# Compliance center
Source: https://sovaria.in/docs/compliance-center

Download an evidence pack for your own audits and customer security reviews: audit-log check, encryption, backups and point-in-time recovery, access matrix, Security Advisor findings, data region and subprocessors.

When your own customers or auditors ask how your backend is secured, the compliance center gives you one file with the answers, taken from the live platform at the moment you download it. Owners and admins find it under **Organization › Compliance**.

> **Warning:** The pack is evidence of how Sovaria is set up for **your organization**. It is not a certification, and it doesn't make your product compliant on its own. Sovaria itself is preparing for SOC 2 and ISO/IEC 27001 and holds neither yet; the [trust center](https://sovaria.in/trust) shows our status control by control.

(Diagram: How the pack is built — Every engine checks your access as usual: the pack is built with your own session, so it never shows more than you could see in the console.)

## What is in the pack

| File | What it shows |
|---|---|
| `audit_chain.json` | Whether your organization's tamper-evident (hash-chained) [audit log](https://sovaria.in/docs/audit-logs) verifies end to end, and how many entries it has. |
| `encryption.json` | Encryption in transit and at rest, and whether you use [your own key](https://sovaria.in/docs/encryption-keys). |
| `projects.csv`, `backups/<ref>.json` | Per project: data region, backups and [point-in-time recovery](https://sovaria.in/docs/backups-and-recovery) status. |
| `security_advisor/<ref>.json` | Findings from the [Security advisor](https://sovaria.in/docs/security-advisor): tables without policies, permissive rules, public buckets. |
| `access_members.csv`, `access_project_grants.csv`, `access_api_keys.csv` | Who can reach what: members and their role, whether they use two-factor, direct project roles, API keys by name, kind and prefix (never the key itself). |
| `subprocessors.csv` | Who processes data for Sovaria, what for, and where. |
| `report.json`, `README.txt`, `MANIFEST.json` | Everything in one document, what each file is, and the SHA-256 of every file so a reviewer can check nothing was edited. |

A section the platform couldn't read when the pack was made is marked `unavailable`, `not_permitted` or `not_enabled` with the reason, never left out silently.

## Download it

CLI:
```bash
sov compliance status                          # what the pack shows now
sov compliance export -o acme-evidence.zip     # whole organization (checks every SHA-256)
sov compliance export --project <project-id>
```

JavaScript:
```ts
const overview = await sov.compliance.overview(orgId)
const zip = await sov.compliance.downloadEvidence(orgId, { projectId })  // Blob
```

Python:
```python
overview = await sov.get_compliance_overview(org_id)
zip_bytes = await sov.download_compliance_evidence(org_id, project_id=project_id)
```

HTTP:
```http
GET /api/v1/org/{org_id}/compliance?project_id=…
GET /api/v1/org/{org_id}/compliance/evidence?project_id=…   → application/zip
```

- Only organization owners and admins can see the overview or download the pack; others get 403.
- Every download is written to your organization's audit log with the pack's SHA-256.
- Sovariq can read the overview (`get_compliance_overview`) to tell you what to fix before a review; downloading stays with people.

|  | Free | Pro | Ultra | Team | Enterprise |
|---|---|---|---|---|---|
| Compliance evidence pack for your own audits | ✓ | ✓ | ✓ | ✓ | ✓ |
| Compliance evidence packs per day | 3 | 20 | 50 | 100 | 500 |