Audit Export & Compliance

Export Formats

JSON

Complete, structured data for programmatic use:

1. Go to **Governance** → **Audit Trail**
2. Click **Export** → **JSON**
3. Optionally apply filters first
4. Download file (audit-2025-03-15.json)

Sample Output:

{
  "export_metadata": {
    "timestamp": "2025-03-15T10:30:00Z",
    "period": "2025-03-01 to 2025-03-15",
    "total_entries": 2847,
    "hash_verification": "sha256:abc123...",
    "encrypted_fields": ["request_text", "response_text"]
  },
  "entries": [
    {
      "id": "log_001",
      "timestamp": "2025-03-15T10:23:45Z",
      "sequence_number": 1,
      "hash": "sha256:entry1hash...",
      "previous_hash": "sha256:genesis",
      "user_id": "user_123",
      "model": "gpt-4",
      "decision": "allowed",
      "latency_ms": 145,
      "tokens": 412
    }
  ]
}

Use Cases:

Programmatic analysis (Python, SQL, etc.)
Integration with SIEM systems
Auditor review with specialized tools

CSV

Tabular format for spreadsheets and analysis:

1. Click **Export** → **CSV**
2. Download file
3. Open in Excel, Google Sheets, or Tableau

Sample Output:

timestamp,user_id,model,decision,violation_type,confidence,latency_ms
2025-03-15T10:23:45Z,user_123,gpt-4,allowed,,0.0,145
2025-03-15T10:25:12Z,user_456,claude-3,blocked,pii_detected,0.98,78
2025-03-15T10:27:03Z,user_789,gpt-4,warned,toxicity_detected,0.72,92

Use Cases:

Spreadsheet analysis
Trend graphing
Compliance dashboards
Auditor reports

PDF

Formatted report for printing and sharing:

1. Click **Export** → **PDF**
2. Choose report style:
   - Executive Summary (1-2 pages)
   - Detailed Report (5-10 pages)
   - Full Technical (20+ pages)
3. Download

PDF Includes:

Cover page with company info
Executive summary of findings
Charts and graphs of violations
Sample audit entries
Compliance framework mapping
Signature page for sign-off

Use Cases:

Board meetings
Investor presentations
Auditor meetings
Regulatory submission

SIEM Integration

Send audit logs directly to your security system:

Setup:

Go to Settings → Integrations → SIEM
Select platform:
- Splunk
- ELK Stack
- Sumo Logic
- Datadog
- Custom Syslog
Configure credentials/endpoint
Choose which events to export:
- All requests
- Violations only
- Policy changes
- Rare events
Click Test Connection
Click Enable

Result:

Audit logs automatically sent in real-time
Integrated into your security dashboard
Searchable alongside other security events
Alerting based on your rules

Filtering Before Export

Export only relevant data:

Go to Governance → Audit Trail
Apply filters:
- Time Range: Select start/end dates
- User: Filter by specific user
- Model: Filter by model
- Status: Blocked, allowed, or warned
- Violation Type: PII, injection, etc.
Click Export

Example: Export all PII violations from Q1

Filter:
  Violation Type: PII detected
  Time Range: 2025-01-01 to 2025-03-31
  Status: (any)

Export → CSV

Scheduled Exports

Automatically export audit logs on a schedule:

Setup

Go to Governance → Audit Trail → Scheduled Exports
Click + New
Name: “Monthly Audit Report”
Schedule: Monthly, first day of month at 09:00 UTC
Query: Use advanced query syntax (optional)
Format: CSV, JSON, or PDF
Recipients:
- Email addresses (comma-separated)
- Slack channel
- Webhook URL
Click Create

Common Schedules

Daily Security Report

Schedule: Every day at 08:00 UTC
Query: decision:blocked OR decision:warned
Format: CSV
Recipients: security-team@company.com

Weekly Compliance Report

Schedule: Every Monday at 09:00 UTC
Query: violation:(pii_detected OR injection_detected)
Format: PDF
Recipients: compliance@company.com

Monthly Board Report

Schedule: 1st of month at 10:00 UTC
Query: (none - all events)
Format: PDF (Executive Summary style)
Recipients: cto@company.com, security-lead@company.com

Quarterly Audit Export

Schedule: 1st day of Q (Jan 1, Apr 1, Jul 1, Oct 1)
Format: JSON
Recipients: auditor@firm.com

Compliance Evidence

Use exports to prove compliance to auditors:

SOC 2 Type II

Required Controls:

CC7.2: System monitoring

Evidence:

Export audit trail for audit period (usually 1 year)
Verify hash chain: truthvouch audit verify --file audit.json
Show: All requests logged, no gaps, integrity verified
Share with auditors

File to Export:

Export:
  Format: JSON
  Time Range: Audit period (e.g., Jan 1 - Dec 31)
  Include Hash Verification

ISO 42001

Required Controls:

4.4 Governance monitoring

Evidence:

1. Export all governance-related events
2. Filter: policy changes, violations, approvals
3. Create summary: X policies deployed, Y violations blocked
4. Provide to certification body

EU AI Act

Required Controls:

Article 9: Transparency
Article 73: Incident Reporting

Evidence:

1. Export all AI usage (Article 9 transparency)
2. Export any violations > threshold (Article 73)
3. Show timestamp and decision for each
4. Provide to regulatory body if requested

Required Controls:

Article 32: Security measures
Article 17: Right to delete

Evidence:

1. Export shows encryption of sensitive fields
2. Export shows timestamps of data deletion
3. Verify no unauthorized access in audit trail
4. Use as evidence in data protection audit

Verification & Integrity

Verify Export Integrity

The JSON export includes cryptographic hashes. Verify no tampering:

# Command
truthvouch audit verify --file audit-export.json

# Output
Verifying audit hash chain...
Entry 1: ✓ Valid
Entry 2: ✓ Valid
Entry 3: ✓ Valid
...
Entry 2847: ✓ Valid

All entries verified. No tampering detected.
Hash chain is intact.

What Verification Proves

No entries were added after export
No entries were deleted from the chain
No entry contents were modified
Export is authentic and unmodified

Auditors will:

Download your JSON export
Run verification command
See “All entries verified”
Confirm audit trail integrity

Real-World Compliance Scenarios

Scenario 1: SOC 2 Audit

Timeline: Auditor conducting annual SOC 2 review

Steps:

Export: Full year of audit logs

Time Range: 2024-01-01 to 2024-12-31
Format: JSON
Include Verification Hashes: Yes

Share with Auditor:
- Via secure link (if available)
- Download and email
- Via auditor portal
Auditor Reviews:
- Runs verification: ✓ Passes
- Analyzes violations
- Confirms controls working
- Includes in audit report
Outcome: Control CC7.2 marked as “Effective”

Scenario 2: Data Breach Investigation

Timeline: Company discovers potential data exposure

Steps:

Query audit logs:

violation:pii_detected
AND decision:blocked
AND timestamp:[incident_date]

Export evidence:

Format: PDF
Include: Which PII, when detected, how blocked

Share with:
- Legal team
- Regulators (if required)
- Customers (if required)
Demonstrate: Firewall detected and blocked attempt

Scenario 3: Investor Due Diligence

Timeline: Company fundraising, investor wants security proof

Steps:

Generate Executive Report:

Period: Last 90 days
Format: PDF (Executive Summary)
Highlight: "X violations detected and blocked"

Share with Investor:
- Key metrics on first page
- Framework compliance
- No personal data exposed
Highlight:
- “100% of AI systems governed”
- “Zero AI-related security incidents”
- “SOC 2 compliant”

API Access

Export audit logs programmatically:

REST API

# Get audit logs
curl -X GET "http://localhost:5000/api/v1/governance/audit/export" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/json" \
  -d '{
    "start_date": "2025-01-01",
    "end_date": "2025-03-31",
    "format": "json",
    "include_verification": true
  }'

# Response: JSON file download

Python SDK

from truthvouch import TruthVouchClient

client = TruthVouchClient(api_key="tvk_...")

# Export audit logs
export = client.governance.audit.export(
    start_date="2025-01-01",
    end_date="2025-03-31",
    format="json",
    verify=True  # Include hash verification
)

# Save to file
with open("audit-export.json", "w") as f:
    f.write(export.to_json())

# Verify integrity
if export.verify():
    print("Audit trail verified - no tampering detected")
else:
    print("WARNING: Audit trail integrity check failed!")

Storage Considerations

File Sizes

Typical export sizes:

Period: 1 month
Format: JSON
Entries: 2,847
Size: ~5 MB (compressed) / ~15 MB (uncompressed)

Period: 1 year
Format: JSON
Entries: 34,000
Size: ~60 MB (compressed) / ~180 MB (uncompressed)

Archive Old Exports

# Export to file
truthvouch audit export --period 2024-Q1 --format json > audit-2024-Q1.json.gz

# Upload to cold storage
aws s3 cp audit-2024-Q1.json.gz s3://compliance-archives/ --storage-class GLACIER

# Keep reference in audit management system

Audit Export & Compliance

Export Formats

JSON

CSV

PDF

SIEM Integration

Filtering Before Export

Scheduled Exports

Setup

Common Schedules

Compliance Evidence

SOC 2 Type II

ISO 42001

EU AI Act

GDPR

Verification & Integrity

Verify Export Integrity

What Verification Proves

Real-World Compliance Scenarios

Scenario 1: SOC 2 Audit

Scenario 2: Data Breach Investigation

Scenario 3: Investor Due Diligence

API Access

REST API

Python SDK

Storage Considerations

File Sizes

Archive Old Exports

Related Topics