and the steps to check it.

02 / Artifact

Audit package

The newest 10,000 audit log entries for a date range, the result of the hash-chain check, how much of the chain is content-verifiable, and a SHA-256 hash over all entries. The verification steps are inside the package.

03 / Artifact

CSV and JSON exports

Traces and the audit log as CSV or JSON, up to 10,000 rows per request. Trace exports filter by date range, agent, status and environment; audit log exports by date range.

04 / Artifact

Report history

Every JSON report is saved, so a viewer can reopen last quarter's report as it was signed. Generating a report writes an audit log entry, and if that entry cannot be written, the request fails instead of returning an unlogged report.

§ INSIDE THE REPORT

What the signed report contains

Everything below is inside the signed body, so none of it can be changed after signing without the signature failing.

What the signed report contains

SummaryPolicy counts (active, by mode, and policies whose rule cannot match anything), enforcement decisions, blocks, approvals, registered agents, and whether the audit chain and the approval certificate chain check out.
Policy inventoryEvery policy with its type, enforcement mode, whether it is active, and the frameworks and controls it is mapped to.
Enforcement statisticsDecisions in the period: allowed, blocked, warned, approved, denied and expired, by policy type, plus blocks per policy.
Outcome confirmation coverageHow many allowed actions have a confirmed outcome, so a reader cannot assume that every allowed action landed.
Enforcement bypassesCalls that ran without a server decision because an SDK configured to fail open could not get one.
Approvals and certificatesEach approval with requester agent, policy, decision, decider and reason; each approval certificate, and whether it was verified when the action ran.
Agents and permissionsThe agent registry and each agent's permission posture.
Prompt changes and model-judged rulesPrompt-version approvals split into independent and self-approved, and the results of rules a model judges.
Framework controlsFor each framework you select, every control with status (met, partial, not met), risk level, an evidence summary and a gap note where something is missing.
Audit package summaryAudit chain result, entry count, the SHA-256 package hash and the chain coverage figures.

§ FRAMEWORKS BY PLAN

Which frameworks each plan can report on

Admins generate reports in the dashboard or through GET /api/v1/compliance/report. Any member can open saved reports.

Which frameworks each plan can report on

PlanFrameworks in the report
Free, TrialNot included
StarterGDPR, EU AI Act, OWASP ASI
ProfessionalGDPR, EU AI Act, OWASP ASI, SOC 2 Type II, HIPAA, ISO 27001:2022
EnterpriseAll of the above, plus PCI DSS and NIST AI RMF

Prices and limits are on the pricing page.

§ VERIFY

How to verify a signed compliance report

The same five steps work offline with any RSA library. Execlave also runs steps 2 to 4 for you at POST /api/v1/compliance/verify-signature.

How to verify a signed compliance report

  1. Take the JSON report

    Download the JSON from the dashboard or request GET /api/v1/compliance/report with format=json. The HTML and PDF versions show the signature, but the signed bytes come from the JSON.

  2. Remove the signature fields

    Delete signatureInfo from the report object, and signingStatus if it is present. Neither is part of the signed bytes.

  3. Canonicalise the rest

    Serialise the remaining object as JSON with object keys sorted recursively and no whitespace, encoded as UTF-8.

  4. Check the signature

    Verify the base64 signature in signatureInfo.signature over those bytes with RSA-PSS and SHA-256, against signatureInfo.publicKey. If it fails, the report changed after it was signed.

  5. Check who signed it

    A valid signature proves the report is intact since it was signed with that key, not who signed it. Fetch /.well-known/execlave-signing-keys.json from the issuing deployment's API host (Execlave Cloud: https://api.execlave.com/.well-known/execlave-signing-keys.json), find the entry whose kid equals signatureInfo.keyId, and verify the signature again with that entry's publicKey, not the key inside the report. The keyId is not signed, so a match on the ID alone proves nothing. Keys from before a rotation stay listed as retired; for reports without a keyId, compare the keys in DER form, not as PEM text.

The audit package is checked differently: re-derive each entry's hash, check the chain links and recompute the package hash. Those steps are on the audit trail page.

§ FAQ

Compliance evidence, answered

Compliance evidence, answered

Is an Execlave compliance report a certification?

No. The report is evidence for your audit. It shows what your controls did in a period and where they fall short. Whether your organisation meets a framework is your auditor's call, and Execlave itself is not certified against these frameworks.

Can an auditor verify a report without access to Execlave?

Yes. The public key is inside the report, and the five steps above need only the JSON file and a standard RSA library. The verify-signature endpoint is a convenience, not a requirement.

What if signing is not set up on a deployment?

The report says so. An unsigned report carries a signingStatus field with the reason (keys not configured, keys misconfigured, or signing failed), and the HTML and PDF versions state that the report is not signed.

Does the report hide gaps?

No. Controls that are not met are listed with a risk level and a gap note. The report also states how many allowed actions have a confirmed outcome and how many calls ran without a server decision, so silence is never read as success.

How far back can a report go?

As far as the data is kept. The audit log is kept for one year on every plan, and traces for your plan's retention period. Saved reports keep what they showed when they were generated.

What is the difference between the report and the audit package?

The report summarises a period against frameworks and is signed. The audit package is the raw audit log entries with a SHA-256 package hash, for an auditor who wants to re-check the chain entry by entry.

Execlave produces evidence for your compliance work. It does not give legal advice, an audit opinion or a certification.

Generate your first signed report

Connect an agent, set a policy, and export a signed report for the period you choose. Starter includes GDPR, EU AI Act and OWASP ASI reports.

Start freeSee the framework mapping