Docs

Compliance center

Download an evidence pack for your own audits and customer security reviews: audit-log check, encryption, backups and point-in-time recovery, access matrix, Security Advisor findings, data region and subprocessors.

Updated Oct 26, 2026

When your own customers or auditors ask how your backend is secured, the compliance center gives you one file with the answers, taken from the live platform at the moment you download it. Owners and admins find it under Organization › Compliance.

Owner or adminconsole, CLI orSDKCompliance centerowners/admins,counted per day,auditedAudit log checkBackups, PITR, regionSecurity AdvisorOwn-key statusEvidence ZIPMANIFEST.json withSHA-256s
Every engine checks your access as usual: the pack is built with your own session, so it never shows more than you could see in the console.

#What is in the pack

FileWhat it shows
audit_chain.jsonWhether your organization's tamper-evident (hash-chained) audit log verifies end to end, and how many entries it has.
encryption.jsonEncryption in transit and at rest, and whether you use your own key.
projects.csv, backups/<ref>.jsonPer project: data region, backups and point-in-time recovery status.
security_advisor/<ref>.jsonFindings from the Security advisor: tables without policies, permissive rules, public buckets.
access_members.csv, access_project_grants.csv, access_api_keys.csvWho can reach what: members and their role, whether they use two-factor, direct project roles, API keys by name, kind and prefix (never the key itself).
subprocessors.csvWho processes data for Sovaria, what for, and where.
report.json, README.txt, MANIFEST.jsonEverything in one document, what each file is, and the SHA-256 of every file so a reviewer can check nothing was edited.

A section the platform couldn't read when the pack was made is marked unavailable, not_permitted or not_enabled with the reason, never left out silently.

#Download it

sov compliance status                          # what the pack shows now
sov compliance export -o acme-evidence.zip     # whole organization (checks every SHA-256)
sov compliance export --project <project-id>
  • Only organization owners and admins can see the overview or download the pack; others get 403.
  • Every download is written to your organization's audit log with the pack's SHA-256.
  • Sovariq can read the overview (get_compliance_overview) to tell you what to fix before a review; downloading stays with people.
FreeProUltraTeamEnterprise
Compliance evidence pack for your own audits✓✓✓✓✓
Compliance evidence packs per day32050100500