[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_84":85,"_86":87,"_88":89,"_13":14,"_90":-7,"_91":92,"_93":94,"_95":96,"_97":-5,"_98":62,"_99":62,"_100":-5,"_101":-5,"_102":103,"_104":105,"_106":107,"_108":109},"pages/Login",{"_9":10,"_11":12},"context",{"_13":14},"returnTo","/","portal",{"_15":16,"_17":18,"_19":20,"_21":13,"_22":20,"_23":24,"_25":26,"_27":24,"_28":-5,"_29":-5,"_30":31,"_32":33,"_34":35,"_36":37,"_38":39,"_40":41,"_42":43,"_44":45,"_46":-5,"_47":20,"_48":20,"_49":50,"_51":52},"id","b8eb05f9-32f9-4994-939c-3b4b59e966e2","tenantId","u-compai-u651c","isExternal",true,"mode","isEnabled","customDomain","support.trycomp.ai","defaultDomain","compai.help.unthread.io","canonicalDomain","signInEmailSender","previewUrl","projectIds",[83],"customLinks",[],"featuredCollections",[],"ticketTypeSections",[],"settings",{"_77":78,"_79":80,"_81":80,"_82":20},"identityPlatformTenantId","e-compai-swzto","homepageMetadata",{"_74":75,"_76":75},"loginMethods",[68,69],"statusBanner","requireAuthentication","restrictLoginToAccountDomains","embedAllowedOrigins",[],"tenant",{"_15":18,"_53":54,"_55":56,"_57":58,"_59":60},"name","Comp AI","subdomain","compai","allowedEmailDomains",[67],"allowedPriorities",{"_61":62,"_63":20,"_64":20,"_65":20,"_66":20},"1",false,"3","5","7","9","trycomp.ai",{"_70":73,"_72":20},{"_70":71,"_72":62},"type","emailPassword","enabled","magicLink","title","","description","logoUrl","https://firebasestorage.googleapis.com/v0/b/trnout-co.appspot.com/o/u-compai-u651c%2Fslack%2Ficon_dark.png?alt=media","primaryColor","#004f3a","darkThemeAccentColor","allowDirectTicketCreation","73383f0b-63ac-4c4d-ad91-a2a3404c9096","cspNonce","47ff126c585e14e9548f6f090dad8ec4b0637b4265b40d3f827ca91db736efba","firebaseConfig",{"_3044":3045,"_3046":24,"_169":3047},"session",{"_3039":3040,"_3041":20},"inAppChat","mixpanelToken","cc23843c498db1553f595eae3fae57d7","sentryDsn","https://cd638f7e7e056e6e02d1d91f09ba2fa9@o563911.ingest.us.sentry.io/4510302612946944","environment","prd","theme","isMac","isEmbed","embedConfig","userProfile","projects",[3031],"articles",[1720,1721,1722,1723,1724,1725,1726,1727,1728,1729,1730,1731,1732,1733,1734,1735,1736,1737,1738,1739,1740,1741,1742,1743,1744,1745,1746,1747,1748,1749,1750,1751,1752,1753,1754,1755,1756,1757,1758,1759,1760,1761,1762,1763,1764,1765,1766,1767,1768,1769,1770,1771,1772,1773,1774,1775,1776,1777,1778,1779,1780,1781,1782,1783,1784,1785,1786,1787,1788,1789,1790,1791,1792,1793,1794,1795,1796,1797,1798,1799,1800,1801,1802,1803,1804,1805,1806,1807,1808,1809,1810,1811,1812,1813,1814,1815,1816,1817,1818,1819,1820,1821,1822,1823,1824,1825,1826,1827,1828,1829,1830,1831,1832,1833,1834,1835,1836,1837,1838,1839,1840,1841,1842,1843,1844,1845,1846,1847,1848,1849,1850,1851,1852,1853,1854,1855,1856,1857,1858,1859,1860,1861,1862,1863,1864,1865,1866,1867,1868,1869,1870,1871,1872,1873,1874,1875,1876,1877,1878,1879,1880,1881,1882,1883,1884,1885,1886,1887,1888,1889,1890,1891,1892,1893,1894,1895,1896,1897,1898,1899,1900,1901,1902,1903,1904,1905,1906,1907,1908,1909,1910,1911,1912,1913,1914,1915,1916,1917,1918,1919],"collections",[637,638,639,640],"uncategorizedArticles",[110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160],{"_74":628,"_162":629,"_164":630,"_166":428,"_168":-5,"_169":-5,"_170":631,"_172":632,"_15":633,"_17":18,"_175":-5,"_176":634,"_178":-5,"_179":635,"_181":636},{"_74":620,"_162":621,"_164":-5,"_166":622,"_168":-5,"_169":83,"_170":623,"_172":623,"_15":624,"_17":18,"_175":-5,"_176":625,"_178":-5,"_179":626,"_181":627},{"_74":611,"_162":612,"_164":613,"_166":614,"_168":-5,"_169":-5,"_170":615,"_172":615,"_15":616,"_17":18,"_175":-5,"_176":617,"_178":-5,"_179":618,"_181":619},{"_74":603,"_162":604,"_164":-5,"_166":605,"_168":-5,"_169":-5,"_170":606,"_172":606,"_15":607,"_17":18,"_175":-5,"_176":608,"_178":-5,"_179":609,"_181":610},{"_74":595,"_162":596,"_164":-5,"_166":597,"_168":-5,"_169":-5,"_170":598,"_172":598,"_15":599,"_17":18,"_175":-5,"_176":600,"_178":-5,"_179":601,"_181":602},{"_74":586,"_162":587,"_164":542,"_166":588,"_168":-5,"_169":-5,"_170":589,"_172":590,"_15":591,"_17":18,"_175":-5,"_176":592,"_178":-5,"_179":593,"_181":594},{"_74":578,"_162":579,"_164":-5,"_166":580,"_168":-5,"_169":-5,"_170":581,"_172":581,"_15":582,"_17":18,"_175":-5,"_176":583,"_178":-5,"_179":584,"_181":585},{"_74":559,"_162":569,"_164":570,"_166":571,"_168":-5,"_169":-5,"_170":572,"_172":573,"_15":574,"_17":18,"_175":-5,"_176":575,"_178":-5,"_179":576,"_181":577},{"_74":559,"_162":560,"_164":561,"_166":562,"_168":-5,"_169":-5,"_170":563,"_172":564,"_15":565,"_17":18,"_175":-5,"_176":566,"_178":-5,"_179":567,"_181":568},{"_74":549,"_162":550,"_164":551,"_166":552,"_168":-5,"_169":-5,"_170":553,"_172":554,"_15":555,"_17":18,"_175":-5,"_176":556,"_178":-5,"_179":557,"_181":558},{"_74":540,"_162":541,"_164":542,"_166":543,"_168":-5,"_169":-5,"_170":544,"_172":544,"_15":545,"_17":18,"_175":-5,"_176":546,"_178":-5,"_179":547,"_181":548},{"_74":530,"_162":531,"_164":532,"_166":533,"_168":-5,"_169":-5,"_170":534,"_172":535,"_15":536,"_17":18,"_175":-5,"_176":537,"_178":-5,"_179":538,"_181":539},{"_74":520,"_162":521,"_164":522,"_166":523,"_168":-5,"_169":-5,"_170":524,"_172":525,"_15":526,"_17":18,"_175":-5,"_176":527,"_178":-5,"_179":528,"_181":529},{"_74":502,"_162":512,"_164":513,"_166":505,"_168":-5,"_169":-5,"_170":514,"_172":515,"_15":516,"_17":18,"_175":-5,"_176":517,"_178":-5,"_179":518,"_181":519},{"_74":502,"_162":503,"_164":504,"_166":505,"_168":-5,"_169":-5,"_170":506,"_172":507,"_15":508,"_17":18,"_175":-5,"_176":509,"_178":-5,"_179":510,"_181":511},{"_74":494,"_162":495,"_164":-5,"_166":496,"_168":-5,"_169":-5,"_170":497,"_172":497,"_15":498,"_17":18,"_175":-5,"_176":499,"_178":-5,"_179":500,"_181":501},{"_74":484,"_162":485,"_164":486,"_166":487,"_168":-5,"_169":-5,"_170":488,"_172":489,"_15":490,"_17":18,"_175":-5,"_176":491,"_178":-5,"_179":492,"_181":493},{"_74":475,"_162":476,"_164":-5,"_166":477,"_168":-5,"_169":-5,"_170":478,"_172":479,"_15":480,"_17":18,"_175":-5,"_176":481,"_178":-5,"_179":482,"_181":483},{"_74":465,"_162":466,"_164":467,"_166":468,"_168":-5,"_169":-5,"_170":469,"_172":470,"_15":471,"_17":18,"_175":-5,"_176":472,"_178":-5,"_179":473,"_181":474},{"_74":455,"_162":456,"_164":457,"_166":458,"_168":-5,"_169":-5,"_170":459,"_172":460,"_15":461,"_17":18,"_175":-5,"_176":462,"_178":-5,"_179":463,"_181":464},{"_74":445,"_162":446,"_164":447,"_166":448,"_168":-5,"_169":-5,"_170":449,"_172":450,"_15":451,"_17":18,"_175":-5,"_176":452,"_178":-5,"_179":453,"_181":454},{"_74":435,"_162":436,"_164":437,"_166":438,"_168":-5,"_169":-5,"_170":439,"_172":440,"_15":441,"_17":18,"_175":-5,"_176":442,"_178":-5,"_179":443,"_181":444},{"_74":425,"_162":426,"_164":427,"_166":428,"_168":-5,"_169":-5,"_170":429,"_172":430,"_15":431,"_17":18,"_175":-5,"_176":432,"_178":-5,"_179":433,"_181":434},{"_74":399,"_162":417,"_164":418,"_166":319,"_168":-5,"_169":-5,"_170":419,"_172":420,"_15":421,"_17":18,"_175":-5,"_176":422,"_178":-5,"_179":423,"_181":424},{"_74":399,"_162":408,"_164":409,"_166":410,"_168":-5,"_169":-5,"_170":411,"_172":412,"_15":413,"_17":18,"_175":-5,"_176":414,"_178":-5,"_179":415,"_181":416},{"_74":399,"_162":400,"_164":401,"_166":402,"_168":-5,"_169":-5,"_170":403,"_172":403,"_15":404,"_17":18,"_175":-5,"_176":405,"_178":-5,"_179":406,"_181":407},{"_74":391,"_162":392,"_164":-5,"_166":393,"_168":-5,"_169":-5,"_170":394,"_172":394,"_15":395,"_17":18,"_175":-5,"_176":396,"_178":-5,"_179":397,"_181":398},{"_74":381,"_162":382,"_164":383,"_166":384,"_168":-5,"_169":-5,"_170":385,"_172":386,"_15":387,"_17":18,"_175":-5,"_176":388,"_178":-5,"_179":389,"_181":390},{"_74":371,"_162":372,"_164":373,"_166":374,"_168":-5,"_169":-5,"_170":375,"_172":376,"_15":377,"_17":18,"_175":-5,"_176":378,"_178":-5,"_179":379,"_181":380},{"_74":361,"_162":362,"_164":363,"_166":364,"_168":-5,"_169":-5,"_170":365,"_172":366,"_15":367,"_17":18,"_175":-5,"_176":368,"_178":-5,"_179":369,"_181":370},{"_74":353,"_162":354,"_164":-5,"_166":355,"_168":-5,"_169":-5,"_170":356,"_172":356,"_15":357,"_17":18,"_175":-5,"_176":358,"_178":-5,"_179":359,"_181":360},{"_74":345,"_162":346,"_164":-5,"_166":347,"_168":-5,"_169":-5,"_170":348,"_172":348,"_15":349,"_17":18,"_175":-5,"_176":350,"_178":-5,"_179":351,"_181":352},{"_74":326,"_162":336,"_164":337,"_166":338,"_168":-5,"_169":-5,"_170":339,"_172":340,"_15":341,"_17":18,"_175":-5,"_176":342,"_178":-5,"_179":343,"_181":344},{"_74":326,"_162":327,"_164":328,"_166":329,"_168":-5,"_169":-5,"_170":330,"_172":331,"_15":332,"_17":18,"_175":-5,"_176":333,"_178":-5,"_179":334,"_181":335},{"_74":299,"_162":317,"_164":318,"_166":319,"_168":-5,"_169":-5,"_170":320,"_172":321,"_15":322,"_17":18,"_175":-5,"_176":323,"_178":-5,"_179":324,"_181":325},{"_74":299,"_162":308,"_164":309,"_166":310,"_168":-5,"_169":-5,"_170":311,"_172":312,"_15":313,"_17":18,"_175":-5,"_176":314,"_178":-5,"_179":315,"_181":316},{"_74":299,"_162":300,"_164":-5,"_166":301,"_168":-5,"_169":-5,"_170":302,"_172":303,"_15":304,"_17":18,"_175":-5,"_176":305,"_178":-5,"_179":306,"_181":307},{"_74":290,"_162":291,"_164":-5,"_166":292,"_168":-5,"_169":-5,"_170":293,"_172":294,"_15":295,"_17":18,"_175":-5,"_176":296,"_178":-5,"_179":297,"_181":298},{"_74":272,"_162":282,"_164":283,"_166":275,"_168":-5,"_169":-5,"_170":284,"_172":285,"_15":286,"_17":18,"_175":-5,"_176":287,"_178":-5,"_179":288,"_181":289},{"_74":272,"_162":273,"_164":274,"_166":275,"_168":-5,"_169":-5,"_170":276,"_172":277,"_15":278,"_17":18,"_175":-5,"_176":279,"_178":-5,"_179":280,"_181":281},{"_74":264,"_162":265,"_164":-5,"_166":266,"_168":-5,"_169":-5,"_170":267,"_172":267,"_15":268,"_17":18,"_175":-5,"_176":269,"_178":-5,"_179":270,"_181":271},{"_74":255,"_162":256,"_164":-5,"_166":257,"_168":-5,"_169":-5,"_170":258,"_172":259,"_15":260,"_17":18,"_175":-5,"_176":261,"_178":-5,"_179":262,"_181":263},{"_74":245,"_162":246,"_164":247,"_166":248,"_168":-5,"_169":-5,"_170":249,"_172":250,"_15":251,"_17":18,"_175":-5,"_176":252,"_178":-5,"_179":253,"_181":254},{"_74":237,"_162":238,"_164":-5,"_166":239,"_168":-5,"_169":83,"_170":240,"_172":240,"_15":241,"_17":18,"_175":-5,"_176":242,"_178":-5,"_179":243,"_181":244},{"_74":228,"_162":229,"_164":-5,"_166":230,"_168":-5,"_169":-5,"_170":231,"_172":232,"_15":233,"_17":18,"_175":-5,"_176":234,"_178":-5,"_179":235,"_181":236},{"_74":219,"_162":220,"_164":-5,"_166":221,"_168":-5,"_169":83,"_170":222,"_172":223,"_15":224,"_17":18,"_175":-5,"_176":225,"_178":-5,"_179":226,"_181":227},{"_74":211,"_162":212,"_164":-5,"_166":213,"_168":-5,"_169":-5,"_170":214,"_172":214,"_15":215,"_17":18,"_175":-5,"_176":216,"_178":-5,"_179":217,"_181":218},{"_74":201,"_162":202,"_164":203,"_166":204,"_168":-5,"_169":-5,"_170":205,"_172":206,"_15":207,"_17":18,"_175":-5,"_176":208,"_178":-5,"_179":209,"_181":210},{"_74":191,"_162":192,"_164":193,"_166":194,"_168":-5,"_169":-5,"_170":195,"_172":196,"_15":197,"_17":18,"_175":-5,"_176":198,"_178":-5,"_179":199,"_181":200},{"_74":183,"_162":184,"_164":-5,"_166":185,"_168":-5,"_169":83,"_170":186,"_172":186,"_15":187,"_17":18,"_175":-5,"_176":188,"_178":-5,"_179":189,"_181":190},{"_74":161,"_162":163,"_164":165,"_166":167,"_168":-5,"_169":-5,"_170":171,"_172":173,"_15":174,"_17":18,"_175":-5,"_176":177,"_178":-5,"_179":180,"_181":182},"HIPAA Module - Task Completion Guide","slug","hipaa-module-task-completion-guide","url","https://kb.trycomp.ai/HIPAA-Module-Task-Completion-Guide-35fa1b1858b8801084cdf591dae23f19","content","This guide walks you through each HIPAA task in Comp AI with practical, SaaS-friendly advice on how to complete it well (not just check the box). Each section covers what the task is, why it matters and how to complete it in the platform.\n\n> 💡 Who this is for: SaaS companies that handle Protected Health Information (ePHI) - either as a Covered Entity (you provide services directly to patients/providers) or, far more commonly, a Business Associate (you process ePHI on behalf of a customer).\n\n> ⚠️ Important: HIPAA does not have a formal certification. Compliance is demonstrated through documented controls and evidence of operation. Completing these tasks well is what you'll show during a customer security review, an OCR audit, or after an incident.\n\n| Task | Typical Cadence | HIPAA Citation |\n| ------------------------------------- | ----------------------------- | ------------------------- |\n| Risk Analysis & Treatment Plan | Annually + on major change | §164.308(a)(1)(ii)(A)–(B) |\n| Security Officer Assignment | Once + review annually | §164.308(a)(2) |\n| Workforce Authorization & Supervision | Continuous (review quarterly) | §164.308(a)(3)–(4) |\n| Contingency Plan Testing & Revision | Annually at minimum | §164.308(a)(7) |\n| Business Associate Agreement Registry | Continuous (review annually) | §164.308(b), §164.314(a) |\n| Facility Security Plan | Annually | §164.310(a)(2)(ii) |\n| Media Sanitization & Disposal Log | Continuous | §164.310(d)(2)(i)–(ii) |\n\nCitation: §164.308(a)(1)(ii)(A) and (B)\n\nA documented assessment of where ePHI lives in your environment, what could go wrong, how likely and impactful those scenarios are, and what you've decided to do about them. This is the foundational HIPAA control - every other safeguard should trace back to a risk identified here.\n\nRisk analysis is the single most-cited deficiency in OCR enforcement actions. They want to see that you understand your specific environment, not a generic template with \"Cloud Provider\" listed once.\n\nThis task is handled in the Risk tab.\n\nIdentify every system that creates, receives, maintains, or transmits ePHI. For a SaaS company this usually includes: your production database, application logs, backups, S3/blob storage, CI/CD pipelines that touch fixtures, customer support tools (Zendesk/Intercom), and any analytics/observability stack.\n\nFor each system, log risks covering the CIA triad: Confidentiality (unauthorized disclosure), Integrity (unauthorized modification), and Availability (loss of access).\n\nAssess each risk on likelihood × impact, document the treatment decision (mitigate / accept / transfer / avoid).\n\nOnce all HIPAA-relevant risks are logged and assessed, mark the task complete.\n\nePHI accidentally written to application logs or error tracking (Sentry, Datadog)\n\nePHI leaving production via developer database access or pulled into staging fixtures\n\nBackups stored without encryption or with overly permissive IAM\n\nThird-party AI/LLM features sending ePHI to a sub-processor without a BAA\n\nMisconfigured S3 buckets or public sharing in collaboration tools\n\nCompromised employee credentials (especially without MFA on admin accounts)\n\nInsider access to customer ePHI without business need\n\nRansomware affecting production or backup environments\n\n❌ Treating the risk register as a one-time deliverable. Update it when you ship a new feature that touches ePHI, change a sub-processor, or expand to a new region.\n\n❌ Listing risks without assigning ownership or a treatment decision.\n\n❌ Marking everything \"Low\" to make the heatmap look clean.\n\nRefresh the analysis annually at minimum.\n\nRe-run any time you have a material change: new product feature touching ePHI, new sub-processor, infrastructure migration, M\\&A, or post-incident.\n\nCitation: §164.308(a)(2)\n\nA named individual who owns your HIPAA program. This is a required designation - not optional, not \"shared.\" One person, in writing.\n\nIt establishes accountability. During an incident, OCR wants to know who was responsible for the program that failed.\n\nDecide who owns this. In most early-stage SaaS companies it's the CTO, Head of Security, or Head of Compliance. At larger orgs it sits with a dedicated CISO or Security Officer.\n\nGet a signed designation letter (template below) on file.\n\nUpload the signed designation to the task and ensure the person's name appears in your security policies as the responsible party.\n\n> 📌 Same person can hold both roles. HIPAA also requires a Privacy Officer (§164.530(a)(1)). At small SaaS companies these are typically the same individual; document that explicitly.\n\nHIPAA SECURITY OFFICIAL DESIGNATION Effective Date: \\[DATE] Organization: \\[LEGAL ENTITY NAME] Pursuant to 45 CFR §164.308(a)(2), \\[ORGANIZATION] hereby designates: \\[FULL NAME], \\[JOB TITLE] Email: \\[EMAIL] as the HIPAA Security Official responsible for the development, implementation, and ongoing management of the policies and procedures required under the HIPAA Security Rule. Scope of responsibility includes: • Maintaining the organization's risk analysis and risk treatment program • Approving and reviewing security policies and procedures • Overseeing the workforce security and access management program • Coordinating incident response and breach notification procedures • Coordinating contingency planning and testing • Managing the Business Associate Agreement program • Conducting (or commissioning) periodic security evaluations • Workforce security awareness training oversight This designation remains in effect until rescinded in writing. \\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_ \\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_ \\[CEO / AUTHORIZING OFFICER] \\[SECURITY OFFICIAL] Signature & Date Signature & Date (acceptance)\n\n❌ Designating \"the security team\" instead of a named person.\n\n❌ Letting the designation go stale after the named person leaves. Update it the day responsibility transfers.\n\nCitation: §164.308(a)(3) and (a)(4)\n\nDocumented evidence that (a) you've decided who is allowed to access ePHI and why, and (b) you actively review and supervise that access.\n\nMost breaches involve a credential or access path that should never have existed in the first place. This control is how you prove you grant access deliberately and revoke it promptly.\n\nThis task is satisfied by the RBAC (Role-Based Access Control) Document form in the Documents tab. To get full credit:\n\nOpen the RBAC document and confirm every role with potential ePHI access is listed.\n\nFor each role, document: who can grant the access, what business justification is required, and how it's reviewed.\n\nEnsure the document references your joiner/mover/leaver process and your periodic access review cadence (quarterly is the SaaS norm).\n\nHave the Security Officer review and sign off.\n\nA clear matrix of roles → systems → permission levels (e.g., Engineer → Production DB → no direct query access except via break-glass)\n\n\"Need to know\" enforced via just-in-time access where possible (e.g., Teleport, AWS SSO with short-lived sessions)\n\nAll ePHI-bearing systems require SSO + MFA\n\nA documented quarterly access review where role owners attest to who should still have access\n\nTermination workflow that revokes access within hours (ideally automated via SCIM/identity provider)\n\nLogged access to customer ePHI for support purposes, with a documented business reason per access event\n\nACCESS REVIEW - Q\\[X] \\[YEAR] System: \\[SYSTEM NAME] Reviewer (role owner): \\[NAME] Date: \\[DATE] For each user listed in the attached export: \\[ ] Still employed and in role requiring this access \\[ ] No longer needs this access - REMOVE \\[ ] Access level should be reduced to: \\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_ Reviewer signature: \\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_ Security Officer countersign: \\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\n\n❌ Confusing \"we use Okta\" with \"we have an access management program.\" The tool is not the control.\n\n❌ Never reviewing access for shared production tools (DataDog, Sentry, etc.).\n\n❌ Allowing engineers to self-grant production access.\n\nQuarterly access reviews\n\nImmediate (same-day) deprovisioning on termination\n\nAnnual RBAC document review\n\nCitation: §164.308(a)(7)\n\nA periodic, documented test of your ability to recover from a disaster - and the changes you made based on what you learned.\n\nThe contingency plan itself has five required parts under HIPAA:\n\nData backup plan - how you back up ePHI\n\nDisaster recovery plan - how you restore systems\n\nEmergency mode operation plan - how you keep critical functions running during a disaster\n\nTesting and revision procedures - how you validate the above\n\nApplications and data criticality analysis - which systems are most critical\n\nA plan that has never been tested is theatre. They want evidence you've actually rehearsed.\n\nUpload a test report covering:\n\nDate of test\n\nScenarios tested (e.g., ransomware on production DB, AWS regional outage, primary on-call unavailable during incident)\n\nParticipants (roles + names)\n\nRTO/RPO results - what you targeted vs. what you achieved\n\nGaps identified\n\nPlan revisions made as a result\n\nYou don't need to nuke prod. Start small and escalate:\n\nTabletop exercise (1–2 hours, conference room) - walk through a scenario, identify gaps. Great starting point.\n\nRestoration test - actually restore the most recent backup to a sandbox environment, verify integrity, time it.\n\nFailover drill - fail over to a secondary region or read replica, measure how long until traffic is serving correctly.\n\nFull game-day - surprise scenario announced morning-of, full team responds.\n\nMost early SaaS companies do one tabletop + one restoration test per year as a minimum.\n\nCONTINGENCY PLAN TEST REPORT Test Date: \\[YYYY-MM-DD] Test Type: \\[Tabletop / Restoration / Failover / Game-day] Scenario: \\[e.g., \"Ransomware encrypts primary production PostgreSQL cluster; backups are intact but last verified restore was 6 months ago\"] Test Lead: \\[NAME] Participants: \\[NAME - ROLE] \\[NAME - ROLE] OBJECTIVES • Validate ability to detect \\[X] • Validate ability to restore \\[Y] within RTO of \\[Z hours] • Validate communication procedures TARGETS RTO (Recovery Time Objective): \\[e.g., 4 hours] RPO (Recovery Point Objective): \\[e.g., 15 minutes data loss] RESULTS Actual recovery time: \\[e.g., 6h 12m] Actual data loss: \\[e.g., 22 minutes] Met RTO? \\[Y/N] Met RPO? \\[Y/N] TIMELINE HH:MM - Incident declared HH:MM - Incident commander assigned HH:MM - Backup restoration initiated HH:MM - Service validation began HH:MM - Service restored GAPS IDENTIFIED 1. \\[e.g., Runbook for DB restore was 18 months out of date] 2. \\[e.g., Status page credentials not in 1Password - caused 25min delay] PLAN REVISIONS 1. \\[Description] - Owner: \\[NAME] - Due: \\[DATE] 2. \\[Description] - Owner: \\[NAME] - Due: \\[DATE] NEXT TEST Type: \\[e.g., Restoration test] Target date: \\[YYYY-MM-DD] Signed: \\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_ \\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_ Security Officer Test Lead\n\n❌ \"We've never had an outage so we don't need to test.\" Untested backups have a near-100% failure rate when you actually need them.\n\n❌ Testing only the happy path - restore the database when the documented runbook author is on call.\n\n❌ Not following through on remediation items.\n\nAt least annually, and after any major architectural change.\n\nCitation: §164.308(b) and §164.314(a)\n\nA complete list of every vendor (Business Associate) that creates, receives, maintains, or transmits ePHI on your behalf - with a signed BAA on file for each.\n\nMissing BAAs are one of the most common HIPAA violations and the easiest for an auditor to spot. They'll ask for the list and then sample it.\n\nIn the Vendor section:\n\nCreate a new task for each applicable vendor.\n\nUpload the signed BAA in the comments of that task.\n\nTag the vendor's BAA execution date and next review date.\n\nYes: Any third party that processes, stores, or transmits ePHI on your behalf.\n\nCloud infrastructure (AWS, GCP, Azure, Cloudflare)\n\nDatabase/data warehouse providers handling ePHI\n\nEmail providers if ePHI flows through them (Google Workspace, Microsoft 365)\n\nCustomer support tools if ePHI appears in tickets (Zendesk, Intercom, Front)\n\nLogging/observability if ePHI hits logs (Datadog, Sentry - note: not all offer BAAs)\n\nCommunications platforms (Twilio, SendGrid - only Twilio's HIPAA-eligible products)\n\nAI/LLM providers if you send ePHI to them\n\nPayroll/HR? Usually not - they don't see patient ePHI\n\nNo: \"Conduit\" services that only transmit data without persistent access (rare in practice - read the rule carefully), and vendors that demonstrably never touch ePHI.\n\nA surprising number of SaaS tools do not offer BAAs, or offer them only on enterprise tiers. Before you sign with a vendor that will touch ePHI, ask: \"Do you offer a BAA, on which plan, and at what additional cost?\" Some popular ones to verify:\n\nSentry - BAAs available on Business plan and above\n\nDatadog - BAA on Enterprise plan\n\nSlack - BAA on Enterprise Grid\n\nNotion - does not currently offer a BAA (last checked - verify before relying)\n\nOpenAI - BAA available for API/Enterprise customers, not free ChatGPT\n\nAlways verify the current BAA availability and tier on the vendor's site before assuming.\n\n| Field | Example |\n| ----------------------------- | -------------------------------------------- |\n| Vendor name | Acme Logs Inc. |\n| Service/product used | Log aggregation |\n| Data categories | ePHI in application logs |\n| BAA executed (Y/N) | Y |\n| BAA execution date | 2025-03-14 |\n| BAA expiry / renewal date | 2026-03-14 |\n| Storage region | us-east-1 |\n| BAA file location | \\[link to Comp AI task] |\n| Sub-processors used by vendor | AWS, Snowflake (review their list quarterly) |\n| Owner | Security Officer |\n\n❌ Signing a Data Processing Agreement (GDPR) and assuming it covers HIPAA. It doesn't. You need a HIPAA-specific BAA.\n\n❌ Forgetting that you also need to sign BAAs as a Business Associate with your downstream sub-processors (if you process ePHI on behalf of a covered entity customer, your vendors are sub-business-associates).\n\n❌ Letting BAAs lapse silently when contracts renew.\n\nReview the full registry at least annually.\n\nRe-check on any contract amendment, vendor acquisition, or change in services.\n\nCitation: §164.310(a)(2)(ii)\n\nDocumentation of how you safeguard the physical facilities and equipment that house ePHI from unauthorized physical access, tampering, and theft.\n\nRequired sections of the plan:\n\nAccess control & validation - who can enter facilities, how access is granted/revoked, visitor procedures\n\nContingency operations - how facility access continues during emergencies\n\nMaintenance records - log of repairs/modifications to physical security components (locks, doors, cameras)\n\nDevice & media controls - handling of hardware that stores or accesses ePHI\n\nUpload:\n\nThe signed Facility Security Plan\n\nPhotos of safeguards (door locks, badge readers, server room, security cameras, alarm panels)\n\n> You can mark this task as Not Relevant if your team is fully remote and no physical ePHI or ePHI-storing equipment is kept at a company facility.\n\nHowever - and this is the part most people miss - you should still document why it's not applicable and address remote-work physical safeguards.\n\nFACILITY SECURITY PLAN - APPLICABILITY ASSESSMENT Organization: \\[NAME] Date: \\[YYYY-MM-DD] Prepared by: \\[SECURITY OFFICIAL] 1. ORGANIZATIONAL FACILITIES \\[Organization] does not operate any owned or leased office facility in which ePHI is processed, stored, or accessed in physical form. 2. ePHI STORAGE LOCATIONS All ePHI is processed in \\[CLOUD PROVIDER] data centers in \\[REGIONS]. Physical security of these facilities is covered by \\[PROVIDER]'s compliance program (SOC 2 Type II, HIPAA-eligible services, BAA on file). See: \\[link to BAA registry]. 3. ENDPOINT DEVICES Workforce members access systems from company-issued or BYOD endpoints. Physical safeguards for endpoints are addressed in the Workforce Endpoint Security Policy and include: • Full-disk encryption (FileVault / BitLocker) enforced via MDM • Auto-lock after \\[X] minutes of inactivity • Remote wipe capability via MDM • Reporting requirement for lost/stolen devices within \\[X] hours • No local storage of ePHI permitted; ePHI accessed only via authorized cloud applications 4. APPLICABILITY DETERMINATION The Facility Security Plan requirements under §164.310(a)(2)(ii) are addressed through: • Reliance on covered cloud provider physical safeguards (BAA) • Endpoint controls described in section 3 No on-premises facility plan is required. 5. REVIEW TRIGGERS This determination will be reassessed if \\[Organization]: • Opens any physical office • Begins storing ePHI on-premises • Begins handling physical PHI (paper records, etc.) Signed: \\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_ \\[Security Official], \\[Date]\n\nCover at minimum: badge access logs, visitor sign-in, server/network closet access, camera coverage of entry points, alarm system, after-hours procedures, lost-badge process.\n\n❌ Marking N/A without documentation. \"We're remote\" is not a control; the written justification is.\n\n❌ Forgetting endpoint physical controls (laptops are facilities for compliance purposes when they hold cached ePHI).\n\nCitation: §164.310(d)(2)(i) and (ii)\n\nA log proving you securely dispose of, reuse, and move hardware and electronic media that contained ePHI - using methods that make the data unrecoverable.\n\nDiscarded drives full of recoverable patient data has been a real, repeated, six-figure-penalty source of HIPAA breaches.\n\nMaintain a running log. Every entry should include:\n\nAsset ID / serial number\n\nAsset type (laptop, server, mobile, USB, etc.)\n\nDate of action\n\nAction type (disposal, reuse internally, return to lessor, transfer)\n\nSanitization method\n\nVerification (who confirmed, signature)\n\nCertificate of destruction (if applicable)\n\nCryptographic erase - destroying the encryption key on a fully encrypted drive (fast, effective if encryption was always on)\n\nSoftware wipe - NIST SP 800-88 compliant overwrite (e.g., DBAN for spinning disks, vendor secure-erase for SSDs)\n\nPhysical destruction - shredding, pulverizing, incinerating (required for failed/unreadable drives)\n\nDegaussing - magnetic media only; not effective on SSDs\n\n> 🔐 SaaS shortcut: If all endpoints are fully-disk encrypted from day one (enforced via MDM) and cloud storage is encrypted at rest, cryptographic erase is the fastest path. Document this in your policy and reference it in each log entry.\n\n| Date | Asset ID | Type | Owner | Action | Method | Verified By | Cert. of Destruction |\n| ---------- | --------- | --------------------- | ---------- | ------------------------- | ----------------------------------------- | --------------------- | -------------------- |\n| 2026-01-12 | MBP-2451 | MacBook Pro | jane\\@co | Disposed (e-waste vendor) | Crypto-erase + vendor shred | A. Smith | CoD #4421 attached |\n| 2026-02-03 | SRV-DB-07 | Server (AWS instance) | infra-team | Terminated | EBS cryptographic erase (KMS key deleted) | DevOps automation log | n/a - cloud |\n| 2026-02-18 | USB-014 | USB drive | bob\\@co | Destroyed in-house | Physical shred | A. Smith (witnessed) | Photo attached |\n\nCloud resources count too. Document your process for:\n\nTerminating EC2/compute instances - does your IaC handle volume deletion?\n\nDeleting S3 buckets / blob storage that held ePHI\n\nKMS key rotation/deletion as your cryptographic-erase method\n\nDatabase snapshot lifecycle\n\nA monthly automated report from your cloud account showing terminated ePHI-bearing resources can satisfy this for cloud assets.\n\n❌ \"We just toss old laptops in the e-waste bin.\" Get a vendor that provides Certificates of Destruction.\n\n❌ Reusing an old engineer's laptop without a documented wipe.\n\n❌ Selling old equipment on secondary markets without verifiable sanitization.\n\nContinuous - every disposal/reuse/transfer event gets a log entry within the same business day. Review the log quarterly for completeness.\n\nThese seven tasks aren't independent - they form an interconnected program:\n\nYour Risk Analysis identifies what could go wrong.\n\nYour Security Officer owns the response.\n\nWorkforce Authorization, BAAs, Facility Security, and Media Sanitization are the day-to-day controls that mitigate the identified risks.\n\nContingency Plan Testing validates that the controls work when stressed.\n\nIf you can tell that story end-to-end - with documents, dates, and named owners - you have a defensible HIPAA program. If any link is missing or stale, that's where to focus next.\n","collectionId","projectId","createdAt","2026-06-10T13:39:29.424Z","updatedAt","2026-06-23T17:25:32.869Z","943b570d-1c91-4805-8aa5-f388a610eb85","collection","collectionPath",[],"hostedUrl","userGroups",[],"channels",[],"Handling \"New Findings\" Notifications During Audit Review","handling-new-findings-notifications-during-audit-review","## Overview\n\nDuring the auditor's review, you may receive **\"New findings\"** email notifications from the platform as the auditor flags issues. A common question is whether to fix these issues as they come in, or wait until the auditor has completed their full initial review.\n\n## Both Approaches Are Acceptable\n\n**Option 1: Fix findings as they come in**\\\nYou can address each finding immediately as you receive the email notification. This is perfectly fine.\n\n**Option 2: Wait until the auditor completes their initial review**\\\nThe typical recommended approach is to wait until the auditor has flagged that they have completed their initial review, then send a follow-up message so all findings can be addressed at once.\n\n## Summary\n\nEither approach works — there is no strict requirement to wait. If you prefer to resolve issues incrementally as notifications arrive, that is acceptable. If you prefer to batch your remediation efforts after the auditor's initial review is complete, that is also fine.","2026-05-11T19:52:54.950Z","26eadc61-6972-4035-b92e-9ae439bb7d0c",[],[],[],"Governance, Roles & Documentation","governance-roles-documentation","https://kb.trycomp.ai/Governance-Roles-Documentation-388a1b1858b8810297fadd25c3c15653","Governance, roles & documentation. These five tasks are the accountability backbone of GDPR: who is responsible, the paperwork that proves it, and the records a regulator asks for first. Each section is named exactly as the task appears in your platform, so jump straight to the one you're stuck on.\n","2026-06-23T17:25:33.417Z","2026-06-23T17:25:33.445Z","7f411b0c-c020-47d8-a90c-326d21f5fc63",[],[],[],"Governance, Risk & Compliance","governance-risk-compliance","https://kb.trycomp.ai/Governance-Risk-Compliance-327a1b1858b880caa42cc9a4ad6c9e62","[← Get Audit Ready](https://kb.trycomp.ai/p/313a1b1858b880baa983e8df56697e7b?pvs=25) • [↑ Evidence](https://kb.trycomp.ai/p/2f0a1b1858b880bd8544ecb562b8a0d8?pvs=25)\n\n#### Public policies\n\n#### Incident Response\n\nISO 27001 Specific\n\n#### Statement of Applicability\n\n#### Legal Proof of Company Registration\n\n#### Internal Security Audit\n\nGDPR Specific\n\n#### Appoint or Review Data Protection Officer (GDPR)\n\n#### Manage Third-party and EU Rep relations (GDPR & NEN 7510)\n\n#### Review International Data Transfers (GDPR)\n","2026-06-10T13:39:31.464Z","2026-06-23T17:25:34.491Z","d14ea115-0ded-43fe-8c7a-fa28ea785827",[],[],[],"GitHub readonly role issue for private repositories","github-readonly-role-issue-for-private-repositories","This is due to there not being a readonly role for private repos. GitHub requires write to read private repos","2026-02-03T17:27:13.566Z","2bdc9dda-dcaf-4502-9672-e39f2ba29b81",[],[],[],"GitHub Integration: Repository Selection","github-integration-repository-selection","# GitHub Integration: Repository Selection\n\n## Overview\n\nWhen setting up the GitHub integration, you choose which repositories Unthread monitors. Repository selection is handled through a **multi-select dropdown**, giving you full flexibility to include exactly the repos that matter to your team.\n\n---\n\n## How Repository Selection Works\n\n- During integration setup (or when editing the integration), a multi-select dropdown lists all repositories accessible to your connected GitHub account or organization.\n- You can select **one or more repositories** to bring into scope.\n- Only the repositories you select will be monitored — no others are included automatically.\n\n---\n\n## Choosing Which Repos to Include\n\nThere is no fixed requirement on how many repositories to select. Common patterns include:\n\n| Scenario | Typical Selection |\n| --- | --- |\n| Single-product team | One main application repository |\n| Monorepo setup | The single monorepo |\n| Multi-repo organization | A few key repositories (e.g., core services) |\n\nMost teams include **one or two primary repositories** — often a main monorepo or the most active application repo. You can always return to the integration settings to add or remove repositories as your needs change.\n\n---\n\n## Tips\n\n- **Start focused.** Begin with your most important repository and expand the selection later if needed.\n- **You can update your selection at any time** by revisiting the GitHub integration settings.\n- **All selected repositories are treated equally** — the same monitoring rules apply across every repo you include.\n\n---\n\n## Related\n\n- GitHub Integration Setup\n- Managing Integrations","2026-06-24T12:07:54.800Z","2026-06-24T12:12:11.689Z","f8d70660-c57a-49c6-b622-522bb6c79b8e",[],[],[],"# GitHub Integration: Repository Selection","github-integration-repository-selection-2","# GitHub Integration: Repository Selection\n\n## Overview\n\nWhen setting up the GitHub integration, you choose which repositories Unthread monitors. Repository selection is handled through a **multi-select dropdown**, giving you full flexibility to include exactly the repos that matter to your team.\n\n---\n\n## How Repository Selection Works\n\n- During integration setup (or when editing the integration), a multi-select dropdown lists all repositories accessible to your connected GitHub account or organization.\n- You can select **one or more repositories** to bring into scope.\n- Only the repositories you select will be monitored — no others are included automatically.\n\n---\n\n## Choosing Which Repos to Include\n\nThere is no fixed requirement on how many repositories to select. Common patterns include:\n\n| | |\n| --- | --- |\n| | |\n| | |\n| | |\n\n- **Single-product team** — One main application repository\n- **Monorepo setup** — The single monorepo\n- **Multi-repo organization** — A few key repositories (e.g., core services)\n\nMost teams include **one or two primary repositories** — often a main monorepo or the most active application repo. You can always return to the integration settings to add or remove repositories as your needs change.\n\n---\n\n## Tips\n\n- **Start focused.** Begin with your most important repository and expand the selection later if needed.\n- **You can update your selection at any time** by revisiting the GitHub integration settings.\n- **All selected repositories are treated equally** — the same monitoring rules apply across every repo you include.\n\n---\n\n## Related\n\n- GitHub Integration Setup\n- Managing Integrations","2026-06-24T12:31:02.244Z","2026-06-24T12:33:53.480Z","51fffe01-f92d-4892-9766-e0dd75868912",[],[],[],"Getting Started: How to Kick Off Your Onboarding","getting-started-how-to-kick-off-your-onboarding","## Getting Started with Comp AI\n\nWhen you're ready to begin, look for the **green button** pinned at the top of your shared Slack channel with the Comp AI team. Click it to spin up your org and launch the onboarding form.\n\nCompleting the onboarding form is the first step in your compliance journey. Once your org is set up, the CS agent in your Slack channel is available to answer questions — it's trained on the Comp AI knowledge base and handles most questions on the spot.\n\n## Getting Support\n\nIf the CS agent's response doesn't fully address your question, you'll see an option to **create a ticket** directly in that thread. You can also tag a team member in the channel and someone will jump in.","2026-06-30T22:30:11.404Z","42f603b0-aad9-4944-a2f2-8bdc50e1cd38",[],[],[],"Framework Updates","framework-updates-2","https://kb.trycomp.ai/Framework-Updates-372a1b1858b881719966df46cf4f6f28","![🔄 Callout icon](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)\n\nKeep your frameworks current so your audit runs smoothly. When a Framework Update appears on your Overview page, apply it - there's little reason not to.\n\nPeriodically, a Framework Update will appear on your Overview page, suggesting you update your framework. We recommend doing this whenever it appears - updates rarely require significant additional effort, and keeping current helps your audit run smoothly.\n\nClearer evidence tasks: Updates to evidence task names and descriptions to make them more helpful. All existing evidence is retained and your integrations are kept.\n\nImproved control mapping: Tweaks to control mapping so the audit runs smoothly and the auditor can find what they need—often the most helpful change.\n\nRecommended policies: Occasionally a recommended additional policy. This is added as a draft in the Policies tab for you to review before publishing.\n\nBecause these updates rarely require significant effort, we suggest keeping all of them up to date wherever possible.\n\nAs of April 2026, many evidence tasks were superseded by Documents in the Documents tab. Where this applies, it's worth (but again not mandatory):\n\nMoving the uploaded evidence from the old task to the corresponding document in the Documents tab.\n\nRemoving the old task once the evidence has been moved across.\n\nThis ensures controls are mapped correctly and helps your auditor find the specific evidence quickly.\n\n![💬 Callout icon](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)\n\nNeed a hand? Reach out to the team and we'll help you move evidence across or answer any questions you have on changes you’ve seen after applying the framework updates.\n","2026-06-10T13:39:29.684Z","2026-06-23T17:25:33.030Z","cbf5cdde-7615-4faa-8fcf-ae375b4d2b82",[],[],[],"Framework updates","framework-updates","# Framework updates\n\nWhen the standard or template behind a framework you've adopted changes, Comp now shows you those changes in-app so you can review and apply them on your own schedule — without losing the edits you've made.\n\n## **Where you'll see updates**\n\n**Overview page banner.** When one or more of your frameworks has a new version available, an \"**# framework updates available**\" banner appears at the top of your Overview page with a **NEW** badge. Click **Review Changes** to expand it; each framework gets a row showing the version jump (e.g. `v2 → v3`) and a **Review update** button.\n\n**Framework detail page.** Open any framework and you'll also see an \"Update available\" section linking to the same review flow.\n\nThe banner disappears as soon as you apply or roll back an update — no refresh needed.\n\n## **Reviewing an update**\n\nClicking **Review update** opens a side-by-side change summary for that framework version. At the top you'll see four stat cards:\n\n- **New** — requirements, controls, policies, or tasks being added\n- **Removed** — items being archived\n- **Modified** — items whose template content changed\n- **Links affected** — control ↔ policy/task/requirement/document-type relationships being added or removed\n\nUse the **All / Added / Removed / Modified** tabs to filter the change list. Each row shows the item name, identifier (where applicable), and a colored marker (`+`, `−`, `~`).\n\n### **Your edits are protected**\n\nAnything you've customized stays yours. Items you've edited locally appear under **Your edits preserved** with the note: *\"Your edits are kept. Template changed underneath.\"*\n\nFor **published policies**, applying an update doesn't overwrite the published version — it creates a **new draft** with the template changes so you can review and re-publish on your timeline.\n\n## **Applying an update**\n\nClick **Apply N changes** at the bottom of the review page, then confirm in the dialog. The framework instance updates to the new version, and you'll land back on the framework page.\n\n> Apply will update your framework instance. **You can roll back within 14 days.**\n\nIf you need to revert, use the rollback option on the framework detail page within that 14-day window.\n\n## **Permissions**\n\n- **Reviewing updates** — visible to anyone who can see frameworks\n- **Applying or rolling back updates** — requires the `framework:update` permission (Owner, Admin, and any custom role granted that permission)\n\nIf you don't have permission, you'll still see the banner and the review page, but the **Review update** and **Apply** buttons won't appear.\n\n## **What's covered**\n\nFramework updates can include changes to:\n\n- Requirements (added, removed, modified)\n- Controls (added, archived, modified — with your edits preserved)\n- Policies (added, archived, modified — published policies get a new draft)\n- Tasks (added, archived, modified — with your edits preserved)\n- Links between controls and policies, tasks, requirements, and document types\n\n## **Newly available frameworks**\n\nIn addition to versioning improvements, **PIPEDA** and **CCPA** are now available alongside the existing framework catalog and can be turned on for your Trust portal.\n\n## **FAQ**\n\n**Will applying an update break my audit evidence?**\\\nNo. Items you've customized are preserved, and removed items are archived rather than deleted, so historical evidence remains intact.\n\n**Can I update one framework at a time?**\\\nYes. Each framework version is reviewed and applied independently from its own row in the banner.\n\n**Why don't I see a banner?**\\\nEither none of your frameworks have updates available, or your frameworks are already on the latest version.","2026-05-08T12:25:25.461Z","2026-05-08T12:27:26.740Z","7e15f4c6-98e7-4121-9e67-57ec76a0cc5a",[],[],[],"Frameworks & Controls","frameworks-controls","**Product area:** Frameworks (built-in) & Controls\\\n**Summary:** Frameworks are the compliance standards a customer works toward (SOC 2, ISO 27001, HIPAA, etc.). Adding a framework instantly builds out the **controls** and the policy/task/document requirements needed to satisfy it. **Controls** are the individual security practices that get \"satisfied\" by linked evidence — and one control can satisfy many frameworks at once, so overlapping work isn't duplicated.\n\n**Disambiguation (use to route questions correctly):**\n\n- **Frameworks** = the standards you're certifying against.\n- **Controls** = the practices that satisfy framework requirements; mostly managed inside a framework's detail page.\n- **Custom Frameworks** = customer-authored frameworks (covered in a separate article).\n- If a customer asks \"how do I start SOC 2?\" → add the framework. \"Why is this control not green?\" → control evidence.\n\n---\n\n## **Core facts**\n\n- **Add from the Frameworks page** via **Add Framework**; you can enable several at once.\n- **Adding a framework auto-builds its structure:** it creates the framework's controls, maps them to requirements, and links the policy/task/document requirements — but it does **not** auto-complete anything. You still satisfy controls by publishing policies, completing tasks, and submitting documents.\n- **Shared controls:** a single control can map to multiple frameworks, so completing it counts everywhere it applies.\n- **Evidence that counts:** published **policies**, done/not-relevant **tasks**, and **documents** submitted within the last 6 months.\n- **No auto-mapping AI:** controls/policies aren't AI-generated when you add a framework — the structure comes from built-in templates.\n\n---\n\n## **Built-in frameworks offered**\n\nSOC 2 (Type I & II), ISO 27001, ISO 42001, ISO 9001, HIPAA, GDPR, PCI DSS (and PCI DSS Level 1), NEN 7510, and CCPA.\n\n---\n\n## **Structure**\n\nFrameworks follow the same hierarchy as custom frameworks:\n\n- **Framework** → contains **Requirements** (what the standard demands, e.g. \"CC6.1\")\n- **Requirement** → satisfied by one or more **Controls** (the practices)\n- **Control** → satisfied by linked **Evidence** (policies, tasks, documents)\n\n**How completion flows up:**\n\n- A **control** becomes **Satisfied** when all its linked policies are **Published**, all its linked tasks are **Done** (or Not relevant), and any required documents have a **fresh submission** (within 6 months).\n- A **requirement** is satisfied when its mapped controls are satisfied.\n- A **framework's compliance %** is the share of mapped evidence that's complete across all its controls.\n\n---\n\n## **Framework detail page**\n\nOpening a framework shows its compliance progress plus tabs:\n\n- **Controls** — the controls for this framework.\n- **Requirements** — the standard's requirements, mapped to controls.\n- **Progress / History** — progress over time and change history.\n\n**Controls table columns:** Name, Requirement(s), Compliance (% bar), Status, Policies ({done}/{total}), Tasks ({done}/{total}), Documents ({done}/{total}). Searchable and sortable.\n\n**Actions:** **Link Requirement** (reuse requirements from other frameworks), **Add Custom Requirement**, and **Delete Framework** (with permission).\n\n---\n\n## **Controls**\n\nA **control** is a discrete security practice (e.g., \"Access Control,\" \"Firewall Configuration\"). Controls are organization-wide and are primarily viewed and managed from within a framework's **Controls** tab.\n\n**A control's detail page** shows tabs for its linked **Policies**, **Tasks**, and **Requirements** (with each requirement's identifier, name, and description). Linking the right policies, tasks, and documents is what drives a control to **Satisfied**.\n\n---\n\n## **Statuses (what each means)**\n\n**Control status**\n\n| **Status** | **Label shown** | **Meaning** |\n| --- | --- | --- |\n| Completed | **Satisfied** | All linked evidence is complete. |\n| In progress | **In Progress** | Partially complete. |\n| Not started | **Not Started** | No evidence yet. |\n| Not relevant | **Not Relevant** | Marked as not applicable. |\n\n**Framework status** (from its compliance %)\n\n| **Score** | **Status** |\n| --- | --- |\n| 100% | **Compliant** |\n| 1–99% | **In Progress** |\n| 0% | **Not Started** |\n\n> Evidence completion rules: policy = **Published**; task = **Done** / **Not relevant**; document = submitted **within the last 6 months**.\n\n---\n\n## **Sharing controls across frameworks**\n\nOne control can be mapped to requirements in multiple frameworks. For example, a single \"Firewall Configuration\" control backed by a published Firewall Policy can satisfy both a SOC 2 requirement and an ISO 27001 requirement simultaneously — so adding a second framework that overlaps with your first reuses the work you've already done.\n\n---\n\n## **Managing & removing frameworks**\n\n- **Framework updates:** when a built-in framework's template changes, you can preview the changes and sync to the new version (controls/requirements added or archived accordingly).\n- **Delete framework:** removes the framework instance and its requirement mappings. The underlying **controls remain** in your organization for use by other frameworks — deleting a framework doesn't wipe your evidence.\n\n---\n\n## **Roles & permissions (who can do what)**\n\n| **Capability** | **Owner** | **Admin** | **Auditor** |\n| --- | --- | --- | --- |\n| View frameworks & controls | ✓ | ✓ | ✓ (read-only) |\n| Add a framework | ✓ | ✓ | ✗ |\n| Link/add requirements & controls | ✓ | ✓ | ✗ |\n| Delete a framework | ✓ | ✓ | ✗ |\n\n(Uses the `framework` and `control` permissions.)\n\n---\n\n## **Sample Q&A (canned answers the agent can adapt)**\n\n**Q: How do I start working toward SOC 2 (or ISO 27001, HIPAA, etc.)?**\\\nA: On the Frameworks page, click **Add Framework**, select the standard(s), and add them. Comp AI builds out the controls and the policy/task/document requirements automatically — you then satisfy them by publishing policies, completing tasks, and submitting evidence.\n\n**Q: I added a framework but I'm at 0% — is something wrong?**\\\nA: No. Adding a framework creates the structure (controls and requirements) but doesn't complete anything yet. Your percentage rises as you publish the linked policies, finish the linked tasks, and submit the required documents.\n\n**Q: Why is a control still showing \"In Progress\" or \"Not Started\"?**\\\nA: A control only becomes **Satisfied** when all its linked policies are Published, all its linked tasks are Done (or Not relevant), and any required documents have a submission from the last 6 months. Open the control to see which of those is still outstanding.\n\n**Q: Do I have to redo everything for a second framework?**\\\nA: No. Controls are shared — one control can satisfy requirements in several frameworks at once. Overlapping requirements reuse the evidence you've already completed.\n\n**Q: How is the framework compliance percentage calculated?**\\\nA: It's the share of mapped evidence that's complete — published policies, done tasks, and recently submitted documents — across all the controls in that framework.\n\n**Q: If I remove a framework, do I lose my controls and evidence?**\\\nA: No. Deleting a framework removes that framework's mappings, but the controls (and their policies/tasks/evidence) stay in your organization for other frameworks to use.\n\n**Q: Does adding a framework auto-write my policies for me?**\\\nA: Adding a framework sets up the required controls and the policy/task/document slots, but the content itself isn't auto-generated here. (Policy drafting AI lives in the Policies area.)","2026-06-25T23:14:19.312Z","aa799b92-fe65-497e-88af-0157c47fc2f6",[],[],[],"Final Checklist","final-checklist","https://kb.trycomp.ai/Final-Checklist-327a1b1858b880c38c06f4c182dbd73f","Before you notify us to begin your auditor engagement, please run through this rapid checklist to avoid the most common day-one audit traps:\n\nThe Org Chart: Upload an org tree chart under People>Chart, and ensure every person listed on it is also added to your People tab with the employee role.\n\nDevice Compliance: Check People > Devices to confirm every employee laptop is showing a green \"Compliant\" status.\n\nHires/Terminations tracked during audit period: For recent hires, confirm each person has an onboard date set and a background check completed (or a formal external report uploaded) on their profile. For recent terminations, confirm an offboard date is set and the offboarding checklist has been completed. See the [People guidance](https://www.notion.so/313a1b1858b880d18cc5ee438778525c) for where these live. Keep this up to date for every hire and termination going forward—and imperatively throughout your audit period, as your auditor will expect every new joiner and leaver during that window to be tracked here.\n\nThe \"Not Relevant\" Trap: Do not mark tasks as \"Not Relevant\" without asking us first—even small teams must provide evidence for the vast majority of controls.\n\nIf your dashboard is looking green and you've cleared the list above, you are ready!\n\nNotify us in your shared Slack channel so we can officially begin your auditor engagement.\n\n💡\n\nAlso highly recommended: Whenever a Framework Update is available, apply it to keep your framework up to date on the platform - this can make the audit itself smoother. It isn't mandatory, but it's highly recommended. See [Framework Updates](https://www.notion.so/372a1b1858b881719966df46cf4f6f28) for more on what this does.\n","2026-06-10T13:39:14.619Z","2026-06-23T17:25:31.526Z","41b8302e-9123-4c19-ae75-a065011fc075",[],[],[],"final-checklist-2","https://kb.trycomp.ai/Final-Checklist-327a1b1858b880c38c06f4c182dbd73f?pvs=25","2026-06-23T17:25:32.445Z","2026-06-23T17:25:32.482Z","2ce0eef7-1521-42e6-a90c-0ea53daba2a5",[],[],[],"Evidence Gathering Tips","evidence-gathering-tips","### This document lists the tasks found in the **Evidence** tab of the platform, broken into categories. It provides additional guidance for evidence sought by the auditors, including hints for AI automation prompts to generate evidence, along with tailored guidance for small teams and solo founders.\n\nIntroduction to evidence gathering\n\nEvidence collection in the Evidence tab falls into two main categories.\n\nInfrastructure Tasks such as:\n\n- Codebase security\n- Database configurations\n- Frontend implementations\n\nOrganizational Tasks such as:\n\n- Job descriptions\n- Hiring processes\n- Meeting documentation\n\n### **Automated Evidence**\n\nStreamline collection using the Automated Evidence feature for tasks with simple APIs or straightforward data retrieval:\n\n1. Click \"Create Automation\" next to relevant tasks\n2. Enter prompts for the type of automation needed\n3. Example: TLS/HTTPS task - for this task, we can prompt the agent \"Return the SSL Labs Certificate for my website\"\n4. Test the automation, then click Publish to enable scheduled collection\n5. Best suited for: Website certificates, public API endpoints, domain configurations, and other externally accessible information. Avoid using automations for complex infrastructure tasks requiring intricate authentication setups (like AWS security configurations) as these are difficult to automate reliably.\n\n## People & HR\n\n### Organisation Chart\n\n> **⚡ Automation:** Ask the agent to \"Fetch the current organization chart from \\[HR System Name, e.g., Rippling, BambooHR, or Workday\\].\" You can also ask it to \"Generate a list of reporting lines based on manager fields in \\[Google Workspace/Okta\\].\"\n>\n> ⚙️ **General:** The chart must clearly show \"Who reports to whom.\" Ensure every box includes both the person's full name and their job title. An employee list without the visual hierarchy of reporting lines is often rejected by auditors.\\\n> \\*\\***🌱 Small Teams (2+):** Create a single slide in PowerPoint or Google Slides with simple boxes and arrows showing your current team structure. Export this slide as a PDF.\\\n> \\*\\***👤 Solo Founder:** Mark as Not Relevant.\n\n### Employee Descriptions\n\n> **⚡ Automation:** N/A\\\n> \\*\\***⚙️ General:** Upload a sample of job descriptions. If team size is less than 5 - all job descriptions required. For teams larger than 5, sample size of 5 or 10% needed, whichever is greater.\\\n> \\*\\***🌱 Small Teams (2+):** Job descriptions are still required, they can be brief 4-5 line high level descriptions for ultra-small teams.\\\n> \\*\\***👤 Solo Founder:** You can mark the task as not relevant.\n\n### Employee Performance Evaluations\n\n> **⚡ Automation:** N/A\\\n> \\*\\***⚙️ General:** Upload a sample of employee evaluations. They can be anonymised (blur/block out employee name). If team size is less than 5 - all job descriptions required. For teams larger than 5, sample size of 5 or 10% needed, whichever is greater.\\\n> \\*\\***🌱 Small Teams (2+):** Required for all teams 2+. Use a simple Google Doc or the provided template. The critical evidence is the date and the signatures from both the manager and the employee proving the conversation happened. Template link [here](https://docs.google.com/document/d/1dzHOTXlqBORuU9ZVYcsdMJbD0QvLRYxQ/edit?usp=drive_link&ouid=105483817633840137498&rtpof=true&sd=true)\\\n> \\*\\***👤 Solo Founder:** Mark as Not Relevant.\n\n### Employee Verification\n\n> ⚡ Automation: Ask the agent to \"Check \\[HRIS Name, e.g., Rippling/BambooHR\\] for the background check status of all active employees\" or \"List all employees who have a completed 'Identity Verification' task in the onboarding checklist.\"\n>\n> ⚙️ **General:** Create a simple tracking spreadsheet with columns for \"Employee Name,\" \"Verification Date,\" and \"Method\" (e.g., Reference Call or ID Check). Include sign-off. If you use a service like Checkr, a single screenshot of the dashboard showing \"Clear\" statuses is sufficient.\\\n> \\*\\***🌱 Small Teams (2+):** If no new hires and small founding team - comment ‘No new hires’ and mark task as done for now.\\\n> \\*\\***👤 Solo Founder:** Mark as Not Relevant.\n\n### Board Meetings & Independence\n\n> **⚡ Automation:** N/A\\\n> \\*\\***⚙️ General:** To prove \"Independence,\" simply upload a screenshot of a Board Member's LinkedIn profile showing they are an Investor or Advisor, not a full-time employee. Ensure the meeting minutes are dated within the current audit window.\\\n> \\*\\***🌱 Small Teams (2+):** If you don't have a formal board, \"Management Meetings\" are acceptable. Create a simple one-page document titled \"Q3 Management Meeting,\" list \"Security Review\" as an agenda item, and record 2-3 bullet points of what was discussed.\\\n> \\*\\***👤 Solo Founder:** Mark as Not Relevant.\n\n## Access Control (IAM)\n\n### Role-based Access Controls\n\n> **⚡ Automation:** Ask the agent to \"List all user groups and their associated roles in \\[Identity Provider, e.g., Okta/Google Workspace/Azure AD\\].\" Or ask it to \"Check that users in \\[AWS/GitHub\\] are assigned permissions via groups/roles, not directly.\"\\\n> \\*\\***⚙️ General:** Auditors look for the \"Principle of Least Privilege.\" Ensure your evidence shows that not *everyone* is a Super Admin. If you cannot export a clean list, use the spreadsheet template provided [here](https://docs.google.com/spreadsheets/d/1rN2-d0432aBn-F8x-b9YAJecmMiWenaB/edit?usp=drive_link&ouid=105483817633840137498&rtpof=true&sd=true)\\\n> \\*\\***🌱 Small Teams (2+):** Take a screenshot of the \"User Management\" or \"Members\" page in your primary system (like Google Workspace) showing clearly defined columns for \"Role\" (e.g., Admin vs. User).\\\n> \\*\\***👤 Solo Founder:** Mark as Not Relevant.\n\n### 2FA\n\n> **⚡ Automation:** Ask the agent to \"Check if multi-factor authentication (MFA) is enforced for all users in \\[Google Workspace / Okta / Azure AD\\].\"\\\n> \\*\\***⚙️ General:** Auditors specifically look for \"Enforced\" (mandatory) status, not just \"Allowed\" or \"Optional.\" Ensure your screenshot proves it is impossible for a user to log in without it.\\\n> \\*\\***🌱 Small Teams (2+):**\n>\n> You need two specific screenshots:\n>\n> 1. The Rule: Go to Google Workspace Admin > Security > 2-Step Verification and screenshot where it says \"Enforcement: On\".\n> 2. The Proof: Screenshot the actual login screen where it asks a user for their 6-digit code.\\\n> \\*\\***👤 Solo Founder:** Screenshot your own account settings showing 2FA is enabled and your own login prompt.\n\n### Access Review Log\n\n> **⚡ Automation:** Ask the agent to \"Generate a list of all active users and their last login date from \\[Identity Provider/AWS\\]\" or \"Identify any users in \\[System\\] who have not logged in for over 90 days.\" This provides the raw data you need to conduct the review.\n>\n> ⚙️ **General:** This is typically a quarterly requirement. Auditors specifically look for the \"Reviewer\" and \"Date\" columns to prove a human actually looked at the list. If you removed access for someone, ensure you log that specific action in the \"Notes\" or \"Actions Taken\" column.\\\n> \\*\\***🌱 Small Teams (2+):** Don't overcomplicate this. Use the provided spreadsheet template. Export your user list from Google Workspace or AWS, paste it into the sheet, and add a column called \"Status\" where you type \"Keep\" or \"Remove\" next to each name. Ensure it is dated and signed off. Template is available [here](https://docs.google.com/spreadsheets/d/1_iPQD7-tED6WpEYh2AJqL_eN1SUcfrcH/edit?usp=drive_link&ouid=105483817633840137498&rtpof=true&sd=true)\\\n> \\*\\***👤 Solo Founder:** Mark as Not Relevant.\n\n### Employee Access\n\n> **⚡ Automation:** Ask the agent to \"List all active users in \\[Google Workspace / Okta\\] along with their current account status.\"\\\n> \\*\\***🌱 Small Teams (2+):** Upload a simple screenshot of the \"Users\" directory in your Google Workspace Admin console. Make sure the \"Status\" column is visible to prove which accounts are Active vs. Suspended.\n>\n> 👤 Solo Founder: Mark as **Not Relevant**.\n\n## Cloud Infrastructure & Operations\n\n### Infrastructure Inventory\n\n> **⚡ Automation: Not applicable to this task since there is a deliverable doc that needs to be signed off.**\n>\n> ⚙️ **General:** Auditors look for completeness and ownership. Ensure your list includes not just servers, but also databases and storage buckets. If your cloud provider export doesn't list an \"Owner,\" add a column in a spreadsheet or ensure you have an \"Owner\" tag applied to resources. **Ensure the list is signed off and dated.**\\\n> \\*\\***🌱 Small Teams (2+):** Go to the \"Tag Editor\" or \"Resource Groups\" section of your cloud provider's console and export a CSV of all active resources. Alternatively, use the [provided spreadsheet](https://docs.google.com/spreadsheets/d/170csMBWNcmKIkyC6TE0H3lqwv3C1e5dc/edit?usp=drive_link&ouid=105483817633840137498&rtpof=true&sd=true) to manually list your main assets (e.g., \"Production Database,\" \"Web Server\").\\\n> \\*\\***👤 Solo Founder:** Even if you only have a single Heroku Dyno or Vercel project, you must account for it. A simple screenshot of your main dashboard showing your active services is sufficient\n\n### Monitoring & Alerting\n\n> **⚡ Automation:** In most cases this will require 2 separate automations. 1) Ask the agent to \"Verify that logging is enabled in \\[Cloud Provider\\] 2) Ask the agent to verify Alert Policy is configured to monitor it.\"\n>\n> You must prove two things:\n>\n> 1. Data is being saved (**Logging**).\n> 2. An alarm mechanism exists to notify you of failures (**Alerting**).\n>\n> ⚙️ **General:**\n>\n> Auditors need to distinguish between recording errors and seeing errors.\n>\n> - Good Evidence: A screenshot of your Alert Rules or Notification Policies (e.g., \"If 500 errors > 1%, Slack #dev-ops\").\n> - Bad Evidence: A simple list of raw logs. (This proves the data exists, but fails to prove that anyone is actually watching it).\n> - *Note:* If you have zero recent alerts, do not leave the task empty. Upload a screenshot of your Alert Configuration to prove the system is ready to notify you.\\\n> \\*\\***🌱 Small Teams (2+):** You likely use the built-in dashboards of your platform. Screenshot the \"Activity\" or \"Deployments\" tab in Vercel, Heroku, or Netlify showing recent build statuses (Success/Failure).\\\n> \\*\\***👤 Solo Founder:** Screenshot your default platform alerts (e.g., \"Deployment Failed\" emails) or set up a simple \"Billing Alert\" in AWS/GCP to prove you are being notified of anomalies.\n\n### Production Firewall & No-Public-Access Controls\n\n> ⚡ Automation: `High Configuration Overhead** Automating AWS & Azure controls requires complex environment configuration and strict policy management. We strongly recommend manual evidence (i.e screeenshots) for a faster audit experience if you use these providers, unless you have a dedicated DevOps engineer to manage the initial setup and any potential maintenance.` \\*\\*\\*\\*App Layer Prompt: *\"Check my cloud network settings. Alert me if Port 22 (SSH) or 3389 (RDP) is ever configured to allow traffic from 0.0.0.0/0 (Anywhere).\"*\n>\n> I'm sure the rest of the business would flame us for this \"We strongly recommend manual evidence \"\n\n\\*> *Database: \"Monitor my database instances (RDS, CloudSQL) every 24 hours. Mark this control as 'Failed' if any database port (e.g., 5432, 3306) allows inbound traffic from the public internet (*`0.0.0.0/0`).\"\n\n> ⚙️ **General:**\n>\n> You need to provide evidence for two distinct layers:\n>\n> 1. The App Layer (Servers / VMs)\n>\n> - What to upload: Screenshots of the Firewall/Security Group rules attached to your Web Servers or EC2/VM instances.\n> - Compliance Check: Ensure SSH (Port 22) or RDP (Port 3389) is either missing entirely or strictly limited to a private VPN IP. Never allow `0.0.0.0/0` on these ports.\n> - *Note: If you use PaaS (like Heroku or Vercel) and have no servers to manage, please add a comment stating this.*\n>\n> 2. The Data Layer (Databases)\n>\n> - What to upload: Screenshots of the specific inbound firewall rules for your Database (RDS, Azure SQL, etc.).\n> - Compliance Check: Ensure there is no rule allowing `0.0.0.0/0` (Anywhere), even on non-database ports (like HTTPS). The only allowed sources should be your App Servers or private subnets.\\\n> \\*\\***🌱 Small Teams (2+):** Go to your Cloud Provider (e.g., AWS EC2 Dashboard), select your \"Production Security Group,\" and screenshot the **Inbound Rules** tab. The goal is to show that Port 22 is either missing or restricted to a specific IP, not \"Anywhere.\".\\\n> \\*\\***👤 Solo Founder:** Even for PaaS users (like Heroku or Render), screenshot your database settings showing \"Public Access: Disabled\" or \"Trusted IPs only.”\n\n### Planning\n\n> **⚡ Automation:** Ask the agent to \"Verify that automated backups are enabled for all active databases in \\[Cloud Provider\\].\" You can also ask it to \"Check the backup retention period settings for \\[Database Name\\] to ensure point-in-time recovery is active.\" `AWS & Azure automation has a high barrier to entry. If you aren't comfortable with the technical requirements, please use screenshots instead.`\n>\n> ⚙️ **General:** Auditors look for Frequency (typically daily) and Retention (how far back can you go, typically 30 days). Ensure your screenshot captures these two details, not just the word \"Enabled.\"\\\n> \\*\\*\\*\\*🌱 Small Teams (2+)\\*\\*: Screenshot the \"Backup\" or \"Maintenance\" tab in your database provider (e.g., Heroku, Railway, RDS). The key is to show the toggle is \"On\" and the Retention Period is > 0 days.\n>\n> 👤 **Solo Founder:** Screenshot your platform's settings showing automated backups are active. If using a managed service (like Supabase/Firebase), screenshot or link to their policy documentation of the default backup policy. Include evidence that your data is with this provider.\n\n### Backup Restoration Test\n\n> **⚡ Automation:** N/A\n>\n> ⚙️ **General:** A simple \"Restore Complete\" notification is not enough. You must demonstrate Data Integrity - meaning you actually opened the restored database and verified that the data inside is readable and accurate. This test is required annually.\\\n> \\*\\***🌱 Small Teams:** The easiest evidence is a video. Record a short screen capture of yourself clicking \"Restore,\" waiting for the new test db to boot. Ensure the recording includes the organisation name and proves data integrity.\\\n> \\*\\***👤 Solo Founder:** This process is identical for solo founders. You must prove you can get your data back if your main database is corrupted.\n\n### App Availability\n\n> ### **⚡ Automation:** Ask the agent to \"Check if DDoS protection (like WAF or Shield) is enabled on my public domains in \\[Cloud Provider/Cloudflare\\].\" You can also ask it to \"Verify that auto-scaling policies are configured for my production services to handle traffic spikes.\"\n>\n> \\*\\*\\*\\*⚙️ General: T\\*\\*his task covers two distinct risks: Capacity (Auto-scale) and Attacks (DDoS). Your evidence should ideally show protections for both. If you don't use auto-scaling (e.g., fixed servers), upload a capacity planning document explaining how you monitor load.\\\n> \\*\\***🌱 Small Teams (2+):** If you use a PaaS (like Vercel, Netlify, or Heroku), you likely have this by default. Screenshot your \"Project Settings\" showing \"Serverless Function Region\" or your Cloudflare dashboard showing the \"Web Application Firewall\" is On. Alternatively link to providers documentation and provide evidence your app is with the provider stated.\\\n> \\*\\***👤 Solo Founder:** Screenshot your hosting dashboard. Even if you don't have \"Auto-scale,\" showing you use a managed platform that handles traffic spikes (like Vercel or Render) is sufficient evidence.\n\n### Diagramming\n\n> **⚡ Automation:** N/A\n>\n> ⚙️ **General:** Auditors specifically look for boundaries. Your diagram should clearly identify the \"Public Internet\" versus your \"Private Network\" (where the database lives) to prove you understand your own security perimeter.\\\n> \\*\\***🌱 Small Teams (2+):** Keep it high-level. A simple box-and-arrow drawing in Lucidchart or Figma showing User → Load Balancer → App Server → Database is perfectly acceptable. It does not need to show every single IP address.\\\n> \\*\\***👤 Solo Founder:** You must document how your system works. A logical diagram showing how your front-end talks to your back-end (e.g., Vercel functions calling a Supabase DB) is sufficient.\n\n### Encryption at Rest\n\n> **⚡ Automation:** Ask the agent to \"Verify that encryption is enabled on all active databases in \\[Cloud Provider\\].\" You can also ask it to \"List all storage volumes and their encryption key status to confirm data is secured.\"\n>\n> ⚙️ **General:** Ensure your evidence covers both structured data (DB) and unstructured data (Files).\\\n> \\*\\***🌱 Small Teams (2+):** Navigate to the \"Properties\" or \"Configuration\" tab of your primary database (e.g., AWS RDS or Google Cloud SQL) and screenshot the \"Encryption\" section. It should explicitly say \"Enabled\" or show a Key ID.\\\n> \\*\\***👤 Solo Founder:** Even on managed platforms like Heroku, Render, or Supabase, data is stored. Screenshot your project settings or the provider's documentation confirming that your specific plan includes encryption at rest by default.\n\n## Engineering & App Security\n\n### Sanitized Inputs\n\n> **⚡ Automation:** Integration tips coming soon\n>\n> ⚙️ **General:** This task requires two layers of defense: protecting data *as it enters* (Input Validation) and checking code *before it ships* (Static Analysis). Auditors will reject evidence that only shows one but misses the other.\\\n> \\*\\***🌱 Small Teams (2+):** You need two screenshots combined into one PDF:\n>\n> 1. **Code:** A snippet of your code showing a Zod/Pydantic schema definition.\n> 2. **Scan:** The \"Security\" tab in GitHub (or your CI logs) showing CodeQL or Dependabot running successfully.\\\n> \\*\\***👤 Solo Founder:** If you use GitHub, CodeQL is often free for public repositories or Pro accounts. Enable \"Code Scanning\" in your repo settings and upload a screenshot of the active setup.\n\n### Secure Code\n\n> **⚡ Automation:** Ask the agent to \"Check if Dependabot is enabled in my GitHub repository.\"\n>\n> ⚙️ **General:** Auditors want to see evidence of remediation, so show some closed/remediated issues. Focus on Critical and High vulnerabilities. You do not need to fix every single \"Low\" priority alert, but your evidence must show that zero Critical/High issues remain open.\\\n> \\*\\***🌱 Small Teams:** Go to the \"Security\" tab in your main GitHub repository and select \"Dependabot alerts.\" Upload a screenshot showing the list is either empty or contains only \"Low/Moderate\" risks. Show closed/ remediated alerts\\\n> \\*\\***👤 Solo Founder:** Enable Dependabot (it's free for public/personal repos) and provide the evidence.\n\n### Secure Secrets\n\n> **⚡ Automation:** Ask the agent to \"Verify that my application loads configuration from a secure store (like AWS Secrets Manager or Parameter Store).\" You can also ask it to \"Scan my code repository to ensure no passwords or .env files have been accidentally committed.\"\n>\n> ⚙️ **General:** Redaction is critical. Never upload a screenshot that reveals the actual API keys or passwords. Additionally, a screenshot of your `.gitignore` file listing `.env` is excellent supporting evidence that you block secrets from version control.\\\n> \\*\\***🌱 Small Teams (2+):** If you use platforms like Vercel, Heroku, or Render, their built-in \"Environment Variables\" settings page counts as a secret manager. Screenshot that page showing the names of the keys (e.g., `DATABASE_URL`), but keep the values hidden.\\\n> \\*\\***👤 Solo Founder:** Screenshot your hosting provider's environment variables dashboard. This proves you inject secrets at runtime rather than hardcoding them into your source code\n\n### TLS / HTTPS\n\n> **⚡ Automation:** Ask the agent to \"Check the SSL certificate status for my public website to ensure HTTPS is valid and enforced.\"\n>\n> ⚙️ **General:** This is a specific external test. Go to Qualys SSL Labs ([ssllabs.com](http://ssllabs.com)), enter your website URL, and wait for the scan to finish. Upload a screenshot of the final \"Grade\" (aim for an A or A+).\\\n> \\*\\***🌱 Small Teams (2+):** This applies to every modern business. Run the same SSL Labs test on your main landing page and upload the result.\\\n> \\*\\***👤 Solo Founder:** As above.\n\n### Code Changes\n\n> **⚡ Automation:** Ask the agent to \"Check if my main branch protection is enabled.\" and ask it to \"List the last 5 merged Pull Requests to verify they all passed their status checks.\"\n>\n> ⚙️ **General:** Auditors test for \"Operating Effectiveness.\" A screenshot of the settings proves the rule exists, but the sample of PRs proves the rule is actually working. Ensure your sample shows the \"Checks\" (tests) passing before the merge happened.\\\n> \\*\\*\\*\\*🌱 Small Teams (2+)\\*\\*:\n>\n> You need two pieces of evidence:\n>\n> 1. **The Rule:** A screenshot of your Branch Protection settings showing \"Require pull request\" is checked.\n> 2. **The Proof:** A sample of 5 recent Pull Requests. Screenshot the PR page for each showing the \"Merged\" purple badge and the green \"Checks Passed\" ticks.\\\n> \\*\\***👤 Solo Founder:** Settings are not enough; you must prove you use them. Upload your branch protection screenshot, plus a screenshot of your \"Closed Pull Requests\" list showing that you regularly merge code via PRs rather than pushing directly.\n\n## Device Management\n\n### Secure Devices\n\n> **⚡ Automation:** N/A - use the device agent!\n>\n> ⚙️ **General:** The fastest path is simply installing the Comp AI agent (from `portal.trycomp.ai`) on each laptop. This generates the evidence automatically.\n>\n> [Device agent guide](https://trycomp.ai/docs/device-agent) *Manual Alternative:* If you don't use the agent, you must upload screenshots for every employee. Manual evidence guides can also be found at the bottom of this [link](https://trycomp.ai/docs/device-agent#manual-evidence-collection)\\\n> \\*\\***🌱 Small Teams (2+):** Ensure all employees are added to the ‘People’ tab with the ‘employee’ role in order for them to access the portal.\\\n> \\*\\***👤 Solo Founder:** Evidence also required for your own device.\n\n### Device List\n\n> ⚡ Automation:\\*\\*N/A - use the device agent!\n>\n> ⚙️ **General:** This list is your \"inventory.\" If a device is lost or stolen, you need to know exactly which serial number to lock. Auditors check this list against your \"Employee Access\" list to ensure every employee has at least one secured device assigned to them.\\\n> \\*\\***🌱 Small Teams (2+):** If you installed the Comp AI Agent on everyone's machine, you can mark this manual task as Not Relevant. *Manual Alternative:* Create a spreadsheet with columns for: Device Type (MacBook), Serial Number, Assigned User, and Date Issued.\\\n> \\*\\***👤 Solo Founder:** If you installed the agent on your laptop, mark this task as Not Relevant. If not, upload a simple PDF or comment listing your own laptop's serial number and model.\n\n## Governance, Risk & Policy\n\n### Incident Response Tabletop Exercise\n\n> **⚡ Automation:**\n>\n> ⚙️ **General:** The auditor wants to see that your team isn't just reacting blindly, but is trained and 'aware' of the playbook before any incident occurs. By documenting who attended and what \"Action Items\" were found (e.g., \"We realized we didn't have the support number saved\"), you satisfy the control that proves your team is actively managing risk, not just ignoring it.\\\n> \\*\\***🌱 Small Teams (2+):** Fill out a meeting notes of a tabletop exercise appropriate to your organisation. Template available [here](https://docs.google.com/document/d/1HwJPsGEO9rX3H0w-Nzy5AbYWh68kCsjg/edit?usp=drive_link&ouid=105483817633840137498&rtpof=true&sd=true) with some example scenarios in the appendix\n>\n> 👤 **Solo Founder:** Run a \"mental simulation.\" If your main laptop was destroyed how would you restore the company? Write down the steps you would take and any gaps you realize you have (e.g., \"I need to buy a backup key\").\n\n### Incident Response\n\n> **⚡ Automation:** N/A\n>\n> ⚙️ **General:** Comment ‘no incidents’ in the task if there have been no security incidents.\\\n> \\*\\***🌱 Small Teams (2+):** If you have not had any incidents, attest to no incidents in the task as a comment and mark as done.\\\n> \\*\\***👤 Solo Founder:** As above.\n\n### Public Policies\n\n> **⚡ Automation:** Ask the agent to check if e.g [www.yourcompanydomain.com/](http://www.yourcompanydomain.com/)privacypolicy is live\n>\n> ⚙️ **General:** This task has two parts: The Policy (Public) and The Log (Internal). Auditors may specifically ask to see your \"Data Subject Request (DSR) Log.\" If you haven't received any requests yet, you must still acknowledge this—upload a blank log or a comment stating \"No data deletion requests received during this period.\"\\\n> \\*\\***🌱 Small Teams (2+):** You don't need a complex privacy portal. A simple `mailto:privacy@yourdomain.com` link in your policy text is sufficient for \"intake.\" For the \"logging\" requirement, simply create a private Google Sheet named \"Data Deletion Request Log\" to track any emails that come in.\\\n> \\*\\***👤 Solo Founder:** Required as above, Ensure the contact email listed is one you actually check.\n\n### Contact Information\n\n> **⚡ Automation:** Ask the agent to check if e.g [www.yourcompanydomain.com/contact](http://www.yourcompanydomain.com/contact) is live\n>\n> ⚙️ **General:** Add a comment with a link to your Contact page\n>\n> 🌱 Small Teams: A simple `support@` email address listed in your website footer is sufficient. To satisfy the \"logging\" requirement, ensure these emails go to a shared inbox or a simple tracker spreadsheet, not just a personal inbox where they might get lost.\\\n> \\*\\***👤 Solo Founder:** Your landing page must have a way for users to report bugs or security issues. A \"mailto\" link in the footer is perfectly acceptable.\n\n## Physical Security\n\n*If you are a fully remote team the following tasks can be marked as ‘Not relevant’*\n\n### Office Access & Door Monitoring\n\n> ⚡ Automation: n/a\n>\n> ⚙️ **General:** Task can be marked not relevant for remote teams. See advice in platform task description.\\\n> \\*\\***🌱 Small Teams (2+):** You don't need a key log if the building manages it. Screenshot the \"Member List\" in your coworking portal (e.g., WeWork/Regus app) to prove that only *current* employees are authorized to enter. **Physical Keys:** Use a simple spreadsheet with columns for \"Key ID,\" \"Assigned To,\" and \"Date Returned.\"\n>\n> 👤 Solo Founder: Mark as Not Relevant.\n\n### Building / Workplace Rules\n\n> ⚡ **Automation:** n/a\n>\n> ⚙️ **General:** Task can be marked not relevant for remote teams. See advice in platform task description.\\\n> \\*\\***🌱 Small Teams (2+):** If you are in a coworking space (like WeWork, Regus, or a local hub), send a quick email to the Community Manager. Ask them to reply confirming: 1) The building is keycard accessed, 2) There is a reception desk for visitors, and 3) Emergency exits are marked. That email reply *is* your evidence.\\\n> \\*\\***👤 Solo Founder:** Mark as Not Relevant.\n\n### Secure Storage\n\n> **⚡ Automation:** n/a\n>\n> ⚙️ **General:** Task can be marked not relevant for remote teams OR if you do not keep sensitive physical data in your office, e.g all laptops taken home each night) See advice in platform task description.\\\n> \\*\\***🌱 Small Teams:** If you are mostly digital but have a few contracts or checks, a small lockable filing cabinet or a lockbox is sufficient. Upload a photo of it locked. For destruction, a photo of a standard office shredder works as proof of your \"method.\"\\\n> \\*\\***👤 Solo Founder:** Mark as Not Relevant.\n\n### Visitor Control\n\n> **⚡ Automation:** n/a\n>\n> ⚙️ **General:** Task can be marked not relevant for remote teams. See advice in platform task description.\\\n> \\*\\***🌱 Small Teams (2+):** A simple paper notebook at the front desk works perfectly. Upload a photo of a page showing: Date, Name, Company, Arrival Time, Departure Time, and Host. Also, snap a photo of a printed sign on the door saying \"All Visitors Must Be Escorted.”\\\n> \\*\\***👤 Solo Founder:** Mark as Not Relevant.","2026-01-22T15:05:14.724Z","2026-01-22T15:05:54.257Z","270b969f-ba0e-443e-b562-c7623dda9da3",[],[],[],"Evidence","evidnece","**Product area:** Tasks — labeled **Evidence** in the app\\\n**Summary:** Tasks are the recurring units of compliance work that produce evidence for your controls — things like \"review access logs\" or \"collect the latest backup test.\" Each task is assigned to someone, can recur on a schedule, holds the evidence (file attachments, comments, automation results), and rolls up into control and framework compliance when completed. The app's UI calls this area **Evidence**; \"task\" and \"evidence item\" mean the same thing.\n\n**Disambiguation (use to route questions correctly):**\n\n- **Tasks/Evidence** = recurring compliance work items that satisfy controls.\n- **Documents** = the standalone evidence *forms* (meeting minutes, pen tests). Both feed compliance, but Tasks are control-linked work items with assignees and recurrence.\n- **Controls/Frameworks** = what tasks roll up into.\n- If a customer asks \"what do I need to do / who's assigned / where do I upload proof?\" → Tasks (Evidence).\n\n---\n\n## **Core facts**\n\n- **Where:** the **Evidence** tab; the create button is **Create Evidence**.\n- **Each task links to one or more controls**, so completing it advances control and framework compliance.\n- **Completion states that count:** a task counts as complete for compliance when it's **Done** or **Not relevant**.\n- **Recurring:** tasks can be set to recur (daily/weekly/monthly/quarterly/yearly); completing one sets the next review date.\n- **Evidence lives on the task:** file attachments (up to 100MB each), comments, and automation/integration results.\n- **Optional approval workflow:** when enabled, completed tasks route through an approver before they're marked Done.\n\n---\n\n## **What a task contains**\n\n- **Title** and **description** (required).\n- **Status**, **assignee**, and optional **approver**.\n- **Frequency** (recurrence) and a **review/due date**.\n- **Department** (e.g., IT, HR, admin — built-in or custom).\n- **Linked controls** (what the task satisfies).\n- **Evidence:** attachments, comments, and any integration/automation results.\n- **Automation status** (whether it's automated or manual).\n\n---\n\n## **Task list view**\n\n- **Columns/elements:** status indicator, title, description, automation indicator, and assignee.\n- **Views:** a flat **List** view or a **Categories** view grouped by control (unlinked tasks fall under \"Uncategorized\").\n- **Filters:** status, assignee, framework, and automation status. **Search** matches title and description.\n- **Stats:** totals and completion rate, plus counts by status and automation health.\n- **Bulk actions:** change status, reassign, submit for review, or delete multiple tasks at once.\n\n---\n\n## **Statuses (what each means)**\n\n| **Status** | **Meaning** |\n| --- | --- |\n| **To do** | Not started. |\n| **In progress** | Being worked on. |\n| **In review** | Submitted and awaiting approver decision (when approval is on). |\n| **Done** | Completed (and approved, if approval is on). Counts toward compliance. |\n| **Not relevant** | Marked out of scope (requires a justification). Counts toward compliance. |\n| **Failed** | Marked failed (often by an automated check). |\n\n> For compliance, only **Done** and **Not relevant** count as complete.\n\n---\n\n## **Creating & managing tasks**\n\n- **Create** via **Create Evidence** — title and description required; optionally set assignee, frequency, department, and linked controls. You can start from a **template** to auto-fill the details.\n- **Edit** inline (title/description) or via the task's properties panel (status, assignee, approver, frequency, due date).\n- **Assign** to any member with app access; reassign in bulk.\n- **Recurrence & due dates:** set a frequency; completing a recurring task auto-schedules its next review date.\n- **Reorder** by drag-and-drop; **delete** individually or in bulk.\n- **Not relevant** requires a written justification (cleared if you later change the status).\n\n---\n\n## **Evidence on a task**\n\n- **Attachments:** drag-and-drop or select files (up to 100MB each; executable file types are blocked). Each shows its upload date and can be downloaded or deleted.\n- **Comments:** a discussion thread with @-mentions, all audit-logged.\n- **Activity:** a full audit trail of status changes, reassignments, approvals, and rejections.\n- **Export:** download a single task's evidence as a ZIP, or export **all** evidence in bulk.\n\n---\n\n## **Recurrence & freshness**\n\n- A task's **frequency** controls how often it comes due again; completing it sets the next **review date**.\n- This keeps recurring evidence current so compliance reflects up-to-date work rather than a one-time completion.\n\n---\n\n## **Automation & integration checks**\n\nTasks can be satisfied automatically:\n\n- **Integration checks:** connected integrations (AWS, Okta, Google Workspace, etc.) run checks against a task; a passing check can auto-complete it, and a failure can mark it failed. You can run a check manually, see its last run and findings, and disconnect/reconnect a check from a task.\n- **Evidence automations:** scheduled automations gather and evaluate evidence against criteria you set, with a run history (status, pass/fail, duration).\n- **Regenerate from template:** refresh a task's title/description/automation settings from the latest framework template.\n\n---\n\n## **Approval / review workflow**\n\nWhen evidence approval is enabled for the organization:\n\n1. A completed task is **Submitted for Review** to a chosen **approver** → status becomes **In review**.\n2. The approver **Approves** (→ Done, timestamped) or **Rejects** (→ reverts to its prior status).\n3. While in review, the status is locked except via approve/reject. Tasks can also be submitted for review in bulk to a single approver.\n\n---\n\n## **How tasks roll up**\n\n- Completing tasks (Done/Not relevant) helps satisfy their linked **controls**, which in turn advances **framework** compliance.\n- A task can cover **multiple controls**, and a control can be covered by **multiple tasks**.\n- **Assignees** are tracked in the **People** tab, where each person's task completion appears in their progress.\n\n---\n\n## **Roles & permissions (who can do what)**\n\n| **Capability** | **Owner** | **Admin** | **Auditor** | **Employee/Contractor** |\n| --- | --- | --- | --- | --- |\n| View tasks | ✓ (all) | ✓ (all) | ✓ (all) | Only tasks assigned to them |\n| Create / edit / reassign | ✓ | ✓ | ✗ | ✗ |\n| Delete | ✓ | ✓ | ✗ | ✗ |\n| Approve / reject (as assigned approver) | ✓ | ✓ | ✓ (if approver) | ✗ |\n\n(Uses the `task` permission; assignees must have app access.)\n\n---\n\n## **Sample Q&A (canned answers the agent can adapt)**\n\n**Q: Where do I see what I need to do for compliance?**\\\nA: Open the **Evidence** tab. It lists your tasks with status and assignee; you can filter by assignee or framework. Employees see the tasks assigned to them.\n\n**Q: How do I add proof to a task?**\\\nA: Open the task and upload files in its evidence area (drag-and-drop, up to 100MB each), or add a comment. You can also let an integration check or automation supply the evidence automatically.\n\n**Q: What's the difference between Tasks/Evidence and the Documents tab?**\\\nA: Both produce audit evidence. Tasks (Evidence) are recurring, control-linked work items with assignees and schedules; the Documents tab holds standalone evidence forms like meeting minutes and pen test reports.\n\n**Q: Why did a task I completed come due again?**\\\nA: It's set to recur on a frequency (e.g., quarterly). Completing it schedules the next review date so the evidence stays current.\n\n**Q: How do I mark a task that doesn't apply to us?**\\\nA: Set its status to **Not relevant** and provide a short justification. It then counts as complete for compliance.\n\n**Q: Can someone review evidence before it's accepted?**\\\nA: Yes, if your organization enables evidence approval. A completed task is submitted to an approver, who approves it (→ Done) or rejects it (→ back to its prior status).\n\n**Q: Can these complete automatically?**\\\nA: Yes. Connect an integration and attach its checks to a task — a passing check can auto-complete it. Evidence automations can also gather and evaluate evidence on a schedule.\n\n**Q: How do tasks affect my compliance score?**\\\nA: Tasks satisfy the controls they're linked to. When a task is Done or Not relevant, it contributes to those controls, which in turn raises the relevant framework's compliance percentage.\n\n**Q: Can I export evidence for an auditor?**\\\nA: Yes — download a single task's evidence as a ZIP, or export all evidence in bulk.","2026-06-25T23:21:18.763Z","2026-06-25T23:27:03.558Z","93bd3bb5-5121-493e-9b78-23a773b04ec6",[],[],[],"evidence-3","https://kb.trycomp.ai/Evidence-2f0a1b1858b880bd8544ecb562b8a0d8","👥\n\nPeople & HR\n\nFocus: HR, employees\n\nWho should do this: Founders or HR/Ops leads\n\nKey tasks: Employee descriptions, employee verification\n\n🏢\n\nPhysical Security\n\nFocus: On-site safety and environmental controls\n\nWho should do this: Office Manager or Operations Lead\n\nKey tasks: Office access and door monitoring, building and workplace rules, secure storage, visitor control\n\n🔐\n\nAccess Control (IAM)\n\nFocus: Identity and access management across SaaS tools and internal systems\n\nWho should do this: IT Manager, Security Lead, or Operations Lead\n\nKey tasks: 2FA, access review log, employee access\n\n⚖️\n\nGovernance, Risk & Compliance\n\nFocus: Policies, risk management, and legal compliance\n\nWho should do this: Founders, Legal, or Operations Lead\n\nKey tasks: Public policies, internal security audit, Incident Response, ISO Statement of Applicability, GDPR tasks on data transfers, DPOs, third party relations\n\n☁️\n\nInfrastructure & Operations\n\nFocus: Service reliability, data integrity, and network defence — across cloud, hosted, or vendor-managed systems\n\nWho should do this: CTO, Lead Engineer, or Operations Lead\n\nKey tasks: Monitoring and alerting, access restrictions, backups and restoration testing, service availability, encryption at rest\n\n🛡️\n\nProduct & Application Security\n\nFocus: Secure development and application-layer defence — or equivalent controls if you don't build software\n\nWho should do this: Development Lead, CTO, or Operations Lead for service-only orgs\n\nKey tasks: Input validation, vulnerability management, secrets & credentials, TLS and HTTPS, Data Masking, Separation of Environments\n\n💻\n\nDevice Management\n\nFocus: Endpoint security across laptops, mobile devices, and shared hardware\n\nWho should do this: IT Administrator or Operations Lead\n\nKey tasks: Secure devices, device list\n","2026-06-10T13:39:16.125Z","2026-06-23T17:25:31.182Z","20c2ff48-60e7-4b88-b150-ea0fa7942035",[],[],[],"evidence-2","https://kb.trycomp.ai/p/2f0a1b1858b880bd8544ecb562b8a0d8?pvs=25","Notion\n","2026-06-10T13:39:13.899Z","2026-06-10T13:39:13.977Z","1668a2b4-03dc-4220-ad96-8568e244a20e",[],[],[],"Engineering & App Security","engineering-app-security","https://kb.trycomp.ai/Engineering-App-Security-313a1b1858b88066a76ee0fe11887672","![⚙️](/api/knowledge-base/images/7a069641-6628-4a72-bf2e-79e1b1e04624) General: This task is about making sure untrusted data is checked before it's processed — whether that data flows into your code, a third-party platform, or a manual workflow. Auditors want to see that you have a defined control for validating inputs, not just an assumption that \"the platform handles it.\"\n\nIf you build software: You'll need two layers of defense — protecting data as it enters (Input Validation via Zod, Pydantic, or equivalent schema/validation libraries) and checking code before it ships (Static Analysis via CodeQL, Dependabot, or similar). Auditors will reject evidence that only shows one and misses the other.\n\nIf you don't build software (service orgs, ops-heavy teams): Use built-in validation in the tools you operate — required fields on forms, dropdown/enum constraints, approval steps before records are accepted, import checks for bulk data uploads, or documented review controls where a human verifies inputs before they're used downstream.\n\n![🌱](/api/knowledge-base/images/ae01233a-bd33-4e6d-8e43-c510da227dcf) Small Teams (2+) — software: You need two screenshots combined into one PDF:\n\nCode: A snippet of your code showing a Zod/Pydantic schema definition.\n\nScan: The \"Security\" tab in GitHub (or your CI logs) showing CodeQL or Dependabot running successfully.\n\n![🌱](/api/knowledge-base/images/88891bb6-9f8d-4a4e-9dfc-3497fc8833ca) Small Teams (2+) — service / no-code: Screenshot the configuration of validation rules in your platform — for example, required fields and field-type restrictions on a Typeform/Jotform/HubSpot form, validation rules on a Salesforce object, or an approval workflow in your CRM/ticketing tool. Pair this with a short written description of the control (what's validated, by whom, when).\n\n![👤](/api/knowledge-base/images/0906eba1-e3d5-4be9-9399-e7d93e2744b3) Solo Founder — software: If you use GitHub, CodeQL is often free for public repositories or Pro accounts. Enable \"Code Scanning\" in your repo settings and upload a screenshot of the active setup.\n\n![👤](/api/knowledge-base/images/32913f12-1d9b-49d9-95f7-94c981e45c75) Solo Founder — service: Screenshot any built-in validation you rely on (required fields, approval prompts, import preview/checks) and add a short note describing how you review submitted data before acting on it.\n\n![⚡](/api/knowledge-base/images/20079884-666c-4fe1-90b1-8302d0bc893d) Automation: Strongly recommended — use the pre-built automation for GitHub / Dependabot. For most of our customers this is the most straightforward way to satisfy this control, and it's what auditors are most comfortable seeing.\n\n![⚙️](/api/knowledge-base/images/51ee01ed-1479-4512-b8e1-79a8517e94f6) General: The goal is simple: prove you can identify vulnerabilities and fix the important ones. Auditors want to see evidence of remediation, not just detection — so always include some closed/remediated alerts in your evidence. Focus on Critical and High findings. You do not need to fix every single \"Low\" priority alert, but your evidence must show that zero Critical/High issues remain open.\n\nScope: This control covers software, systems, cloud infrastructure, dependencies, and third-party services. In practice, Dependabot covers the dependency layer, which is where the highest volume of real vulnerabilities lives for most SaaS teams. If you also run cloud infrastructure or want broader coverage, equivalent tools include Snyk, GitHub security alerts, cloud security scanning (e.g. AWS Inspector, GCP Security Command Center), or Qualys.\n\nIf you don't develop software (service orgs): Use equivalent controls — patch management records for laptops and servers, vulnerability scan reports from your IT provider, vendor security update logs, or documented risk reviews for the key tools you depend on.\n\n![🌱](/api/knowledge-base/images/7bbeebe4-8057-47a7-aadb-7985bebdda17) Small Teams — recommended (Dependabot): Go to the \"Security\" tab in your main GitHub repository and select \"Dependabot alerts.\" Upload a screenshot showing the list is either empty or contains only \"Low/Moderate\" risks. Crucially, also show closed / remediated alerts — auditors want proof that when something Critical or High appears, you actually fix it.\n\n![👤](/api/knowledge-base/images/a5ec683a-c04f-4535-aafc-4ea6a5c9c80a) Solo Founder — recommended (Dependabot): Enable Dependabot (it's free for public/personal repos) and provide the evidence as above. This is by far the fastest path to satisfying this task.\n\nService orgs / non-developers: Upload patch management evidence (e.g. an MDM report showing devices on the latest OS), a recent vulnerability scan report from your IT vendor, or a short documented review of the top 5–10 SaaS tools you rely on showing you track their security advisories.\n\n![⚡](/api/knowledge-base/images/e5627495-281e-4524-a1e9-58676c9b02a5) Automation: Ask the agent to \"Verify that my application loads configuration from a secure store (like AWS Secrets Manager or Parameter Store).\" You can also ask it to \"Scan my code repository to ensure no passwords or .env files have been accidentally committed.\"\n\n![⚙️](/api/knowledge-base/images/730ffbd7-5c49-4b08-81e8-112a2a577e75) General: This control is about where you store passwords, API keys, tokens, certificates, environment variables, and any other secrets. They must live in a secrets manager or secure vault — never in code, repositories, shared documents, tickets, chat, or plain text files. Acceptable tools include AWS Secrets Manager, Google Secret Manager, Azure Key Vault, Doppler, 1Password, Bitwarden, or equivalent.\n\nRedaction is critical. Never upload a screenshot that reveals the actual secret values — show only the key names. A screenshot of your\n\n.gitignore\n\nfile listing\n\n.env\n\nis excellent supporting evidence that you block secrets from version control.\n\nIf you don't write code (service orgs): This still applies — your team's shared passwords, vendor API keys, and admin credentials should live in a password manager / vault (1Password, Bitwarden, Keeper) rather than a shared spreadsheet, Slack message, or sticky note. Screenshot the relevant vault showing entries exist, with values hidden.\n\n![🌱](/api/knowledge-base/images/cab20415-91c8-4e55-ac31-5f70c873f274) Small Teams (2+) — software: If you use platforms like Vercel, Heroku, or Render, their built-in \"Environment Variables\" settings page counts as a secret manager. Screenshot that page showing the names of the keys (e.g.,\n\nDATABASE_URL\n\n), but keep the values hidden.\n\n![🌱](/api/knowledge-base/images/e6fa5eb3-f5c0-467d-985b-d6abb52d231d) Small Teams (2+) — service: Screenshot your team password manager (1Password, Bitwarden, etc.) showing a shared vault with entries for your key tools and credentials. Values must be hidden.\n\n![👤](/api/knowledge-base/images/06033bca-dfde-4407-b052-d2a0d6afe44c) Solo Founder — software: Screenshot your hosting provider's environment variables dashboard. This proves you inject secrets at runtime rather than hardcoding them into your source code.\n\n![👤](/api/knowledge-base/images/5a2b4236-6252-422a-bd52-4f6eb27f1d8f) Solo Founder — service: Screenshot your personal password manager showing your business credentials are stored there rather than in plain text anywhere else.\n\n> ⚠️ **Common rejection: infrastructure or database configuration screenshots are not accepted.**\\\n> Screenshots of AWS RDS backup settings, maintenance windows, database configuration panels, or other infrastructure screens have no bearing on secrets management. They do not show that passwords, API keys, tokens, or other credentials are being stored in a secrets manager or secure vault. Your evidence must come from a recognised secrets manager (e.g. AWS Secrets Manager, Azure Key Vault, 1Password, Doppler) and must show that application secrets are stored there — not in code or plain text.\n\n![⚡](/api/knowledge-base/images/838428a9-f3bf-49b2-a7fd-df676cfb8004) Automation: Ask the agent to \"Check if my main branch protection is enabled\" and to \"List the last 5 merged Pull Requests to verify they all passed their status checks.\"\n\n![⚙️](/api/knowledge-base/images/21b7342a-9992-4ac7-8bb7-4dc4edf66aad) General: This control is about reviewing, approving, testing, and documenting changes before they're released — whether the change is to code, a SaaS configuration, a vendor setup, or an operational process. Auditors test for \"Operating Effectiveness.\" A screenshot of the settings proves the rule exists, but a sample of real changes proves the rule is actually being followed.\n\nIf you ship software: Enable branch protection on your main branch, prevent direct pushes, require pull requests, and show examples of reviewed PRs, passing tests, deployment approvals, or rollback plans. Your evidence sample should show the \"Checks\" (tests) passing before the merge happened.\n\nIf your changes are non-code (service orgs, ops teams): Use equivalent controls — change approval forms or tickets, impact assessments, test/UAT records, admin change logs from your SaaS tools, vendor configuration change records, or documented rollback procedures. The pattern is the same: someone other than the requester reviews and approves the change, it's tested where appropriate, and there's a written record of what changed and when.\n\n![🌱](/api/knowledge-base/images/b5f321c5-db6f-4196-9f8e-eee3a9aecee0) Small Teams (2+) — software:\n\nYou need two pieces of evidence:\n\nThe Rule: A screenshot of your Branch Protection settings showing \"Require pull request\" is checked.\n\nThe Proof: A sample of 5 recent Pull Requests. Screenshot the PR page for each showing the \"Merged\" purple badge and the green \"Checks Passed\" ticks.\n\n![🌱](/api/knowledge-base/images/70ec3ab0-8396-43bf-86a7-57675cc5a7b5) Small Teams (2+) — non-code: Provide your change management process (a short written doc or template) plus 3–5 examples of real changes that went through it — e.g. Jira/Linear tickets showing approval before implementation, a vendor configuration change log, or admin audit-log entries showing who changed what and when.\n\n![👤](/api/knowledge-base/images/27e937b2-4ea6-4141-9f82-87bd863d3a0d) Solo Founder — software: Settings are not enough; you must prove you use them. Upload your branch protection screenshot, plus a screenshot of your \"Closed Pull Requests\" list showing that you regularly merge code via PRs rather than pushing directly.\n\n![👤](/api/knowledge-base/images/5a363a6f-566d-4e3e-a9dc-96052cc342c9) Solo Founder — non-code: Document the changes you make to critical systems (even informally) and show a sample — for example, a short log of admin/config changes with date, what changed, and a one-line justification.\n\n![⚡](/api/knowledge-base/images/56373088-bb8a-4d9e-807d-2fe3ee70d1ce) Automation: Ask the agent to \"Verify that HTTPS is enabled and valid for my website.\"\n\n![⚙️](/api/knowledge-base/images/a3dab561-5c59-4324-94bf-86a3ff130ee7) General: Auditors check to ensure that all data transmitted over public networks to the production environment is encrypted using industry-standard protocols (TLS 1.2 or higher) to prevent unauthorized interception or tampering.\n\nISO27001 specific\n\n![⚡](/api/knowledge-base/images/5c60bf40-a8af-4ac5-8817-c1a6ce7d0d6f) Automation: This item cannot be automated\n\n![⚙️](/api/knowledge-base/images/de7bb534-20ae-47e3-8e6f-2b662493b0c3) General: Ensure that we are masking all sensitive data, both in any logs and UI components. (If no data process or logged, we ca mark this as not relevant)\n\nTo provide strong evidence for a Data Masking task, your screenshots should clearly show either a \"Before and After\" state or a \"Permissions-Based\" difference. You need to prove the masking logic works without exposing real sensitive data in your report.\n\nThis is the gold standard for proving a transformation script worked. It shows both the source data and the masked result.\n\nScreenshot A: A snippet of the Production/Source database (blur the actual sensitive parts for the report).\n\nScreenshot B: A snippet of the Dev/UAT database showing the masked equivalents.\n\nWhat to highlight: Use arrows to show that the format stays the same (e.g., a valid-looking email) while the actual identity has changed.\n\n![⚙️](/api/knowledge-base/images/9cc56dd5-e79e-42eb-a70d-63e6e06b2c05) General:\n\nWhat to show: The screenshot needs to clearly display separate accounts, distinct VPCs (Virtual Private Clouds), or completely separate database clusters (e.g., one RDS instance named\n\nprod-db\n\nand another named\n\nstaging-db\n\n).\n\nThe Access Layer: Ideally, your evidence should also hint at restricted access—such as showing that production sits in a dedicated AWS Account or GCP Project that requires specific, elevated IAM permissions to access.\n\n![🌱](/api/knowledge-base/images/05f9895c-0369-4715-a52d-2cb49d087953) Small Teams (2+):\n\nYou don't need a complex multi-VPC enterprise AWS setup to pass this. If you use modern PaaS tools (like Vercel, Heroku, or Render), simply take a screenshot of your project dashboard showing the clear delineation between your \"Production\" deployment and your \"Preview/Staging\" branches.\n\n![⚙️](/api/knowledge-base/images/b46a9e02-af92-4a52-9021-4a7502f7d478) General:\n\nPart 1: The Utility List. Create a simple spreadsheet listing your approved \"privileged utilities\" (e.g.,\n\ntcpdump\n\n,\n\nWireshark\n\n,\n\niptables\n\n, disk-encryption tools). Note who is authorized to use them and for what purpose. Click Upload Evidence to attach this list.\n\nPart 2: The Time Sync (NTP). You must prove your devices are synced to an official time source within ±1 second. Upload screenshots of the following:\n\nLinux Server: A screenshot of your terminal running\n\ntimedatectl\n\nor\n\nchronyc tracking\n\nshowing NTP is active and synced.\n\nMac/Windows Device: A screenshot of your device's date/time settings showing \"Set time automatically\" is enabled, or a terminal output (like\n\nw32tm /query /status\n\non Windows) proving the sync.","2026-06-10T13:39:31.943Z","2026-07-01T00:16:47.680Z","18a81c96-73c0-4a41-8195-65e567780cdb",[],[],[],"engineering-app-security-2","https://kb.trycomp.ai/Engineering-App-Security-313a1b1858b88066a76ee0fe11887672?pvs=25","#### Separation of Environments\n","2026-06-23T17:25:35.130Z","2026-06-23T17:25:35.147Z","02a28701-901e-4779-922a-467b0aa59b2d",[],[],[],"Enable Frameworks for your Trust Center","enable-frameworks-for-your-trust-center","\n1. Navigate to **Trust** in the left rail → \n2. Open **Trust Portal Settings** (the portal-settings section)\n3. Switch to the **Compliance Frameworks** tab \n4. For each framework you want to publish (SOC 2 Type I/II, ISO 27001, ISO 42001, ISO 9001, GDPR, HIPAA, PCI DSS, NEN 7510):\n - Flip the **toggle switch** to \"on\" to make it visible on the public trust page\n - Set its **status** dropdown — `Started`, `In Progress`, or `Compliant`\n5. Changes save automatically","2026-05-06T13:33:24.636Z","167f7c9b-ecb3-41da-9f35-2c0085a16f26",[],[],[],"Employee Portal","employee-portal","**Product area:** Employee Portal\\\n**Summary:** The Portal (`portal.trycomp.ai`) is the employee-facing app where team members complete their compliance tasks — accepting policies, finishing security training, registering their device, and submitting forms. It's separate from the main admin app: employees only see their own tasks, while admins manage everything and track completion in the **People** tab.\n\n**Disambiguation (use to route questions correctly):**\n\n- **Portal** = where employees *do* their tasks.\n- **People tab** (admin app) = where admins *track* who's done their tasks.\n- If an employee asks \"how do I sign my policies / watch my training?\" → Portal. If an admin asks \"who hasn't finished?\" → People tab.\n\n---\n\n## **Access & login**\n\n- **URL:** `portal.trycomp.ai`.\n- **How employees get in:** they receive a Portal invite, then sign in with their **work email**:\n - **Email one-time code (OTP):** enter email → get a 6-digit code → enter it to sign in.\n - **Google or Microsoft SSO** (where enabled).\n- **Device agent enrollment** uses a dedicated sign-in flow when linking a device.\n- No password to manage; access is email-based.\n\n---\n\n## **Home view (the task checklist)**\n\nAfter login, employees land on a **task checklist** (accordion) with a progress bar reading **\"{X} of {Y} tasks completed.\"** Each section shows a green ✓ when done (with the title struck through) or a gray ○ when still pending.\n\nSections appear based on what the organization has enabled:\n\n| **Section** | **Title shown** | **When it appears** |\n| --- | --- | --- |\n| **Security Policies** | \"Security Policies\" | When policies require signing |\n| **Device Agent** | \"Download and install Comp AI Device Agent\" | When the device step is enabled |\n| **Security Awareness Training** | \"Complete general security awareness training\" | When training is enabled |\n| **HIPAA Training** | \"Complete HIPAA security awareness training\" | When the HIPAA framework is active |\n| **Company Forms** | Access Request / Whistleblower Report | When those forms are enabled |\n\n---\n\n## **Policy acceptance**\n\n- The **Security Policies** section lists each policy to review with the prompt \"Please review and accept the following policies.\"\n- Employees can open a policy to read its full content (rich-text or PDF), then click **Accept Policy** (which becomes **Policy Accepted**).\n- **Accept All** signs everything outstanding at once → shows **All Policies Accepted** when complete.\n- After accepting, an employee sees a \"You have accepted this policy\" confirmation and can use **View Signed Policies** to review what they've signed.\n- **Re-acceptance:** if an admin publishes a new version of a policy, it returns to the employee's list to be accepted again.\n\n---\n\n## **Security awareness training**\n\n- A set of **5 video lessons** (Security Awareness Training Parts 1–5) shown in a carousel.\n- Employees watch each video and click **Mark Complete**; a **\"X/5\"** badge tracks progress and the **Next** button unlocks as each is completed.\n- When finished, they see an \"All Training Videos Completed!\" confirmation.\n\n---\n\n## **HIPAA training (when enabled)**\n\n- A **read-through** module (not a video) with sections covering why the training exists, what PHI is, day-to-day required behaviors, a do/do-not reference, and incident reporting.\n- The employee must check **all acknowledgment boxes**, then click **Acknowledge HIPAA Training**.\n- On completion: \"HIPAA training acknowledged — Completed on \\[date\\]. A certificate was emailed to you.\"\n\n---\n\n## **Device registration (Comp AI Device Agent)**\n\nThe **Device Agent** section walks employees through three steps:\n\n1. **Download** — a **Download Agent** button auto-detects the OS (macOS — Apple Silicon or Intel, Windows, Linux).\n2. **Install** — open the downloaded file (`.dmg`, `.exe`, or `.deb`) and follow the prompts.\n3. **Log in** — sign in with the work email, select the organization, and click **Link Device**.\n\n**After install:** a **\"Your Devices\"** list shows each device with its status:\n\n- ✓ \"All security checks passing\" (compliant), or\n- ○ \"Some security checks need attention\" (with a **Refresh** option to re-check).\n\nIt also shows platform, OS version, and last check-in. **System requirements:** macOS 14+, Windows 10+, or Linux (Ubuntu 20.04+); 512MB RAM; 200MB disk. Device status auto-refreshes periodically.\n\n---\n\n## **Forms employees can submit**\n\nWhen enabled by the organization, the **Company Forms** area lets employees submit:\n\n- **Access Request** — request access to systems, with fields for accounts needed, permission level (Read/Write/Admin), business justification, who granted it, and the date. Employees can view their own submissions under **My requests** and see status (e.g., Pending, Approved).\n- **Whistleblower Report** — a confidential report with incident date, details, and individuals involved.\n\n---\n\n## **Multiple organizations**\n\n- An employee can belong to **more than one organization**. If so, they see a **\"Your Organizations\"** page and pick which one to open. With a single org, they go straight to its checklist.\n- Profile basics (name, email, avatar) are shown in the user menu; profile details are managed in the main app, not edited in the Portal.\n\n---\n\n## **Emails employees receive**\n\n- **Sign-in code (OTP)** when logging in.\n- **HIPAA training certificate** after acknowledgment.\n- **Policy review/acceptance requests and reminders** when policies are published or outstanding (sent from the platform, including a batched digest when several are pending).\n\n---\n\n## **Sample Q&A (canned answers the agent can adapt)**\n\n**Q: How do I log in to the employee Portal?**\\\nA: Go to portal.trycomp.ai and enter your work email. You'll get a 6-digit code by email to sign in — or use Google/Microsoft sign-in if your company has it enabled.\n\n**Q: I didn't get my login code / invite.**\\\nA: Check spam first. If it's still missing, ask your administrator to use **Resend Portal Invite** from the People tab, and confirm they have your correct work email.\n\n**Q: How do I sign my policies?**\\\nA: Open the **Security Policies** section on your home checklist. You can open each policy to read it and click **Accept Policy**, or use **Accept All** to sign everything at once.\n\n**Q: Why is a policy I already signed back on my list?**\\\nA: Your company published an updated version, so it needs to be re-accepted to confirm you've seen the latest one.\n\n**Q: How do I complete my training?**\\\nA: Open the training section and watch each of the 5 videos, clicking **Mark Complete** after each. The badge shows your progress (e.g., 3/5). HIPAA training, if shown, is a read-through with acknowledgment checkboxes.\n\n**Q: How do I install the device agent?**\\\nA: In the **Device Agent** section, click **Download Agent** (it detects your OS), install the downloaded file, then log in with your work email and click **Link Device**. Your device will then show \"All security checks passing\" once compliant.\n\n**Q: My device shows \"Some security checks need attention\" — what do I do?**\\\nA: One or more security checks are failing (e.g., disk encryption or screen lock). Address the flagged items and use **Refresh** to re-check. Your admin can see the specific failing checks in the Devices view.\n\n**Q: Can I be part of more than one company in the Portal?**\\\nA: Yes. If you belong to multiple organizations, you'll see a \"Your Organizations\" page where you can switch between them.","2026-06-25T22:38:45.050Z","e6a2c0a7-d54a-4eb8-a674-98b626af048d",[],[],[],"Employee Performance Evaluations","employee-performance-evaluations","https://kb.trycomp.ai/Employee-Performance-Evaluations-e9a8547fb7354abcb684128b68b6a331","![🧾 Callout icon](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)\n\nGoal: Show employees are held accountable through regular reviews, including security responsibilities.\n\nEvidence of regular performance feedback cycles.\n\nProof that employees are accountable for their responsibilities (including security-related expectations where applicable).\n\n![⚠️ Callout icon](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)\n\nAuditors require evaluations for 5 employees or 10% of your organisation, whichever is greater.\n\nIf you have fewer than 5 employees, you must provide evaluations for everyone.\n\n![📝 Callout icon](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)\n\nClick + New Submission and complete the evaluation form for each employee in your sample.\n\nFor each submission, make sure you fill in:\n\nReview period end date\n\nEmployee name\n\nOverall rating\n\nManager, Manager signature (name), and Manager signature date\n\nRepeat until you meet the required sample size.\n\n![📎 Callout icon](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)\n\nIf you use an HRIS or documents elsewhere, click Upload Evidence and attach them.\n\nYou can anonymize documents (for example, blur sensitive details) if preferred.\n\nSmall team reality check (2–3 people):\n\nIf you do not run formal annual reviews, upload alternative evidence that shows:\n\nA date, and\n\nSome form of mutual sign-off\n\nExamples include documented 1:1 notes, an OKR spreadsheet with a “reviewed on” date, or an email thread summarising a quarterly performance and security sync.\n\n![👤 Callout icon](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)\n\nCan be considered not relevant.\n","2026-06-10T13:39:31.083Z","2026-06-10T13:39:31.106Z","a9758896-95bd-4d66-a1ad-3188a679d67f",[],[],[],"DPO Necessity Assessment","dpo-necessity-assessment","https://kb.trycomp.ai/DPO-Necessity-Assessment-388a1b1858b8813e853dd7ab7b286d38","⚖️\n\nDPO necessity assessment. A short record of whether you are legally required to appoint a Data Protection Officer. Complete it even if the answer is 'no', it is the evidence for the 'Appoint or Review Data Protection Officer' task.\n\nAnswer each question (Yes / No):\n\n| # | Question | Answer |\n| - | --------------------------------------------------------------------------------------------------------------------------- | ------ |\n| 1 | Are we a public authority or body? | |\n| 2 | Do our core activities require large-scale, regular and systematic monitoring of individuals? | |\n| 3 | Do our core activities involve large-scale processing of special-category data (Art. 9) or criminal-offence data (Art. 10)? | |\n\nConclusion: if any answer is 'Yes', a DPO is likely required: appoint one and document the role. If all answers are 'No', a DPO is not mandatory.\n\nRecord:\n\nConclusion: \\[DPO required / not required]\n\nReasoning: \\[brief explanation]\n\nIf not required, internal privacy owner: \\[name, role]\n\nAssessed by: \\[name] | Date: \\[date] | Next review: \\[date]\n","2026-06-23T17:25:37.451Z","2026-06-23T17:25:37.469Z","9a3e6755-f913-4a42-85b2-501c854f37e4",[],[],[],"DPIA Screening & Report","dpia-screening-report","https://kb.trycomp.ai/DPIA-Screening-Report-388a1b1858b881a19733d77d2406961c","🔎\n\nDPIA screening and report. First screen a new or changed processing activity. If any screening answer is 'Yes', complete the report. Retain both, even when the conclusion is that no full DPIA is needed.\n\nLarge-scale processing of special-category data (health, biometrics, and so on)?\n\nSystematic, large-scale monitoring of a publicly accessible area?\n\nSystematic, extensive profiling or automated decisions with legal or similarly significant effects?\n\nLarge-scale processing generally?\n\nUse of new or innovative technology?\n\nCombining or matching datasets from different sources?\n\nProcessing data about vulnerable individuals (children, employees, patients)?\n\nProcessing that could prevent people from exercising a right or using a service?\n\nResult: any 'Yes' means a DPIA is required. All 'No': record this screening as your evidence and stop here.\n\na. Describe the processing: what data, why, how it flows, volume, retention, and who is involved.\n\nb. Necessity and proportionality: your lawful basis, how you minimise data, and how you uphold data subject rights.\n\nc. Consultation: stakeholders consulted (and your DPO, if you have one).\n\nd. Risks to individuals:\n\n| Risk | Likelihood (L/M/H) | Severity (L/M/H) | Overall |\n| ------------------------------------------ | ------------------ | ---------------- | ------- |\n| \\[e.g. unauthorised access to health data] | | | |\n\ne. Measures to reduce risk:\n\n| Risk | Measure | Residual risk | Approved by |\n| ------- | ----------------------------------- | ------------------- | ----------- |\n| \\[risk] | \\[encryption, access controls, ...] | Low / Medium / High | |\n\nf. Sign-off: owner, DPO (if any), date, and outcome. If residual risk remains high, consult your supervisory authority before starting.\n","2026-06-23T17:25:37.171Z","2026-06-23T17:25:37.201Z","447910ee-3824-4701-a208-d96ab648a861",[],[],[],"Do you have a CLI I can connect with my agent","do-you-have-a-cli-i-can-connect-with-my-agent","No, we do not have a CLI or MCP server at this time, however, you can use the reference links below to help with this! To create an api key, go the to the settings tab in the app => API Keys\n\nFor Human: \\\nFor Agent: ","2026-04-06T14:15:58.434Z","3f37bdeb-178d-4517-938d-da68b1f83a1c",[],[],[],"Documents","documents","https://kb.trycomp.ai/313a1b1858b88049b75fe23cbd775298?pvs=25","![📁 Callout icon](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)\n\nThe Documents section is your checklist of required audit deliverables. This is where you generate or upload the formal records your auditor needs to see - like meeting minutes, access matrices, and penetration test reports.\n\n![⚠️ Callout icon](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)\n\nAnything marked with a yellow TODO tag should be completed for the audit.\n\nIn-app forms: Many requirements can be completed in Comp AI using built-in templates.\n\nManual uploads: If you already have records in Google Drive, an HRIS, or elsewhere, upload those files instead.\n\nPentesting: We handle the Penetration Test for you, so you do not need to source an external vendor.\n\n![🚀 Callout icon](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)\n\nOpen each page below to get:\n\nA plain-English explanation of what the auditor wants\n\nThe fastest way to clear the requirement\n\nGuidance on what “good evidence” looks like for both small and large teams","2026-03-18T15:19:10.122Z","f4f6ce15-42cf-4b14-bc4b-d59a63ac307d",[],[],[],"documents-2","https://kb.trycomp.ai/Documents-313a1b1858b88049b75fe23cbd775298","📁\n\nThe Documents section is your checklist of required audit deliverables. This is where you generate or upload the formal records your auditor needs to see - like meeting minutes, access matrices, and penetration test reports.\n\n⚠️\n\nAnything marked with a yellow TODO tag should be completed for the audit.\n\nIn-app forms: Many requirements can be completed in Comp AI using built-in templates.\n\nManual uploads: If you already have records in Google Drive, an HRIS, or elsewhere, upload those files instead.\n\nPentesting: Run your own penetration test right inside Comp AI—head to the Security tab and start a scan (your first run is free). No need to source an external vendor. See the Penetration Test page below for details.\n\n🚀\n\nOpen each page below to get:\n\nA plain-English explanation of what the auditor wants\n\nThe fastest way to clear the requirement\n\nGuidance on what “good evidence” looks like for both small and large teams\n","2026-06-10T13:39:14.502Z","2026-06-23T17:25:31.289Z","caa98822-8207-4e0f-ae6a-430033586212",[],[],[],"documents-3","https://kb.trycomp.ai/Documents-313a1b1858b88049b75fe23cbd775298?pvs=25","2026-06-23T17:25:32.355Z","2026-06-23T17:25:32.370Z","3fa1e0ff-33a8-48c3-ae9e-b9bdbb8af38c",[],[],[],"Device Management","device-management","https://kb.trycomp.ai/Device-Management-313a1b1858b880eea571c7583e17aaed","[← Get Audit Ready](https://kb.trycomp.ai/p/313a1b1858b880baa983e8df56697e7b?pvs=25) • [↑ Evidence](https://kb.trycomp.ai/p/2f0a1b1858b880bd8544ecb562b8a0d8?pvs=25)\n","2026-06-10T13:39:31.705Z","2026-06-23T17:25:34.617Z","50209145-2fa6-4482-b641-9d8696a25cb8",[],[],[],"Data Subject Rights (DSAR) Log & Response Letters","data-subject-rights-dsar-log-response-letters","https://kb.trycomp.ai/Data-Subject-Rights-DSAR-Log-Response-Letters-388a1b1858b8815e8886ce08aa0478c9","Data Subject Rights (DSAR) toolkit. A log to track requests and ready-to-send response letters. Respond within one month; you may extend by up to two further months for complex or numerous requests if you tell the person inside the first month.\n","2026-06-23T17:25:36.876Z","2026-06-23T17:25:36.904Z","5476f67a-b2b0-4509-af78-243a5bef147b",[],[],[],"Data Retention Schedule","data-retention-schedule","https://kb.trycomp.ai/Data-Retention-Schedule-388a1b1858b881c8a16dc4615374dadc","| Data category | Examples | Retention period | Lawful basis / justification | Disposal method |\n| -------------------------- | ----------------------------- | ------------------------------------------------- | ----------------------------------- | ------------------------------------------- |\n| Customer account data | Name, email, account settings | Duration of contract + 12 months | Contract; legitimate interest | Hard delete from database and backups |\n| Billing and invoices | Invoices, payment records | 7 years | Legal obligation (tax / accounting) | Secure deletion after the period |\n| Marketing contacts | Email, consent records | Until consent withdrawn; reviewed every 24 months | Consent | Remove from CRM and add to suppression list |\n| Support tickets | Correspondence, attachments | 24 months after resolution | Legitimate interest | Delete or anonymize |\n| Job applicants (not hired) | CV, interview notes | 6 to 12 months | Legitimate interest / consent | Delete |\n| Server and access logs | IP addresses, access logs | 12 months | Legitimate interest (security) | Automatic rotation and deletion |\n","2026-06-23T17:25:37.065Z","2026-06-23T17:25:37.082Z","da023e08-019a-484e-a3b2-20e54a7f6757",[],[],[],"Data, Consent & Individual Rights","data-consent-individual-rights","https://kb.trycomp.ai/Data-Consent-Individual-Rights-388a1b1858b8817b9301fa32ed61680d","Data, consent & individual rights. These five tasks cover how you handle personal data day to day and how you honour the rights people have over it. Each section is named exactly as the task appears in your platform, so if you're stuck on one, jump straight to it below.\n","2026-06-23T17:25:33.617Z","2026-06-23T17:25:33.635Z","ca0a65ca-1002-4450-a6b6-a666eb5100c2",[],[],[],"Data Breach Register & Notification Templates","data-breach-register-notification-templates","https://kb.trycomp.ai/Data-Breach-Register-Notification-Templates-388a1b1858b881829106decd5c2dd282","Data breach register and notifications. Log every personal data breach, and use the templates to notify the supervisory authority (within 72 hours of becoming aware, where required) and affected individuals (without undue delay where the risk is high).\n","2026-06-23T17:25:37.279Z","2026-06-23T17:25:37.294Z","535fe76c-efaa-4c15-817d-c65c129fe038",[],[],[],"Custom Frameworks","custom-frameworks","**Product area:** Frameworks (Custom)\\\n**Summary:** Custom frameworks let a customer build their own compliance framework — for an internal control set, a contractual/customer requirement, or a standard Comp AI doesn't ship out of the box. You create the framework, add requirements and controls, map evidence (policies, tasks, documents) to satisfy them, track a compliance score, and optionally publish its status to your public Trust Center.\n\n**Disambiguation (use to route questions correctly):**\n\n- **Built-in frameworks** (SOC 2, ISO 27001, etc.) ship pre-built and stay updated by Comp AI.\n- **Custom frameworks** are authored by the customer and live only in their organization.\n- **Trust Center** is the separate public page where a custom framework's status can be *shown* to visitors — it only appears there if explicitly enabled.\n\n---\n\n## **Core facts**\n\n- **Where:** Created from the **Frameworks** page via **Add Custom Framework**.\n- **Same engine as built-in frameworks:** custom frameworks use the same Requirement → Control → Evidence model, so existing policies, tasks, and documents can be reused.\n- **Org-scoped:** a custom framework is private to the organization that created it.\n- **Evidence types that count:** published **policies**, completed **tasks**, and **documents** submitted within the last 6 months.\n- **Created manually:** there is no AI generation of requirements/controls for custom frameworks (unlike policies).\n- **Trust Center optional:** custom frameworks are private until enabled for the public Trust Center.\n\n---\n\n## **Structure**\n\nA custom framework follows the same hierarchy as a built-in one:\n\n- **Framework** → contains **Requirements** (what must be satisfied, e.g. \"10.3 Access Reviews\")\n- **Requirement** → contains **Controls** (how you satisfy it)\n- **Control** → links **Evidence** (policies, tasks, documents that prove it)\n\nCompliance is measured at the evidence layer.\n\n---\n\n## **The overall flow (end to end)**\n\n1. **Create the framework** — **Add Custom Framework**, then provide **Name** (required), **Description** (required), and **Version** (optional, defaults to 1.0.0).\n2. **Add requirements** — **Add Custom Requirement**, each with a **name**, **identifier** (e.g. \"10.3\"), and **description**.\n3. **Add or map controls** — within a requirement, **Add Control** (new) or **Link existing control** (reuse what you have).\n4. **Map evidence** — link policies, tasks, and documents to each control.\n5. **Track the score** — compliance % updates as mapped evidence is completed.\n6. **(Optional) Publish to Trust Center** — enable the framework and set its public status.\n\n---\n\n## **Statuses (what each means)**\n\nCustom frameworks have **no internal draft/published lifecycle**. The only status concept is the **public Trust Center status** you choose when you enable it:\n\n| **Status** | **Meaning (shown publicly)** |\n| --- | --- |\n| **Started** | Work on the framework has begun. |\n| **In Progress** | Actively being worked toward. |\n| **Compliant** | Requirements are met. |\n\n> Evidence that counts toward the compliance score: **policies** (Published), **tasks** (Done / Not relevant), **documents** (submitted within the last 6 months).\n\n---\n\n## **Compliance scoring**\n\nA custom framework's compliance percentage is the share of mapped evidence that's complete:\n\n> **Score = completed artifacts ÷ total mapped artifacts × 100**\n\n…where each linked published policy, done/not-relevant task, and recently submitted document is one artifact.\n\n---\n\n## **Publishing to the Trust Center**\n\nIn **Trust → portal settings**, under the custom frameworks section, you can:\n\n- **Enable** the framework so it appears on your public Trust page.\n- Set its public **status** (Started / In Progress / Compliant).\n- Upload a **badge/logo** (PNG/JPEG/WebP, \\~256KB max); an initials avatar is shown if none is uploaded.\n- Upload a **compliance certificate (PDF)** for visitors to access.\n\n**What visitors see:** for each enabled framework — its name, description, the status you set, its badge, and the certificate if provided. Frameworks that aren't enabled never appear publicly.\n\n---\n\n## **Roles & permissions (who can do what)**\n\n| **Capability** | **Owner** | **Admin** | **Auditor** |\n| --- | --- | --- | --- |\n| Create a custom framework | ✓ | ✓ | ✗ |\n| Add requirements / controls / map evidence | ✓ | ✓ | ✗ |\n| Delete a framework | ✓ | ✓ | ✗ |\n| View frameworks | ✓ | ✓ | ✓ |\n| Enable/publish to Trust Center, set status, upload badge/cert | ✓ | ✓ | ✗ |\n\n(Authoring uses the `framework` permission; Trust Center publishing uses the `trust` permission.)\n\n---\n\n## **Sample Q&A (canned answers the agent can adapt)**\n\n**Q: How do I create my own framework?**\\\nA: On the Frameworks page, click **Add Custom Framework** and give it a name, description, and optional version. Then add requirements, add or link controls under each requirement, and map your policies, tasks, and documents as evidence.\n\n**Q: What can I use as evidence for a custom framework?**\\\nA: Published policies, completed tasks, and documents submitted within the last 6 months — the same evidence types as built-in frameworks. You can reuse what you already have by linking existing controls.\n\n**Q: How is my custom framework's compliance percentage calculated?**\\\nA: It's the share of mapped evidence that's complete — published policies, done tasks, and recently submitted documents — across all the controls in the framework.\n\n**Q: Can I reuse controls I already have instead of recreating them?**\\\nA: Yes. On a requirement, use **Link existing control** to map controls (and their evidence) you've already built.\n\n**Q: How do I show my custom framework on our Trust Center?**\\\nA: In Trust → portal settings, find the custom frameworks section and **enable** the framework. You can then set its public status (Started, In Progress, or Compliant), upload a badge, and attach a compliance certificate PDF. Only enabled frameworks appear publicly.\n\n**Q: What do visitors to our Trust Center see for a custom framework?**\\\nA: Its name, description, the status you set, a badge (or an initials avatar if none was uploaded), and a downloadable certificate if you provided one.\n\n**Q: Can I edit a requirement's name after creating it?**\\\nA: You can freely add and link requirements and controls. Inline editing of an existing requirement's details and reordering aren't exposed the same way, so the reliable path today is to add a corrected requirement/control.","2026-06-25T22:51:52.435Z","2026-07-07T16:10:51.666Z","f006fac9-6a09-4b0b-a48d-3e4a1a66e037",[],[],[],"Cookie Register","cookie-register","https://kb.trycomp.ai/Cookie-Register-388a1b1858b881f9b935da31a2888a43","Cookie register. An inventory of every cookie, SDK, pixel, and tracker on your sites and apps. It backs your cookie banner and cookie policy. Reconcile it against what is actually set in production, and remediate any drift.\n","2026-06-23T17:25:36.979Z","2026-06-23T17:25:36.993Z","ddca7818-4612-4ada-aea5-33837de178ae",[],[],[],"Cookie Consent and Tracking evidence","cookie-consent-and-tracking-evidence","\n### 1. Cookie / tracker inventory\n\nA complete list of all **cookies, SDKs, pixels, and trackers** used across your public websites and apps. For each, capture the name, category (essential vs. non-essential), purpose, duration, and the third-party recipient (if any). A spreadsheet or a scan export (e.g. from your consent management platform, OneTrust/Cookiebot/etc., or a tool like cookie-scanner) works as evidence.\n\n### 2. Consent banner behaviour\n\nEvidence (screenshots or a screen recording) showing your banner:\n\n- Presents non-essential cookies as **opt-in, default OFF**\n- Loads **no non-essential trackers before consent is given**\n- Offers a **\"reject\" option as easy as \"accept\"** (i.e. not a hidden/buried reject, no dark patterns)\n\nA short screen recording is the cleanest way to show \"nothing fires before consent\" — capture the network tab on first load showing no non-essential trackers until you click accept.\n\n### 3. Cookie policy disclosure\n\nA copy of (or link to) your cookie policy showing it discloses, for each cookie category: **name, purpose, duration, and third-party recipient**. Screenshot or PDF of the published policy.\n\n### 4. Consent records\n\nEvidence that consent is **stored with a timestamp and scope**, and that **withdrawal is as easy as granting**. Typically an export/screenshot from your consent management platform showing logged consent events, plus a screenshot of the withdrawal mechanism (e.g. a \"cookie settings\" link in the footer that lets users change/withdraw).\n\n### 5. Drift reconciliation\n\nThe key verification step: **reconcile the banner's declared cookie list against what is actually set in production**, and remediate any mismatch. Evidence = a comparison showing the cookies your banner claims vs. what a live scan actually finds, with any drift fixed. This is the bit most orgs miss — the declared list and the real-world list must match.\n\n### What to upload\n\n- Cookie/tracker inventory (spreadsheet or scan export)\n- Banner screenshots/recording showing opt-in default-off + easy reject + no pre-consent tracking\n- Cookie policy (PDF or link) with the required per-category disclosures\n- Consent record sample showing timestamp + scope + withdrawal mechanism\n- Reconciliation showing declared-vs-actual cookies match (plus notes on any drift remediated)","2026-06-05T09:57:08.238Z","78b27f17-b88a-4971-94e6-fe94948c5893",[],[],[],"Connect your Integrations","connect-your-integrations-2","https://kb.trycomp.ai/Connect-your-Integrations-313a1b1858b8806782e8f0784c6a17f0","In the [app](http://app.trycomp.ai/), go to the Integrations tab. Connect any one-click integrations relevant to your vendors (any marked with the green “Connect” button.\n","2026-06-10T13:39:14.804Z","2026-06-23T17:25:31.104Z","586b25d9-e7f9-4020-ad27-302213789d39",[],[],[],"connect-your-integrations","https://kb.trycomp.ai/p/313a1b1858b8806782e8f0784c6a17f0?pvs=25","2026-06-10T13:39:13.701Z","2026-06-10T13:39:13.738Z","20d8c880-7cd3-4add-9fed-7b1ba4b19b35",[],[],[],"comp/tools at release · trycompai/comp · GitHub","comptools-at-release-trycompaicomp-github","https://github.com/trycompai/comp/tree/release/integrations-catalog","## Latest commit\n\n![tofikwest](/api/knowledge-base/images/5896950c-be2d-4cef-8754-b10678136953)![claude](/api/knowledge-base/images/86777a12-b41a-4125-bcaf-69f9c8bcf443)\n\nand\n\nApr 20, 2026Apr 20, 2026\n\nAdds SYNC\\_MIN\\_INTERVAL\\_MS (default 100ms) to enforce a minimum gap between HTTP requests across all workers. Paces the sync to stay under the CompAI internal API throttle, which was triggering 429s at higher concurrency. Also logs backoff delays when retries fire for visibility. Co-Authored-By: Claude Opus 4.7 (1M context) \n\n## Folders and files\n\n\\| Name | | Name | Last commit message | Last commit date |\n\\| --- | --- | --- | --- |\n\\| ### parent directory

[

..

](https://github.com/trycompai/comp/tree/release) | | |\n\\| [integrations-catalog-sync](https://github.com/trycompai/comp/tree/release/tools/integrations-catalog-sync \"integrations-catalog-sync\") | | [integrations-catalog-sync](https://github.com/trycompai/comp/tree/release/tools/integrations-catalog-sync \"integrations-catalog-sync\") | [fix(integrations-catalog): add global request pacing to prevent 429s](https://github.com/trycompai/comp/commit/0dfb793be3d7182cc81b0a9bc1e9068211cb2b7a \"fix(integrations-catalog): add global request pacing to prevent 429s
Adds SYNC_MIN_INTERVAL_MS (default 100ms) to enforce a minimum gap
between HTTP requests across all workers. Paces the sync to stay under
the CompAI internal API throttle, which was triggering 429s at higher
concurrency.
Also logs backoff delays when retries fire for visibility.
Co-Authored-By: Claude Opus 4.7 (1M context) \") | Apr 20, 2026Apr 20, 2026 |\n\\| | | |\n","2026-04-29T15:39:09.372Z","2026-04-29T15:39:09.930Z","97eba5e9-e7cd-4f91-bc78-d7ff20825c64",[],[],[],"comp/tools at main · trycompai/comp · GitHub","comptools-at-main-trycompaicomp-github","https://github.com/trycompai/comp/blob/main/integrations-catalog/README.md","## Latest commit\n\n![tofikwest](/api/knowledge-base/images/a0655bf2-fe3f-4ecc-9795-5a4e63308ddb)![claude](/api/knowledge-base/images/0d82dbe3-8b88-4d4f-b4e0-b40242a9f2bd)\n\nand\n\nApr 20, 2026Apr 20, 2026\n\n## Folders and files\n\n\\| Name | | Name | Last commit message | Last commit date |\n\\| --- | --- | --- | --- |\n\\| ### parent directory

[

..

](https://github.com/trycompai/comp/tree/main) | | |\n\\| [integrations-catalog-sync](https://github.com/trycompai/comp/tree/main/tools/integrations-catalog-sync \"integrations-catalog-sync\") | | [integrations-catalog-sync](https://github.com/trycompai/comp/tree/main/tools/integrations-catalog-sync \"integrations-catalog-sync\") | [fix(integrations-catalog): add global request pacing to prevent 429s](https://github.com/trycompai/comp/commit/0dfb793be3d7182cc81b0a9bc1e9068211cb2b7a \"fix(integrations-catalog): add global request pacing to prevent 429s
Adds SYNC_MIN_INTERVAL_MS (default 100ms) to enforce a minimum gap
between HTTP requests across all workers. Paces the sync to stay under
the CompAI internal API throttle, which was triggering 429s at higher
concurrency.
Also logs backoff delays when retries fire for visibility.
Co-Authored-By: Claude Opus 4.7 (1M context) \") | Apr 20, 2026Apr 20, 2026 |\n\\| | | |\n","2026-05-11T18:28:52.706Z","2026-05-19T19:42:23.094Z","8e57771f-e5c2-4ac0-b88a-3e0b91984868",[],[],[],"Compliant badges for your site","compliant-badges-for-your-site","https://kb.trycomp.ai/Certified-Badges-351a1b1858b88056a511c6dd3d6d3787","","2026-05-05T17:36:30.542Z","9ff95dfd-357c-4996-b390-a2f502807884",[],[],[],"Comp AI Status Page","status-page","https://status.trycomp.ai","","2026-05-20T18:11:41.883Z","2026-05-20T18:11:47.424Z","2dd36bb6-e91c-401b-97c0-dabd0c2ba498",[],[],[],"Cloud Infrastructure & Operations","cloud-infrastructure-operations-2","https://kb.trycomp.ai/Cloud-Infrastructure-Operations-313a1b1858b880418fffccbecba29db4?pvs=25","#### Backups and Restoration Testing\n","2026-06-23T17:25:35.019Z","2026-06-23T17:25:35.037Z","cd21f5e8-0be6-463f-a0ae-45610b1d9b45",[],[],[],"cloud-infrastructure-operations","https://kb.trycomp.ai/Cloud-Infrastructure-Operations-313a1b1858b880418fffccbecba29db4","![⚡](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==) Automation:\n\nHigh Configuration Overhead\n\nAutomating AWS & Azure controls requires complex environment configuration and strict policy management. We strongly recommend manual evidence (i.e screeenshots) for a faster audit experience if you use these providers, unless you have a dedicated DevOps engineer to manage the initial setup and any potential maintenance.\n\nApp Layer Prompt: \"Check my cloud network settings. Alert me if Port 22 (SSH) or 3389 (RDP) is ever configured to allow traffic from 0.0.0.0/0 (Anywhere).\"\n\nDatabase: \"Monitor my database instances (RDS, CloudSQL) every 24 hours. Mark this control as 'Failed' if any database port (e.g., 5432, 3306) allows inbound traffic from the public internet (\n\n0.0.0.0/0\n\n).\"\n\n![⚙️](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==) General:\n\nThis control is about restricting access to production and sensitive systems using deny-by-default rules — you only open access for explicit, approved reasons.\n\nIf you run cloud infrastructure: You need to provide evidence for two distinct layers:\n\nThe App Layer (Servers / VMs)\n\nWhat to upload: Screenshots of the Firewall/Security Group rules attached to your Web Servers or EC2/VM instances.\n\nCompliance Check: Ensure SSH (Port 22) or RDP (Port 3389) is either missing entirely or strictly limited to a private VPN IP. Never allow\n\n0.0.0.0/0\n\non these ports.\n\nNote: If you use PaaS (like Heroku or Vercel) and have no servers to manage, please add a comment stating this.\n\nThe Data Layer (Databases)\n\nWhat to upload: Screenshots of the specific inbound firewall rules for your Database (RDS, Azure SQL, etc.).\n\nCompliance Check: Ensure there is no rule allowing\n\n0.0.0.0/0\n\n(Anywhere), even on non-database ports (like HTTPS). The only allowed sources should be your App Servers or private subnets.\n\nIf you don't manage infrastructure (SaaS-only or service orgs): Use equivalent SaaS access controls. Acceptable evidence includes:\n\nRBAC / role-based access screenshots showing who has admin/production access and that non-admins don't.\n\nConditional access policies (e.g. Okta, Entra/Azure AD, Google Workspace) requiring MFA, managed device, or specific location.\n\nIP allowlists / network restrictions on admin consoles where supported.\n\nPrivileged access reviews — a recent review showing who has elevated permissions and confirmation that the list was approved.\n","2026-06-10T13:39:31.823Z","2026-06-10T13:39:31.843Z","9142c4c2-de95-4914-bf71-fe2a7d037746",[],[],[],"Change card registered for billing.","change-card-registered-for-billing","To update or change the credit card on file for your CompAI subscription, please reach out to our accounts team at [**billing@trycomp.ai**](mailto:billing@trycomp.ai). We’ll be happy to help you securely transition your billing details.","2026-04-28T18:44:21.269Z","fe146828-2295-4357-b641-a8ad9fd6052d",[],[],[],"Certified Badges","certified-badges","\\[\n\nSkip to content\n\n]\\()\n\nGet Notion free\n\n![](/api/knowledge-base/images/c6a43917-cae7-4f2d-a215-dd113e7e5eea)\n\n![](/api/knowledge-base/images/9edde6dc-e5a7-47d3-8532-7f045c208f2a)\n\n![](/api/knowledge-base/images/ca7d6421-40c8-4b1d-8e58-20b8d4e2b9a6)\n\n![](/api/knowledge-base/images/9dd6e21b-9e47-4a62-b421-d73c21595c59)\n\n![](/api/knowledge-base/images/d928ae3f-ca3a-475c-a370-a6481ea59fa4)\n\n![](/api/knowledge-base/images/9cdc4e73-53a8-4093-978f-80e1638ed175)\n\n![](/api/knowledge-base/images/395b7fcb-9eb1-4756-ba75-7316c620379d)\n\n![](/api/knowledge-base/images/f6dee3e5-45e7-426a-86ee-c7fad2156039)\n\n![](/api/knowledge-base/images/08f4dda9-582c-4c21-aaee-558c210cbe34)\n","2026-06-10T13:39:22.624Z","2026-06-10T13:39:29.323Z","e8eb844b-875f-44c2-992e-518098857309",[],[],[],"Automations Tab Missing on \"Separation of Environments\" Task","automations-tab-missing-on-separation-of-environments-task","**Symptom**\\\nA customer notices the **Automations** tab is gone from the Separation of Environments task, either after a regen or in general. They may ask if the regen removed it, if it's a timing issue, or where their configured integration (e.g., Microsoft 365) went.\\\n\\\n**Root Cause**\\\nThe Separation of Environments task is intentionally configured as a **manual task**. It does not have an automated check, so the Automations tab will not appear — before or after a regen. This is expected behavior, not a bug.\\\n\\\n**Why It's Manual**\\\nAutomated detection for environment separation is not reliable across the variety of ways customers implement it (separate cloud accounts, VPCs, tags, naming conventions, etc.). Manual evidence is fully accepted by auditors for this control.\\\n\\\n**How to Respond**\n\n1. Confirm the missing tab is **expected** — it's not a timing issue and won't come back after a regen.\n2. Clarify that any previously connected integration will not auto-populate evidence for this task since it's manual.\n3. Direct the customer to upload evidence directly to the task — a screenshot or config export showing prod/non-prod separation is sufficient for auditors.\n\n\\\n\\\n**Example Phrasing**\n\n> \"The Automations tab won't appear on this task — Separation of Environments is set up as a manual task since automated detection isn't reliable for this control. Your Microsoft 365 (or other) integration won't auto-populate it, but the good news is that a screenshot or config export showing your environment separation works perfectly for auditors. Just upload it directly to the task!\"","2026-06-23T19:51:11.118Z","9e5964df-4fad-4fd6-9761-f77864d9ee37",[],[],[],"Automation failure alerts","automation-failure-alerts","When an automation fails, you will receive an email, as well as an in-app notification that the automation has failed. ","2026-02-03T18:16:45.368Z","504f2fd5-c051-4bf1-867f-4e533bafc3cf",[],[],[],"Are the platform’s templated policies acceptable to auditors, and do I need to edit them before collecting evidence?","are-the-platforms-templated-policies-acceptable-to-auditors-and-do-i-need-to-edit-them-before-collec","https://compai.unthread.io/dashboard/inbox/all/conversations/1c623344-0575-45ac-9c04-3e5361558d7e","## Summary\n\nCustomers often ask whether the platform’s automatically generated (templated) policies are sufficient for auditors, and whether they must be edited before proceeding with evidence collection.\n\n## Question\n\n“Are your auditors comfortable with the templated policies, and is it sufficient to collect evidence to support them?”\n\n## Answer\n\n- The policies generated in the platform are created based on the answers provided during onboarding.\n- In their current state (without any changes), these generated policies are acceptable to the auditors.\n- You’re expected to update policies as your business grows.\n- You can still adjust policies even after they are published.\n- You can use the AI Editor to help make any policy changes you want.","2026-03-18T18:19:06.212Z","00614421-6b01-4561-adea-24a1cd8530cf",[],[],[],"Anthropic Integration: Employee Access Check Setup","anthropic-integration-employee-access-check-setup","## Overview\n\nThe Anthropic integration in Comp AI is used exclusively for the **Employee Access** check. This check lists the members of your Anthropic organization to verify employee access. It is **not** used for any other checks, including App Availability.\n\n## Required Key Type\n\nThe Employee Access check requires an **Anthropic Admin API key**. Regular Anthropic API keys will not work and will result in a `401 Unauthorized` error:\n\n```plaintext\nFailed to list organization users: HTTP 401: Unauthorized - {\"type\":\"error\",\"error\":{\"type\":\"authentication_error\",\"message\":\"invalid x-api-key\"}}\n```\n\n**Admin API keys** have the format `sk-ant-admin01-...` and are distinct from standard API keys.\n\n## How to Generate an Admin API Key\n\n1. Go to [console.anthropic.com](https://console.anthropic.com).\n2. Navigate to **Settings → Admin keys**.\n3. Generate a new Admin API key.\n4. Use this key when configuring the Anthropic integration in Comp AI.\n\n## Scope of the Anthropic Integration\n\n| Check | Anthropic Integration Required? |\n| --- | --- |\n| Employee Access | Yes — requires Admin API key |\n| App Availability | No — disconnect if connected |\n\nIf the Anthropic integration is connected to the **App Availability** check, it will fail. Disconnect it from App Availability — that check is specific to your own organization's sites and does not involve Anthropic.","2026-06-30T22:41:54.294Z","155f027f-6bcd-41d6-af50-3fc4aa353e52",[],[],[],"Access Control","access-control","https://kb.trycomp.ai/Access-Control-313a1b1858b8800d9a7ac8f56af18382","2026-06-10T13:39:31.342Z","2026-06-23T17:25:34.368Z","b0a6a320-acdf-4ad1-8eea-d111dc1bbe0b",[],[],[],{"_53":1613,"_162":1614,"_76":1615,"_644":-5,"_645":-5,"_169":-5,"_170":1616,"_172":1616,"_15":1617,"_17":18,"_648":1618,"_104":1619,"_651":1620},{"_53":1062,"_162":1063,"_76":1064,"_644":-5,"_645":-5,"_169":-5,"_170":1065,"_172":1065,"_15":1066,"_17":18,"_648":1067,"_104":1068,"_651":1069},{"_53":299,"_162":779,"_76":-5,"_644":-5,"_645":-5,"_169":-5,"_170":780,"_172":780,"_15":781,"_17":18,"_648":782,"_104":783,"_651":784},{"_53":641,"_162":642,"_76":643,"_644":-5,"_645":-5,"_169":-5,"_170":646,"_172":646,"_15":647,"_17":18,"_648":649,"_104":650,"_651":652},"FAQs","faqs","Most commonly asked questions about the app and audit process","icon","parentId","2026-07-07T16:06:53.230Z","f0fe8cf3-260b-4788-978a-1703ed37e19c","articleCount",13,[653,654,655,656,657,658,659,660,661,662,663,664,665],"subCollections",[],{"_74":620,"_162":773,"_164":-5,"_166":622,"_168":647,"_169":-5,"_170":774,"_172":774,"_15":775,"_17":18,"_176":776,"_178":-5,"_179":777,"_181":778},{"_74":183,"_162":765,"_164":-5,"_166":766,"_168":647,"_169":-5,"_170":767,"_172":768,"_15":769,"_17":18,"_176":770,"_178":-5,"_179":771,"_181":772},{"_74":756,"_162":757,"_164":-5,"_166":758,"_168":647,"_169":-5,"_170":759,"_172":760,"_15":761,"_17":18,"_176":762,"_178":-5,"_179":763,"_181":764},{"_74":747,"_162":748,"_164":-5,"_166":749,"_168":647,"_169":-5,"_170":750,"_172":751,"_15":752,"_17":18,"_176":753,"_178":-5,"_179":754,"_181":755},{"_74":738,"_162":739,"_164":-5,"_166":740,"_168":647,"_169":-5,"_170":741,"_172":742,"_15":743,"_17":18,"_176":744,"_178":-5,"_179":745,"_181":746},{"_74":729,"_162":730,"_164":-5,"_166":731,"_168":647,"_169":-5,"_170":732,"_172":733,"_15":734,"_17":18,"_176":735,"_178":-5,"_179":736,"_181":737},{"_74":720,"_162":721,"_164":-5,"_166":722,"_168":647,"_169":-5,"_170":723,"_172":724,"_15":725,"_17":18,"_176":726,"_178":-5,"_179":727,"_181":728},{"_74":711,"_162":712,"_164":274,"_166":713,"_168":647,"_169":-5,"_170":714,"_172":715,"_15":716,"_17":18,"_176":717,"_178":-5,"_179":718,"_181":719},{"_74":702,"_162":703,"_164":-5,"_166":704,"_168":647,"_169":-5,"_170":705,"_172":706,"_15":707,"_17":18,"_176":708,"_178":-5,"_179":709,"_181":710},{"_74":692,"_162":693,"_164":694,"_166":695,"_168":647,"_169":-5,"_170":696,"_172":697,"_15":698,"_17":18,"_176":699,"_178":-5,"_179":700,"_181":701},{"_74":683,"_162":684,"_164":-5,"_166":685,"_168":647,"_169":-5,"_170":686,"_172":687,"_15":688,"_17":18,"_176":689,"_178":-5,"_179":690,"_181":691},{"_74":674,"_162":675,"_164":-5,"_166":676,"_168":647,"_169":-5,"_170":677,"_172":678,"_15":679,"_17":18,"_176":680,"_178":-5,"_179":681,"_181":682},{"_74":666,"_162":-5,"_164":-5,"_166":667,"_168":647,"_169":-5,"_170":668,"_172":669,"_15":670,"_17":18,"_176":671,"_178":-5,"_179":672,"_181":673},"Why did ISO 27001/SOC 2 dashboard progress drop and why are evidence tasks back to “To Do” after uploading evidence?","## Problem\n\nDashboard progress for ISO 27001 and SOC 2 can decrease and tasks can revert to **“To Do”** even after evidence was previously uploaded.\n\n## Cause\n\nThis typically happens when an evidence task’s **review frequency** (for example, **Quarterly**) is reached. When the next review period comes due, the platform requires the task to be reviewed again, so it appears as **“To Do”**.\n\n## How to mark tasks complete again\n\nFor each task showing **“To Do”**:\n\n1. Open the task.\n2. Review whether anything has changed.\n3. If nothing has changed, add a comment such as **“No changes”**.\n4. Mark the task as **Done** again.\n5. If something has changed, submit **new/updated evidence** and then mark it **Done**.\n\n## Can the quarterly frequency be reduced?\n\nYes—**the task frequency can be reduced**, but quarterly reviews are generally recommended to ensure controls and evidence don’t fall out of date.","2026-03-18T18:17:47.217Z","2026-07-07T16:37:36.907Z","c567a277-9d79-45ad-b056-8e1f9ed90654",[],[],[],"Where do I get the new device agent? ","where-do-i-get-the-new-device-agent","Question: I have the old fleet device agent, Ive followed the migration guide, but the employee portal doesnt give me the option to download the newest agent. \\\n\\\nAnswer: direct download link for the new device agent: ","2026-04-02T16:55:26.950Z","2026-07-07T16:37:36.903Z","f0f64053-3939-491d-ab92-fc6e997feca1",[],[],[],"What is a Control","what-is-a-control","# What is a Control?\n\nA **control** is a single security measure your organization actually implements — for example, *\"Require MFA on all accounts.\"*\n\nThe key advantage: **one control can satisfy many compliance frameworks at once**, eliminating redundant work.\n\n---\n\n## How Controls Fit Into the Compliance Chain\n\nControls sit at the center of a clear hierarchy:\n\n**Framework → Requirement → Control → Policy / Task / Evidence**\n\n| Level | What It Is |\n| --- | --- |\n| **Framework** | The standard you're complying with (e.g., SOC 2, GDPR, ISO 27001) |\n| **Requirement** | A specific clause or obligation within that framework |\n| **Control** | The measure you actually implement to meet the requirement |\n| **Policy / Task / Evidence** | How you prove the control is real and working |\n\n---\n\n## Many-to-Many Mapping\n\nControls map to requirements on a **many-to-many basis** — meaning a single control can check boxes across multiple frameworks simultaneously. This is what makes controls so powerful.\n\n---\n\n## Example: One MFA Control, Two Frameworks\n\nSay you implement one control: **\"MFA enforced on all systems.\"**\n\n**It maps to:**\n\n- **SOC 2** → CC6.1 (Logical Access Controls)\n- **GDPR** → Art. 32 (Security of Processing)\n\n**It's backed by:**\n\n- **Policy** → Your Access Control Policy\n- **Task** → Quarterly MFA enrollment review\n- **Evidence** → Access export / RBAC matrix\n\nYou do the MFA work **once**, and it counts toward both frameworks. If you add ISO 27001 later, the same control simply maps to its corresponding requirement — no additional work required.\n\n---\n\n## Getting Started with Controls\n\nComp ships **pre-built templates** for major frameworks, including:\n\n- SOC 2\n- GDPR\n- ISO 27001\n- HIPAA\n- And more\n\nWhen you adopt a framework, Comp **automatically creates a populated control set** for your organization — so you're never starting from a blank page. You can also build **custom frameworks and controls** to fit your specific needs.","2026-06-22T21:29:05.499Z","2026-07-07T16:09:55.096Z","90d1ca55-e643-4216-a14c-b914a24b6da6",[],[],[],"What does “instance name” mean in the infrastructure document (AWS)?","what-does-instance-name-mean-in-the-infrastructure-document-aws","https://compai.unthread.io/dashboard/inbox/all/conversations/9ec0c001-e6ea-4495-aac0-536b47dc6b58","## Question\n\nIn the infrastructure document, what is meant by “instance name”? Does this mean we should list each AWS resource along with its AWS instance ID (e.g., for EC2 instances)?\n\n## Answer\n\n“Instance name” refers to the **unique identifier** for the resource.\n\n- For an **Amazon EC2 instance**, this can be either:\n - the **AWS instance ID** (e.g., `i-1234567`), or\n - a **custom name** you’ve assigned (such as the Name tag).\n\n## What to document\n\nYes—when listing AWS resources in the infrastructure document, include the **resource-level identifiers**, such as:\n\n- EC2 instances with their **instance IDs** (and optionally their custom names).\n\n## Tip\n\nAWS also provides ways to **export resource details to a CSV**, which can help you collect these identifiers in bulk.","2026-03-18T18:18:23.736Z","2026-07-07T16:37:36.905Z","11ed323b-d111-43ed-b86b-08e2be5cf3bc",[],[],[],"What are the onboarding questions?","onboarding-questions","### **The Basics**\n\n- **Describe your company in a few sentences**\n\n - *A quick overview.*\n\n- **What industry is your company in?**\n\n - *SaaS, FinTech and so on.*\n\n- **How many employees do you have?**\n\n - *Total number of full time, part time and contractors (Or if scoped down to a particular team, the number of team members).*\n\n### **Hardware & Security**\n\n- **What devices do your team members use?**\n\n - *Personal or company provided laptops and/or phones.*\n\n- **How do your team members sign in to work tools?**\n\n - *Email and password, or an identity provider like Google.*\n\n### **Stack & Environment**\n\n- **What software do you use?**\n\n - *Mission critical, e.g. if we remove it we no longer have a product, and anything that touches customer data. (Only add the top 4 - 5 most critical here, we can add the rest later).*\n\n- **How does your team work?**\n\n - *Remote or in person.*\n\n- **Where do you host your applications and data?**\n\n### **Data Management**\n\n- **What types of data do you handle?**\n\n- **Where is your data located?**\n\n - *What region.*","2026-03-19T22:02:24.377Z","2026-07-07T16:37:36.906Z","3e59cdc9-93d4-4271-b745-c906e3f915a8",[],[],[],"SOC 2 Type 2: What happens after all SOC 2 tasks are cleared?","soc-2-type-2-what-happens-after-all-soc-2-tasks-are-cleared","When all SOC 2 tasks have been cleared and you’re ready to proceed with a SOC 2 Type 2 audit, Support will:\n\n- Review your workspace/status\n- Complete the **Audit handoff** for your **SOC 2 Type 2** audit\n- Kickoff penetration testing (if not already complete)\n- If applicable, complete Audit handoff for other in-scope frameworks as well (e.g., **HIPAA**)\n\nAfter the audit handoff is completed, you can continue with your SOC 2 Type 2 process.","2026-03-18T18:27:40.871Z","2026-07-07T16:37:36.902Z","41c5af2b-02e9-4fd8-a8b5-122ae8ca7426",[],[],[],"SOC 2 Type 2 — Observation Period Overview","soc-2-type-2-observation-period-overview","**Topic:** SOC 2 Observation Period\\\n\\\n**Intent Triggers** *(questions this entry should answer)*\n\n- \"What does the SOC 2 observation period look like?\"\n- \"When does my observation period start?\"\n- \"How long does the SOC 2 audit take?\"\n- \"What is the difference between Year 1 and renewal observation periods?\"\n- \"Can I get a SOC 2 report faster?\"\n\n**Key Facts**\\\n\\\n**Observation Window Start**\\\nThe observation period begins when the customer creates their organization in the Comp AI app. Evidence collection and control monitoring start from that point forward.\\\n\\\n**Year 1 (First-Time Report)**\n\n- Minimum observation period: 90 days (3 months)\n- Before the auditor receives the file, the Comp AI CS team conducts an internal evidence review (\\~1 week). During this review, CS flags anything that needs to be addressed so it can be resolved before it ever reaches the auditor.\n- After the CS review is complete and the file is handed off, the auditor has \\~4 weeks to review evidence and the customer has the opportunity to address any remaining findings before the period closes.\n- Final report delivered within 1–2 weeks after the observation period closes\n\n\\\n\\\n**Year 2+ (Renewal)**\n\n- Minimum observation period: 6 months (up to 12 months)\n- New observation window should start immediately after the previous one ends to maintain continuous, gap-free coverage\n\n**Key Concepts**\n\n- **SOC 2 Type 1:** A point-in-time report (not period-based). Available if the customer needs a report quickly, such as for a closing deal before their Type 2 is ready. Can be issued significantly faster than a Type 2.\n- **Bridge Letters:** If there is a gap between observation periods, a bridge letter can be issued to cover that window. Proactively offer this if a customer is concerned about coverage gaps.\n- **Trust Portal:** While the audit is in progress, customers can share their Trust Portal with prospects and clients to show that a SOC 2 Type 2 audit is actively underway.\n- **Timeline Flexibility:** Observation close dates can be adjusted to accommodate the customer's timeline. Offer to provide a specific projected close date based on their org creation date.\n\n**Suggested Response Approach**\n\n1. Confirm that the observation window started when they created their org in the app\n2. Tell them which year they're in (Year 1 or renewal) and the applicable minimum window\n3. Mention the CS evidence review (\\~1 week) that happens before auditor handoff, and that CS proactively flags anything that needs to be fixed first\n4. If they need a faster option, mention SOC 2 Type 1\n5. If they have a coverage gap concern, mention bridge letters\n6. Always offer to give them a specific close date estimate based on their situation\n\n**Tone Guidelines**\n\n- Reassuring and clear — customers are often anxious about audit timelines\n- Avoid jargon where possible; explain terms when used\n- Always offer a next step or specific help","2026-06-25T22:07:31.364Z","2026-07-07T16:37:36.901Z","eabcadb2-7bd4-444e-b620-40fa9e47f3df",[],[],[],"Need to set up a call/meeting?","need-to-set-up-a-call","Feel free to book a meeting with one of our CX reps below:\n\nTo book a time with Dustin (US CST timezone), please click the link below:\n\n[Meet With Dustin (CST GMT-6)](https://cal.com/dustin-turska/15min)\n\nTo book a time with Paul (UK GMT timezone), please click the link below:\n\n[Meet With Paul (GMT)](https://cal.com/paul-langton-wms45e/15min?overlayCalendar=true)\n\nTo book a time with Mark (UK GMT timezone), please click the link below:\n\n[Meet With Mark (GMT)](https://cal.com/mark-restall-6oxd4q/15min?overlayCalendar=true)","2026-01-06T14:33:17.603Z","2026-07-07T16:37:36.900Z","5771b9ef-58dd-4b60-8695-d61e1895f7ea",[],[],[],"I have a referral, who should I send them to?","i-have-a-referral-who-should-i-send-them-to","If you sign up to \"\" and become a partner you will get 20% per referral sale for 1 year.","2026-06-10T17:21:11.150Z","2026-07-07T16:37:36.899Z","dbea0614-be57-4be3-ac26-059546b8c89f",[],[],[],"How to Upload an Incident Response Tabletop Exercise","how-to-upload-an-incident-response-tabletop-exercise","To upload an incident response tabletop exercise, you can use the provided template to document your practice scenarios. This exercise involves demonstrating how you handle different types of incidents. Follow these steps:\n\n1. **Download the Template**: Use the provided link to access and download the template: [Incident Response Tabletop Exercise Template](https://docs.google.com/document/d/1DVwHVDWEDquiXLsABVTkWaHT89OCXRu_/edit).\n\n2. **Choose Scenarios**: Select between 2 to 5 different incident scenarios that you want to practice and document.\n\n3. **Fill Out the Template**: Complete the template with the details of your chosen scenarios, including the steps and actions you would take to respond to each incident.\n\n4. **Upload the Completed Exercise**: Once the template is filled out, upload it to the designated platform or location as required.\n\nThis process helps in preparing and evaluating your incident response strategies effectively.","2025-10-29T15:45:56.580Z","2026-07-07T16:37:36.898Z","5062070e-97a5-4642-8977-c7f5cc0b59d8",[],[],[],"How to Add Employees and Publish Policies in the App","how-to-add-employees-and-publish-policies-in-the-app","To add employees and publish policies in the app, follow these steps:\n\n### Adding Employees\n\n1. Navigate to the \"People\" tab in the app.\n2. Assign the \"Employee\" role to each individual. You can do this:\n - One by one, or\n - By uploading a CSV file if you have a large organization.\n\n### Publishing Policies\n\nYou can publish policies using one of the following methods:\n\nOption 1: Quick Action\n\n1. Go to the overview page.\n2. Use the \"Publish All Policies\" Quick Action to publish all policies in one step.\n\nOption 2: Individual Review\n\n1. Navigate to the \"Policies\" tab.\n2. Review each policy individually.\n3. Update the status of each policy from \"Draft\" to \"Published.\"\n\n### After Publishing\n\nOnce the policies are published:\n\n- Employees will receive an email prompting them to sign the policies.\n- Employees will also be directed to review the security training videos available at [portal.trycomp.ai](http://portal.trycomp.ai).\n\n### Security Training & Phishing\n\nThe employee portal ([portal.trycomp.ai](http://portal.trycomp.ai)) includes security training videos that cover phishing awareness.\n\n**Phishing simulation is not offered.** Comp AI does not send test phishing emails to employees. If your organization requires hands-on phishing simulation, you will need to source that from a separate vendor.\n\n### Anti-Harassment & Anti-Discrimination Training\n\n**Anti-harassment and anti-discrimination training modules are not currently available on the Comp AI platform.** If your organization requires this type of HR compliance or workplace training, you will need to source it from a separate vendor.","2025-09-30T16:00:34.340Z","2026-07-07T16:37:36.897Z","39d455a0-e0b2-4204-8ba7-54efeb1e2934",[],[],[],"handling-new-findings-notifications-during-audit-review-2","## Overview\n\nDuring an auditor's review, you may receive **\"New Findings\"** email notifications from the platform as the auditor flags issues. A common question is:\n\n> **Should I fix findings as they come in, or wait until the auditor completes their full initial review?**\n\nThe short answer: **both approaches are acceptable.**\n\n---\n\n## Your Two Options\n\n### Option 1: Fix Findings as They Arrive\n\n- Address each finding **immediately** upon receiving the email notification.\n- This is a perfectly valid approach if you prefer to resolve issues incrementally.\n\n### Option 2: Wait Until the Initial Review Is Complete *(Recommended)*\n\n- Hold off on remediation until the auditor signals they have **completed their initial review**.\n- Send a follow-up message to the auditor to confirm all findings are in.\n- Address all findings **at once** in a single remediation pass.\n- This is the more commonly recommended approach, as it allows you to batch your efforts efficiently.\n\n---\n\n## Choosing the Right Approach for You\n\n| | Fix as They Come In | Wait Until Review Is Complete |\n| --- | --- | --- |\n| **Best for** | Teams that prefer incremental progress | Teams that prefer batching work |\n| **Recommended?** | ✅ Acceptable | ✅ Recommended |\n| **Requires coordination with auditor?** | No | Yes — confirm review is complete first |\n\n---\n\n## Key Takeaways\n\n- There is **no strict requirement** to wait before addressing findings.\n- Either approach is acceptable — choose based on your team's workflow.\n- If waiting, always **confirm with the auditor** that their initial review is fully complete before beginning remediation.\n\n ## Marking Evidence Item Findings as Accepted Risk or Exception\n\n For **evidence items**, there is no dedicated \"Accepted Risk\" or \"Exception\" flag. To formally record that a finding has been reviewed and the risk accepted, leave a comment in the **Comments section** of the evidence item explaining the reason the risk is accepted.\n\n ### How to do it\n 1. Open the evidence item containing the finding.\n 2. Navigate to the **Comments** section.\n 3. Leave a comment stating that the risk has been accepted and include the justification or reason.\n\n ### Note\n\n This comment-based approach applies specifically to **evidence items**. Cloud tests have a separate accepted risk workflow.","2026-07-07T17:25:31.697Z","2026-07-07T17:28:06.012Z","912e9262-401f-44ad-8543-ac332664b8c9",[],[],[],"anthropic-integration-employee-access-check-setup-2","2026-07-07T17:20:51.416Z","c553f0d9-5310-4123-b4af-206863e392da",[],[],[],"evidence","2025-10-02T19:13:55.428Z","bb985f58-21f0-42d6-80ff-fa2de8ef2a6d",0,[],[785,786],{"_53":994,"_162":995,"_76":-5,"_644":-5,"_645":781,"_169":-5,"_170":996,"_172":997,"_15":998,"_17":18,"_648":999,"_104":1000,"_651":1001},{"_53":787,"_162":788,"_76":789,"_644":-5,"_645":781,"_169":-5,"_170":790,"_172":791,"_15":792,"_17":18,"_648":793,"_104":794,"_651":795},"SOC2","soc2","Tasks pertaining to SOC2 Type 1 & 2","2025-10-03T19:21:54.810Z","2025-10-03T19:26:19.233Z","fe774732-3cdc-4ebb-aaa4-f4d8690eff72",20,[796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815],[],{"_74":985,"_162":986,"_164":-5,"_166":987,"_168":792,"_169":-5,"_170":988,"_172":989,"_15":990,"_17":18,"_176":991,"_178":-5,"_179":992,"_181":993},{"_74":976,"_162":977,"_164":-5,"_166":978,"_168":792,"_169":-5,"_170":979,"_172":980,"_15":981,"_17":18,"_176":982,"_178":-5,"_179":983,"_181":984},{"_74":967,"_162":968,"_164":-5,"_166":969,"_168":792,"_169":-5,"_170":970,"_172":971,"_15":972,"_17":18,"_176":973,"_178":-5,"_179":974,"_181":975},{"_74":958,"_162":959,"_164":-5,"_166":960,"_168":792,"_169":-5,"_170":961,"_172":962,"_15":963,"_17":18,"_176":964,"_178":-5,"_179":965,"_181":966},{"_74":949,"_162":950,"_164":-5,"_166":951,"_168":792,"_169":-5,"_170":952,"_172":953,"_15":954,"_17":18,"_176":955,"_178":-5,"_179":956,"_181":957},{"_74":940,"_162":941,"_164":-5,"_166":942,"_168":792,"_169":-5,"_170":943,"_172":944,"_15":945,"_17":18,"_176":946,"_178":-5,"_179":947,"_181":948},{"_74":931,"_162":932,"_164":-5,"_166":933,"_168":792,"_169":-5,"_170":934,"_172":935,"_15":936,"_17":18,"_176":937,"_178":-5,"_179":938,"_181":939},{"_74":922,"_162":923,"_164":-5,"_166":924,"_168":792,"_169":-5,"_170":925,"_172":926,"_15":927,"_17":18,"_176":928,"_178":-5,"_179":929,"_181":930},{"_74":913,"_162":914,"_164":-5,"_166":915,"_168":792,"_169":-5,"_170":916,"_172":917,"_15":918,"_17":18,"_176":919,"_178":-5,"_179":920,"_181":921},{"_74":905,"_162":906,"_164":-5,"_166":907,"_168":792,"_169":-5,"_170":908,"_172":908,"_15":909,"_17":18,"_176":910,"_178":-5,"_179":911,"_181":912},{"_74":896,"_162":897,"_164":-5,"_166":898,"_168":792,"_169":-5,"_170":899,"_172":900,"_15":901,"_17":18,"_176":902,"_178":-5,"_179":903,"_181":904},{"_74":887,"_162":888,"_164":-5,"_166":889,"_168":792,"_169":-5,"_170":890,"_172":891,"_15":892,"_17":18,"_176":893,"_178":-5,"_179":894,"_181":895},{"_74":879,"_162":880,"_164":-5,"_166":881,"_168":792,"_169":-5,"_170":882,"_172":882,"_15":883,"_17":18,"_176":884,"_178":-5,"_179":885,"_181":886},{"_74":870,"_162":871,"_164":-5,"_166":872,"_168":792,"_169":-5,"_170":873,"_172":874,"_15":875,"_17":18,"_176":876,"_178":-5,"_179":877,"_181":878},{"_74":861,"_162":862,"_164":-5,"_166":863,"_168":792,"_169":-5,"_170":864,"_172":865,"_15":866,"_17":18,"_176":867,"_178":-5,"_179":868,"_181":869},{"_74":852,"_162":853,"_164":-5,"_166":854,"_168":792,"_169":-5,"_170":855,"_172":856,"_15":857,"_17":18,"_176":858,"_178":-5,"_179":859,"_181":860},{"_74":844,"_162":845,"_164":-5,"_166":846,"_168":792,"_169":-5,"_170":847,"_172":839,"_15":848,"_17":18,"_176":849,"_178":-5,"_179":850,"_181":851},{"_74":835,"_162":836,"_164":-5,"_166":837,"_168":792,"_169":-5,"_170":838,"_172":839,"_15":840,"_17":18,"_176":841,"_178":-5,"_179":842,"_181":843},{"_74":825,"_162":826,"_164":827,"_166":828,"_168":792,"_169":-5,"_170":829,"_172":830,"_15":831,"_17":18,"_176":832,"_178":-5,"_179":833,"_181":834},{"_74":816,"_162":817,"_164":-5,"_166":818,"_168":792,"_169":-5,"_170":819,"_172":820,"_15":821,"_17":18,"_176":822,"_178":-5,"_179":823,"_181":824},"Utility Monitoring","utility-monitoring","**Privileged Utilities & Time Synchronization**\n\n- **Approved Privileged Utilities List**\n\n - Maintain an up‑to‑date inventory of **approved privileged utilities/tools** such as:\n - Network tools (e.g., iptables, tcpdump)\n - Disk encryption tools (e.g., BitLocker, FileVault, cryptsetup)\n - System administration utilities with root/admin privileges\n - Document:\n - Tool name\n - Purpose/use case\n - Approval owner/authority\n - This list should be reviewed regularly and linked to configuration/change management.\n - **Evidence:** Maintain an accessible, versioned list (e.g., in Git, CMDB, or CM tool).\n\n- **Time Synchronization (NTP/Chrony)**\n\n - All devices must synchronize clocks with a trusted time source (internal NTP server or public reference such as [pool.ntp.org](http://pool.ntp.org)).\n - Systems must maintain accuracy within **±1 second** of the reference time.\n - **Evidence (Option 1 – Manual):**\n - On **Linux**: timedatectl status or chronyc sources\n - On **Windows**: w32tm /query /status\n - On **macOS**: systemsetup -getnetworktimeserver and ntpdate -q [time.apple.com](http://time.apple.com)\n - Provide screenshots/logs from at least one Linux and one Windows/Mac device.\n - **Evidence (Option 2 – Automated):**\n - Deploy the **Comp AI Device Agent** () to automatically validate:\n - Time sync status (NTP/Chrony/OS time service)\n - Full disk encryption\n - Password & lock policies\n - Security update status\n - Antivirus status\n - This provides centralized reporting across devices for audit readiness.\n\n### Mapping to Standards\n\n- **ISO/IEC 27001**:\n - A.8.29 — Control of privileged utilities.\n - A.12.4 — Protecting and monitoring log integrity requires synchronized timestamps.\n- **HIPAA**: Audit logs with synchronized timestamps are required under Security Rule.\n- **PCI DSS**:\n - Req. 6.4.1/10.4 — Approved utilities inventory.\n - Req. 10.4 — Time synchronization ≤1 second for all system logs.\n- **ISO/IEC 42001**:\n - AI system operation and auditability rely on synchronized logs.\n - Any privileged utilities used in AI workflow (model training/debugging tools) should be on the approved list.\n\n✅ **Suggested Evidence for Audits**\n\n1. **Privileged Utilities:**\n - Screenshot or export of utilities list with review date and approver.\n2. **Time Sync Proof:**\n - Manual method: Screenshots from Linux and Windows/macOS showing sync within ±1s.\n - Automated method: **Comp AI Portal dashboard screenshot** showing compliance across devices.\n3. **Optional:** Ticket or monitoring evidence of periodic NTP check.","2025-10-03T19:12:53.650Z","2025-10-03T19:22:49.256Z","b96cfd59-2171-4206-b83f-fdb39bc5ed32",[],[],[],"TLS / HTTPS","tls-https","https://rogue-braid-fad.notion.site/280a1b1858b880a3823bf63433bb8851?v=280a1b1858b880d8bffb000c1721ab44&p=281a1b1858b88030aad3c5d467d19619&pm=s","To protect sensitive data against interception or unauthorized disclosure, all applications and databases must enforce strong encryption controls.\n\n- **General Requirement:**\n\n - Ensure **TLS/HTTPS** is enforced for all web applications, APIs, and services.\n - Use valid SSL/TLS certificates (issued by a trusted CA, renewed automatically).\n - Test external endpoints using tools like **SSL Labs (Qualys)** and capture a screenshot showing a passing grade. \n\n- **HIPAA (Healthcare):**\n\n - EPHI (Electronic Protected Health Information) must be encrypted **in transit (TLS/HTTPS)** and **at rest (storage, backups, databases).**\n - Database encryption must be enabled by default to demonstrate data cannot be read if storage media is lost or stolen.\n\n- **ISO/IEC 27001 (Information Security Management):**\n\n - Require **data-at-rest encryption** for databases, backups, and file storage containing sensitive data.\n - Require **encryption in transit** for all components exposed externally or internally across untrusted networks.\n - Maintain documentation of encryption configurations and key management policies.\n\n### Where to Configure / Locate Encryption Settings\n\n**TLS / HTTPS:**\n\n- **Web apps / APIs:**\n - Ensure TLS is forced in your hosting provider (Vercel, GCP Load Balancer, AWS CloudFront, Azure App Services).\n - Redirect HTTP → HTTPS at ingress/load balancer level.\n- **Verification:**\n - Use **Qualys SSL Labs Scan** → confirm “A” or higher rating.\n - Evidence: Screenshot of SSL Labs results page showing TLS enabled and certificate valid.\n\n**Database Encryption (at rest):**\n\n- **Google Cloud (Cloud SQL, BigQuery, Firestore):**\n - Encryption at rest enabled by default with Google-managed keys (or Customer-Managed Keys via Cloud KMS).\n - Path: *Cloud SQL → Database → Configuration → Encryption.*\n- **AWS (RDS, S3, DynamoDB, Aurora):**\n - Set Storage Encrypted = true on database creation (cannot modify later).\n - KMS keys show active encryption policy.\n- **Azure (SQL Database, Blob Storage):**\n - Transparent Data Encryption (TDE) is enabled by default.\n - Evidence: *Azure Portal → SQL DB → Transparent Data Encryption → Enabled.*\n\n**AI-Specific Environments (ISO 42001 overlap):**\n\n- Ensure model files, training datasets, and AI pipelines stored in **encrypted volumes (cloud buckets + encryption enabled).**\n- Validate inference endpoints use TLS/HTTPS for predictions.\n\n✅ **Suggested Evidence for Audits**\n\n1. Screenshot of **SSL Labs test result** showing HTTPS/TLS enabled (grade A or better).\n2. Screenshot of **database console** (AWS RDS / GCP Cloud SQL / Azure SQL DB) showing Encryption at Rest enabled.\n3. Documentation of cryptographic controls:\n - TLS enforced at ingress/load balancer.\n - Database encryption (TDE, disk encryption, or KMS-integrated).\n - Key management practices (rotation, custody).","2025-10-03T16:41:23.511Z","2025-10-03T19:22:49.255Z","16545982-2466-49f9-8bf8-655555122bb9",[],[],[],"SOC2 Evidence","soc2-evidence","# 📘 Compliance & Security Control Tasks Knowledge Base\n\nThis knowledge base outlines 20 key **compliance and security tasks** required for alignment with frameworks such as **SOC 2, ISO 27001, ISO 42001, HIPAA, PCI DSS, and GDPR**.\n\nEach task includes a description, evidence requirements, and the compliance frameworks it maps to.\\\nIf no framework is explicitly stated, the task is assigned to **SOC 2** by default.\n\n## 🔐 Security & Compliance Task List\n\n### 1. Employee Verification\n\n**Description:**\n\n- Maintain employee verification records.\n- Conduct background/reference checks.\n- Collect and store NDA, candidate evaluation, access approval evidence.\n\n**Frameworks:** ISO 27001, PCI\n\n### 2. Two-Factor Authentication (2FA / MFA)\n\n**Description:**\n\n- Enable MFA/2FA on Google Workspace, apps, and systems.\n- Maintain a “break-glass” account for emergencies.\n- Enforce MFA for administrative and remote access.\n\n**Frameworks:** HIPAA, PCI\n\n### 3. TLS / HTTPS\n\n**Description:**\n\n- Enforce HTTPS/TLS across all services.\n- Encrypt databases at rest.\n- Provide SSL Labs and DB encryption evidence.\n\n**Frameworks:** ISO 27001, HIPAA\n\n### 4. App Availability\n\n**Description:**\n\n- Enable DDoS protection and auto-scaling.\n- Provide firewall configuration evidence.\n\n**Frameworks:** ISO 27001\n\n### 5. Secure Code\n\n**Description:**\n\n- Enable Dependabot (or equivalent).\n- Remediate all **Critical/High** dependency vulnerabilities.\n\n**Frameworks:** SOC 2\n\n### 6. Device List\n\n**Description:**\n\n- Maintain an **inventory of laptops/servers**.\n- Track devices holding PHI.\n\n**Frameworks:** HIPAA, SOC 2\n\n### 7. Contact Information\n\n**Description:**\n\n- Publish how customers can contact you (issues/complaints).\n- Track and log support requests.\n\n**Frameworks:** SOC 2\n\n### 8. Sanitized Inputs\n\n**Description:**\n\n- Implement input validation/sanitization (Zod, Pydantic, CodeQL).\n- Provide evidence.\n\n**Frameworks:** SOC 2\n\n### 9. Secure Secrets\n\n**Description:**\n\n- Use cloud-native secret managers.\n- No secrets committed to Git or embedded in code.\n\n**Frameworks:** SOC 2\n\n### 10. Secure Devices\n\n**Description:**\n\n- Enforce device protections:\n - BitLocker / FileVault\n - Auto-updates\n - Antivirus enabled\n - <5 min screen lock\n - Minimum 8+ password length\n\n**Frameworks:** SOC 2\n\n### 11. Monitoring & Alerting\n\n**Description:**\n\n- Enable cloud logging.\n- Retain logs (1 year minimum, 3 months readily available).\n- Audit logs for PHI and CDE.\n- Configure anomaly alerts.\n- Extend monitoring to AI risks (bias, model drift).\n\n**Frameworks:** HIPAA, PCI, ISO 27001, ISO 42001\n\n### 12. Review Policies\n\n**Description:**\n\n- Approve information security policies.\n- Record employee acknowledgment via company portal.\n\n**Frameworks:** SOC 2\n\n### 13. Code Changes\n\n**Description:**\n\n- Protect branches (require pull requests & regression testing).\n- Provide rollback plans, peer review, change approval evidence.\n- Include AI-specific change management (ISO 42001).\n- Document CHD-related changes (PCI).\n\n**Frameworks:** ISO 27001, ISO 42001, PCI\n\n### 14. Employee Descriptions\n\n**Description:**\n\n- Maintain accurate, updated job descriptions.\n- Perform **annual reviews + org chart maintenance**.\n- For PCI: Document roles with CHD access and validate necessity.\n\n**Frameworks:** PCI, SOC 2\n\n### 15. Incident Response\n\n**Description:**\n\n- Document all incidents (or state “No incidents”).\n- Conduct tabletop exercises.\n- Maintain GDPR-compliant data breach plan (72-hour rule).\n- Test PCI-specific CHD incident response annually.\n\n**Frameworks:** GDPR, PCI\n\n### 16. Public Policies\n\n**Description:**\n\n- Publish Privacy Policy & Terms of Service.\n- GDPR compliance: lawful basis, rights, processing activities.\n- Enable/log deletion requests.\n- ISO 42001: Address stakeholder rights/obligations.\n\n**Frameworks:** GDPR, ISO 42001\n\n### 17. Board Meetings & Independence\n\n**Description:**\n\n- Provide board/management minutes with security topics.\n- Document independent directors (CVs, LinkedIn).\n- Ensure AI MS oversight by leadership (ISO 42001).\n\n**Frameworks:** ISO 42001, SOC 2\n\n### 18. Employee Access\n\n**Description:**\n\n- Manage user access via IdP (e.g., Google Workspace).\n- Perform **annual access reviews** & maintain RBAC matrix.\n- Retain privileged user lists.\n- Provide leaver IT revocation documentation (ISO 27001).\n- Extend org chart to reflect AI compliance roles.\n\n**Frameworks:** ISO 27001, ISO 42001, PCI\n\n### 19. Diagramming\n\n**Description:**\n\n- Maintain single-page system architecture diagram.\n- Maintain data flow diagrams:\n - ISO 27001, HIPAA: Sensitive data flows\n - GDPR: Personal data lifecycle\n - PCI: CDE network + CHD data flows\n- ISO 42001: Add AI system risk mapping\n\n**Frameworks:** ISO 27001, HIPAA, PCI, GDPR, ISO 42001\n\n### 20. Planning (Backups & Recovery)\n\n**Description:**\n\n- Enable point-in-time recovery & annual restore tests.\n- Document backup test results step-by-step.\n- Include AI recovery continuity in planning.\n\n**Frameworks:** ISO 42001, SOC 2","2025-10-02T19:39:49.524Z","2025-10-03T19:22:49.254Z","3137abf1-6dbd-4bfa-882a-26332edf45c6",[],[],[],"Secure Code","secure-code","To reduce risk from vulnerable third‑party libraries, organizations must enforce **automated dependency scanning and patching** processes.\n\n- **General Requirement:**\n\n - Enable **Dependabot** (GitHub) or an equivalent dependency management tool (e.g., GitLab Dependency Scanning, Snyk, Renovate, npm/yarn audit + automated patches).\n - These tools must automatically identify **outdated/insecure dependencies** and recommend or apply updates.\n - Remediate or mitigate all **Critical and High vulnerabilities** in a timely manner.\n - **Evidence:** Upload a screenshot of the project security dashboard showing that there are no outstanding Critical/High severity dependency vulnerabilities after remediation.\n\n- **ISO/IEC 27001 (Secure Development Lifecycle):**\n\n - Demonstrate integration of dependency vulnerability scanning into CI/CD pipelines.\n - Keep records of:\n - Vulnerability scan results\n - Evidence of remediation or acceptance with documented risk justifications\n\n- **PCI DSS (Payment Systems):**\n\n - All **in-scope applications** (handling cardholder data) must be:\n - Regularly scanned for dependency vulnerabilities.\n - Patched against known exploitable flaws.\n - Maintain an audit trail of dependency scanning reports + evidence of patching.\n\n- **ISO/IEC 42001 (AI Systems):**\n\n - Extend vulnerability scanning to **AI/ML libraries and frameworks** (e.g., TensorFlow, PyTorch, scikit-learn).\n - Validate that patched AI libraries are compatible and do not degrade model integrity/performance.\n - Document dependency changes and risk analysis for AI environments.\n\n### Where to Configure / Locate These Controls\n\n**GitHub (Dependabot):**\n\n- Path: Repository → *Settings* → *Code security & analysis* → Enable **Dependabot Alerts & Security Updates**\n- Verification: Security tab → Dependabot → shows “dependencies up to date.”\n- Workflow: Configure .github/dependabot.yml to schedule updates.\n\n**GitLab:**\n\n- Built-in Dependency Scanning CI job: Add dependency_scanning to .gitlab-ci.yml\n- Dashboard: *Security & Compliance → Vulnerability Report.*\n\n**Azure DevOps / Pipelines:**\n\n- Enable WhiteSource/Bolt or GitHub Advanced Security integration.\n\n**Snyk, Renovate, or Other Tools:**\n\n- Snyk dashboard shows discovered vulnerabilities + patches applied.\n- Renovate automates PRs for dependency versions.\n\n**AI Dependencies (ISO 42001):**\n\n- Track Python dependencies in requirements.txt / poetry.lock.\n- Run pip-audit, Safety, or Snyk CLI on ML projects.\n- Record scan results + test model performance post-upgrade.\n\n✅ **Suggested Evidence for Audits**\n\n1. Screenshot of **GitHub Security Dashboard** (or equivalent) showing “no Critical/High vulnerabilities.”\n2. For PCI: Policy/record of critical patch timeframe (e.g., within 30 days).\n3. For ISO 42001: Document a library upgrade test for an ML framework (showing both patching and no degradation to model accuracy).","2025-10-03T18:48:05.941Z","91cce387-b5b7-44b0-ad03-9ccdec1f063a",[],[],[],"Sanitized Inputs","sanitized-inputs","To protect against injection attacks, malformed data, and other security flaws, applications must implement **input validation and sanitization** controls.\n\n- **General Development Requirement:**\n\n - Use **validation libraries** such as:\n - **Zod** (JavaScript/TypeScript)\n - **Pydantic** (Python)\n - Or equivalent libraries/framework features (e.g., Joi, Marshmallow, Yup).\n - Alternatively (or in addition), enable **static analysis / SAST tools** (e.g., **GitHub CodeQL**, SonarQube, Snyk Code) to enforce secure input handling.\n - **Evidence:** Upload a screenshot of validation library usage in code or security scanning tool showing enforcement (e.g., CodeQL workflow step in GitHub Actions).\n\n- **ISO/IEC 27001 (Secure Development Practices):**\n\n - Demonstrate **secure coding standards enforcement** via development pipelines.\n - Evidence includes:\n - Code snippets/screenshots of validation in use.\n - DevSecOps tooling enforcing this at PR/CI stage.\n - Records of secure code review.\n\n- **PCI DSS (Cardholder Data Apps):**\n\n - Validate input for all **in-scope systems handling CHD (Cardholder Data Environment).**\n - Evidence:\n - Code showing input sanitization for form/data entry.\n - CI/CD or PR checks with static analysis results.\n - Logs of SAST scan results retained as artifacts.\n\n- **ISO/IEC 42001 (AI Systems):**\n\n - Extend input validation to cover **AI/ML pipelines.**\n - Examples:\n - Validation of training dataset fields and formats.\n - Sanitization of user-provided inputs for inference APIs.\n - Guardrails for unexpected values that could trigger **bias or model degradation.**\n - Document review/approval showing validation integrated into AI workflows or model pipelines.\n\n### Where to Configure / Locate These Controls\n\n**Code-level validation:**\n\n- **Node.js / TS apps:**\n - Use Zod schemas for API request validation.\n- **Python apps:**\n - Use Pydantic models (FastAPI, Django, Flask).\n- **Other frameworks:** Joi (Node), Marshmallow (Python), Laravel Validation (PHP).\n\n**Static Analysis / Secure Scanning:**\n\n- **GitHub CodeQL:**\n - Repo → Settings → Security & Analysis → Enable *CodeQL Code Scanning.*\n - CI/CD Workflow: .github/workflows/codeql.yml\n- **GitLab:** Includes SAST scanners (can be enabled in CI/CD pipelines).\n- **Azure DevOps / SonarQube:** Configure pipelines to run static scans on every PR/merge.\n\n**AI/ML Projects (ISO 42001):**\n\n- Configure schema validation for raw training data (Pydantic/Zod).\n- Integrate checks into data ingestion pipelines (Airflow, Prefect, dbt).\n- Evidence: Notebook logs or pipeline configs showing schema enforcement.\n\n✅ **Suggested Evidence for Audits**\n\n1. Screenshot of code snippet showing input validation (e.g., Zod schema, Pydantic model).\n2. Screenshot of CI/CD pipeline with **CodeQL or similar security scanner enabled.**\n3. Export of pipeline scan results showing validation checks enforced.\n4. For ISO 42001: Documentation + screenshot of AI pipeline validating datasets and inference inputs.","2025-10-03T16:32:28.470Z","2025-10-03T19:22:49.253Z","9bea6e23-44e6-4ea8-a081-c05d19163d35",[],[],[],"Public Policies","public-policies","**Privacy Policy, Terms of Service & Data Subject Rights**\n\n- **General Requirement:**\n - Publish and maintain up‑to‑date **Privacy Policy** and **Terms of Service (ToS)**, with links easily accessible (e.g., in website footer, app settings, or account dashboard).\n - Privacy Policy must include a **form or mechanism for data deletion requests** (e.g., web form, email address, or portal).\n - Ensure that **all data deletion requests are logged and tracked** (via ticketing system, CRM, or internal register) for compliance reporting.\n - Include explicit references to user rights, commitments, and company responsibilities.\n - **Evidence:** Add a comment with the URLs to the published Privacy Policy and ToS.\n\n### Framework-Specific Requirements\n\n**GDPR (EU General Data Protection Regulation):**\n\n- Privacy notices must be **clear, transparent, and compliant**. At minimum, they must include:\n - Lawful basis for processing data (e.g., consent, contract, legal obligation).\n - Categories of personal data collected.\n - Purposes for which data is used.\n - How and with whom data may be shared.\n - Data retention timelines.\n - Explanation of **data subject rights:** access, rectification, erasure (right to be forgotten), portability, restriction, and objection.\n- Keep version history of your Privacy Policy, and **update promptly** if practices or providers change.\n- Evidence: Link to Privacy Policy page + proof of updates (e.g., changelog or “last updated” date).\n\n**ISO/IEC 42001 (AI Governance):**\n\n- Privacy and AI policies must show how stakeholder **rights and obligations** are respected, including:\n - Customers (e.g., right to deletion, fairness of use).\n - Regulators (compliance with GDPR, HIPAA, PCI).\n - Broader society (e.g., ethical AI use, avoidance of unintended bias).\n- Document how feedback from stakeholders is reviewed and incorporated into governance processes.\n- Evidence: Policy section explicitly outlining stakeholder protections, plus governance committee notes/minutes if available.\n\n### Where to Configure / Locate These Controls\n\n- **Website / SaaS App:**\n - Footer link: “Privacy Policy” & “Terms of Service.”\n - Privacy policy page includes **deletion request form** (or email like [privacy@company.com](mailto:privacy@company.com)).\n- **Data Deletion Tracking:**\n - **Ticketing systems (Jira, Zendesk, ServiceNow)** — log requests as tickets.\n - **CRM systems (HubSpot, Salesforce)** — attach requests to user accounts.\n - **Internal spreadsheets/registers** (with request date, requester, outcome, resolution date).\n\n✅ **Suggested Evidence for Audits**\n\n1. **Comment with links** to Privacy Policy & Terms of Service.\n2. Screenshot of **data deletion request form / mechanism** in Privacy Policy.\n3. For GDPR: Copy of Privacy Policy section showing lawful basis, rights, retention, etc.\n4. For ISO 42001: Documentation showing explicit mention of **customer, regulator, and society stakeholder obligations.**","2025-10-03T18:53:13.411Z","2025-10-03T19:22:49.252Z","d4224423-760f-4405-8c18-4519f9ee6067",[],[],[],"Planning","planning","To ensure resilience against data loss or corruption, organizations must maintain reliable backups and test their restorability:\n\n- **General Backup Requirements**\n\n - Enable **point-in-time recovery (PITR)** or regular backups on databases, storage, and critical systems.\n - Perform **annual (at minimum)** backup recovery testing to confirm data can be restored successfully.\n - **Evidence:** Create & upload a **step-by-step document** of your backup recovery test (including system chosen, restore procedure, and validation that the data/app worked post-restore).\n\n- **ISO/IEC 42001 (AI Management):**\n\n - Extend business continuity/disaster recovery to explicitly include **AI systems.**\n - Ensure backup and recovery cover:\n - Training data storage and recovery.\n - Model artifacts (saved model versions, weights, hyperparameters).\n - AI pipelines and code (to restore ML workflows).\n - Cloud GPU/accelerator resource configs if applicable.\n - Document recovery actions and link them to risk reduction for AI-specific failures (e.g., corrupted training data, degraded model weights).\n\n### Where to Configure / Locate Backup & PITR Settings\n\n**Google Cloud (GCP):**\n\n- **Databases (Cloud SQL, Firestore, BigQuery):**\n - Console → Database → *Backups / PITR* tab → Enable PITR (7–35 days depending on service).\n- Evidence: Screenshot of PITR enabled + screenshot of restore operation test.\n\n**AWS:**\n\n- **RDS / Aurora:** Enable Automated Backups + PITR.\n- **S3:** Versioning + replication policies for rollback.\n- Evidence: Console screenshot of “Restore DB instance to point in time.”\n\n**Azure:**\n\n- **SQL Database:** PITR enabled by default (7–35 days depending on tier).\n- **Blob Storage:** Configure soft delete, snapshots, geo-redundant backups.\n- Evidence: Screenshot of backup retention settings and test restore workflow.\n\n**Vercel:**\n\n- Vercel does not provide PITR — use the **integrated DB vendor** (PlanetScale, Neon, Supabase) or attach cloud DB service.\n- Evidence should come from DB provider’s backup/restore panel.\n\n**AI Systems (ISO 42001):**\n\n- **Model/Data Backup Sources:**\n - MLflow model registry\n - Weights & Biases artifacts\n - Cloud storage buckets for training datasets\n- **Test:** Restore an older dataset + re-load a previous model checkpoint, then document:\n - Recovery steps\n - Integrity validation (model performs as expected)\n\n✅ **Suggested Evidence for Audits**\n\n1. Screenshot of **backup/PITR enabled** (DB, storage, etc.).\n2. Step-by-step document of **backup recovery test** (who performed it, when, and successful validation).\n3. Change management ticket showing **annual restore test performed**.\n4. For ISO 42001: Document a recovery test covering:\n - AI training dataset restored\n - Previous model version restored\n - Model registry access confirmed","2025-10-03T16:18:06.264Z","2025-10-03T19:22:49.251Z","2654ef72-8788-4062-a22d-dc3d80111a88",[],[],[],"Organisation Chart","organisation-chart","**⚡ Automation:** Ask the agent to \"Fetch the current organization chart from \\[HR System Name, e.g., Rippling, BambooHR, or Workday\\].\" You can also ask it to \"Generate a list of reporting lines based on manager fields in \\[Google Workspace/Okta\\].\"\n\n⚙️ **General:** The chart must clearly show \"Who reports to whom.\" Ensure every box includes both the person's full name and their job title. An employee list without the visual hierarchy of reporting lines is often rejected by auditors.\n\n**🌱 Small Teams (2+):** Create a single slide in PowerPoint or Google Slides with simple boxes and arrows showing your current team structure. Export this slide as a PDF.\n\n**👤 Solo Founder:** Mark as Not Relevant.","2026-01-22T14:35:05.481Z","f2d7ee64-b15d-4ce3-a167-8be7a5ab22ec",[],[],[],"Monitoring & Alerting","monitoring-alerting","All environments should have logging enabled to capture operational and security-relevant events. Logs must be reviewed periodically to help detect anomalies, ensure compliance, and support investigation in case of incidents.\n\n- **General Logging (All Environments):**\\\n Ensure that application, infrastructure, and deployment logs are enabled (e.g., Google Cloud Logging, Vercel Deployments tab). Periodically review logs for alerts such as deployment failures or unusual activity.\n\n - If an alert was recently received (e.g., build failure, resource quota exceeded), include a screenshot of the alert.\n - If no alerts have been triggered, document that no alerts were received during the reporting period.\n\n- **HIPAA (Healthcare):**\\\n When handling patient (PHI) data, enable **Audit Logs** at the database, storage, and application layers to demonstrate that no records have been secretly altered or corrupted. Audit logs must track **read/write access and administrative actions**.\n\n- **PCI DSS (Payment Cards):**\\\n Enable logging for all in-scope *Cardholder Data Environment (CDE)* systems, including **firewalls, servers, applications, and databases**.\n\n - Configure alerting for security anomalies: failed login attempts, unusual access to cardholder data, or changes to configurations.\n - Retain logs for **at least 1 year**, with the most recent **3 months readily available** for immediate review.\n\n- **ISO/IEC 42001 (AI-Governance):**\\\n Extend monitoring and logging to explicitly cover AI-related controls. Capture risks such as **performance degradation, data drift, and unintended bias triggers**. Maintain documentation of actions taken to reduce or mitigate undesired AI effects.\n\n### Where to Locate These in Different Environments\n\n**Google Cloud (GCP):**\n\n- Logs:\n - GCP Console → *Logging > Logs Explorer*\n - Audit Logs: *IAM & Admin > Audit Logs* (enable for Cloud SQL, Cloud Storage, BigQuery, etc.)\n - Alerts: *Monitoring > Alerting > Create Policy*\n\n**Vercel:**\n\n- Deployment Logs:\n - Dashboard → Project → *Deployments* → View build/runtime logs\n- Alerts:\n - Automatic failure alerts appear in Deployments tab; notifications can be set via integrations (Slack, email, webhook)\n\n**AWS (if applicable):**\n\n- Logs:\n - *CloudWatch Logs* for application/system logs\n - *CloudTrail* for API/audit logs\n- Alerts:\n - *CloudWatch Alarms* or GuardDuty alerts\n\n**Azure:**\n\n- Logs: *Monitor > Logs (Log Analytics)*\n- Audit Logs: *Azure Active Directory > Audit Logs*\n- Alerts: *Monitor > Alerts*","2025-10-03T15:23:53.736Z","2025-10-03T19:22:49.250Z","fc599ee2-77a9-4529-8d89-9066502f4b83",[],[],[],"Incident Response","incident-response","Organizations must maintain a record of **all security incidents** (e.g., unauthorized access, data exposure, malware infection) and their resolution steps. If no incidents have occurred in the reporting period, explicitly note this by recording **“no incidents.”**\n\n- If applicable, upload documentation (e.g., postmortem reports, helpdesk tickets, or logs) demonstrating the incident and its resolution.\n- Upload evidence of at least one **incident response tabletop exercise** to show preparedness in handling potential incidents.\n\n**GDPR (EU Data Protection):**\n\n- Maintain a **documented data breach response plan**, which must include:\n - **Detection** processes (monitoring/logging triggers).\n - **Escalation** paths (who is notified internally, how quickly).\n - **Notification procedures** (to authorities and impacted customers **within 72 hours**).\n - **Remediation** actions (containment, root cause analysis, prevention).\n- Train staff regularly on breach reporting obligations and awareness, so they know how to recognize and report potential incidents.\n\n**PCI DSS (Payment Card Data):**\n\n- Maintain a formal **incident response plan (IRP)** that specifically covers **cardholder data (CHD) incidents.**\n- Test the IRP **at least annually** (e.g., simulation, tabletop, or red team exercise).\n- Ensure the plan covers:\n - Escalation paths within the organization.\n - Communication with **payment brands** and **acquirers.**\n - **Forensic evidence handling** procedures for compromised systems.\n - Clearly defined **roles/responsibilities of the incident response team (IRT).**\n\n### Where to Locate / Store These in Different Environments\n\n**General Security Teams / Compliance Management:**\n\n- Security incidents are usually logged in:\n - **Ticketing Systems:** Jira, ServiceNow, Zendesk (incident reports, postmortems).\n - **SIEM platforms:** Splunk, Elastic, Sumo Logic (incident detection + logs).\n - **Internal wiki / document management:** Notion, Confluence, SharePoint (response plans, exercise results).\n\n**Google Cloud (GCP):**\n\n- Incident evidence: *Cloud Logging & Security Command Center (SCC)* → Review “Findings.”\n- IRP Storage: Recommended via internal Confluence/Google Drive + link in GCP Security Command Center for reference.\n\n**Vercel:**\n\n- Incidents: Deployment failures and downtime logs in *Deployments tab*.\n- Breach/PCI incidents: Must be separately tracked in an internal incident register; Vercel does not provide full enterprise IRP tooling.\n\n**AWS:**\n\n- Evidence location:\n - *CloudTrail Logs* (who accessed what & when).\n - *GuardDuty findings* for suspicious activity.\n- Response plans: Often stored in runbooks via *AWS Systems Manager* Automation or internal wiki.\n\n**Azure:**\n\n- Detection sources: *Azure Monitor + Sentinel (SIEM).*\n- Incidents & audit trails: *Microsoft 365 Security & Compliance Center.*","2025-10-03T15:29:15.767Z","2025-10-03T19:22:49.249Z","cbd4435f-572c-4cdd-af1c-a1ebe2b66ad4",[],[],[],"Evidence Tips","evidence-tips","Here","2025-11-17T18:48:51.528Z","462b33ff-d3f5-4705-a385-b3bcb0f70fc4",[],[],[],"Employee Verification / Background Checks","employee-verification-","For SOC 2, you are required to maintain evidence that you have verified the identity and professional background of each new hire.\n\nIn the context of this application, Background Checks do NOT include criminal history checks. Instead, they refer to:\n\n- Employment verification (e.g., past roles, employers)\n- Reference checks (e.g., speaking with prior managers or colleagues)\n- Identity verification\n- Social/professional profile validation (e.g., LinkedIn consistency)\n\nAcceptable evidence includes:\n\n- A completed Background Check report in the app, or\n- Documentation showing at least three reference checks and identity verification for the employee\n\nIf you are an early-stage company with no new hires (e.g., founding team only), you may leave a comment noting this. This control is assessed annually, so ensure you have a process in place as you begin hiring.\n\n---\n\n## Small Founding Teams: Marking Background Checks as Not Relevant\n\nIf your team consists entirely of co-founders or long-tenured collaborators (e.g., two co-founders and a contractor you have worked with for several years), you can mark background checks as **not relevant** for now. This is an accepted approach for SOC 2 compliance at this stage.\n\nAs your company grows and you begin hiring new employees, you should revisit this and start completing background checks for incoming hires.\n\n---\n\n## People Section Progress and Background Checks\n\nProgress in the People section is driven by background checks, not just the visible task list. Completing all tasks in the People section will still show 0% progress until background checks are addressed for each employee.\n\nTo advance the People section progress, click into each employee's name and go to the Background Check tab. There are three ways to handle this:\n\n1. Complete the built-in background check - Use the paid plan to run the background check directly in the app (see steps below).\n2. Attach a manual report - If you have already conducted a background check through an external provider, use the attach a report instead link in the bottom right of the Background Check tab to upload the documentation.\n3. Exempt the employee - If background checks are out of scope for a particular employee, toggle the exempt this employee from background check option at the top of the Background Check tab.\n\n---\n\n## Using the Built-In Background Checks Feature\n\nThe Background Checks feature helps you meet this SOC 2 requirement by automating identity verification and employment/reference validation (not criminal checks).\n\nTo run a Background Check:\n\n1. Navigate to People, select the employee, then click the Background Check tab\n2. If billing is not set up, you will be prompted to enter payment details\n3. Enter the employee's personal email and click Complete\n\nWhat happens next:\n\n- The employee receives an invitation to complete identity verification (ID + face scan)\n- References and previous employers are contacted for verification\n- AI analysis reviews professional/social profiles (e.g., LinkedIn consistency)\n\nOnce complete, the report is automatically stored in the employee's Background Check tab as audit evidence.","2025-10-02T19:17:10.649Z","2026-05-11T22:53:43.338Z","7eb4855b-74ca-4805-be23-df424c8a2ce6",[],[],[],"Employee Descriptions\n","employee-descriptions-","\n### Employee Role Definition, Review, and Documentation Requirements\n\n1. **Job Descriptions**\n\n - Every employee must have a clearly defined job description that accurately reflects their responsibilities, reporting structure, and role within the organization.\n - Job descriptions must be kept **up to date** and reviewed at least **annually** to ensure alignment with business needs and compliance requirements.\n - This information can be maintained in a simple, centralized format such as a **spreadsheet** containing:\n - Employee name\n - Email\n - Job title/role\n - Job description (summary of responsibilities)\n\n2. **Annual Performance and Role Review**\n\n - Once each year, managers are required to meet individually with each team member to:\n - Confirm that the employee’s job description remains accurate and reflective of their responsibilities.\n - Conduct a formal performance review assessing the employee’s effectiveness in their role.\n - Managers must keep a **brief record** of each review, including:\n - The date and time of the review\n - The name of the reviewer (manager/supervisor)\n - The name of the employee\n - Acknowledgement from the employee that the review was conducted\n - Documentation of this review may consist of:\n - A signed review document\n - An HR system entry/screenshot\n - A log entry in the shared spreadsheet\n\n3. **Organizational Hierarchy and Reporting Structure**\n\n - A **current organizational chart** must be maintained at all times.\n - The chart must clearly show:\n - Reporting lines (who reports to whom)\n - Employee job titles\n - Updated versions of the org chart must be preserved whenever staffing or reporting changes occur.\n - For smaller organizations, the spreadsheet described above can also serve as a **lightweight org chart substitute**, with columns for supervisor/manager to establish reporting lines.\n\n4. **PCI Compliance Considerations (Access to CHD Systems)**\n\n - For employees whose roles require interaction with **Cardholder Data (CHD) systems**, their access rights must be explicitly documented.\n - The spreadsheet or access control matrix should clearly specify which employees have CHD system access.\n - Access must be verified to ensure alignment with the employee’s role and job responsibilities — no employee should have CHD access beyond what is necessary for their function.\n - Any change in an employee’s role or responsibilities must immediately trigger a review of CHD access rights to ensure compliance with PCI requirements.\n\n💡 **Key Flexibility Note:**\\\nWhile HR systems can be used to document all of the above, maintaining a **simple spreadsheet** with the required information (name, email, role/title, job description, reporting line, and PCI access notation) provides an acceptable and streamlined solution for most compliance audits.","2025-10-02T19:30:24.307Z","2025-10-03T19:22:49.242Z","031d2d48-857f-4f8e-a35d-daf8c0a642a9",[],[],[],"Diagramming","diagramming","Organizations must maintain **current, single‑page architecture and data flow diagrams** appropriate to their environment and regulatory scope. These diagrams provide a clear view of system design, data handling, and potential security exposures.\n\n- **General Architecture Diagram (All Organizations):**\n - Create a simplified diagram (Figma, [Draw.io](http://Draw.io), Lucidchart, Excalidraw, Miro, etc.) showing key components:\n - Applications (frontend, backend, APIs)\n - Databases & storage layers\n - Third‑party integrations (vendors, SaaS, APIs)\n - Security controls (firewalls, WAF, IAM, logging)\n - Hosting/cloud provider boundaries\n - Diagram should fit on a single page and be understandable to technical and non‑technical stakeholders.\n\n### Framework‑Specific Requirements\n\n**ISO/IEC 27001 (Information Security):**\n\n- Develop a **Data Flow Diagram (DFD)** when sensitive information is processed.\n- Show exactly how information travels through the environment:\n - User entry points\n - Processing layers (apps, APIs, middleware)\n - Databases & storage endpoints\n - Security boundaries (firewalls, VPN, IAM, encryption)\n- If no sensitive data is handled → state \"Not Applicable\" and maintain architecture diagram only.\n\n**HIPAA (Healthcare PHI):**\n\n- Data Flow Diagram must explicitly identify systems that **store, process, or transmit ePHI**.\n- Mark encryption points, access controls, and PHI boundaries.\n- Demonstrate safeguards preventing unauthorized access or alteration.\n\n**ISO/IEC 42001 (AI Governance):**\n\n- Extend diagrams to include **AI system architecture**:\n - AI model training pipelines (data ingestion, preprocessing, training environment).\n - Inference endpoints (how decisions/predictions enter applications).\n - Internal & external data sources.\n - Explain **system purpose and scope**.\n- Link diagrams to **AI Impact/Risk Analysis** (bias, data drift, fairness concerns, misuse scenarios).\n - Example: Show how adversarial input could travel into the system and mitigation points.\n- Highlight foreseeable **AI misuse** and its potential effects on individuals and society.\n\n**GDPR (Data Processing & Privacy):**\n\n- Maintain an up‑to‑date **personal data inventory + flow map**:\n - What personal data is collected at each stage.\n - Where it is processed and stored (with system/vendor names).\n - Retention periods & deletion paths.\n - Countries/regions of storage (data residency).\n- Update flow diagrams **whenever vendors, systems, or processing activities change.**\n\n**PCI DSS (Payment Card Data):**\n\n- Maintain a **Cardholder Data Environment (CDE) diagram** that clearly shows:\n - Where cardholder data (CHD) **enters, traverses, and is stored.**\n - Network segmentation (e.g., firewalls separating CDE from corporate network).\n - Connected systems (payment gateways, fraud tools, monitoring).\n- Diagrams must be updated **at least annually** or whenever a significant change occurs.\n\n### Tooling & Where to Build\n\n- **Diagram Tools:** [Draw.io](http://Draw.io) ([diagrams.net](http://diagrams.net)), Lucidchart, Figma, Miro, Excalidraw, Microsoft Visio.\n- **Data Flow Mapping Tools/Repos (GDPR/PCI heavy):** TrustArc, OneTrust, Collibra, or even Notion/Confluence with linked diagrams.\n- **System Source of Truth:** Internal docs/wiki (Confluence, Notion, SharePoint) + Git repo for version control (for audit trail).\n\n✅ **Suggested Evidence for Audits**\n\n1. **Architecture Diagram** (1 page) showing environment layers, integrations, and cloud providers.\n2. **Data Flow Diagram(s):**\n - For ISO 27001/HIPAA → highlight sensitive data flows, security boundaries.\n - For GDPR → highlight personal data lifecycle (collection → storage → retention → deletion).\n - For PCI → highlight cardholder data ingress, flow through network, connected systems, segmentation controls.\n3. **AI‑specific diagrams (ISO 42001):** Identify AI training & inference data flows, model components, and risk controls.\n4. **Version history** of diagrams showing they are maintained and updated with changes.\n\n \\\n Example of a 1 page Architecture Diagram:\\\n ![image.png](https://firebasestorage.googleapis.com/v0/b/trnout-co.appspot.com/o/u-compai-u651c%2Fknowledge-base%2Fimage.png?alt=media)","2025-10-03T19:07:31.744Z","2025-10-03T19:22:49.241Z","14578894-9ae6-4af6-9c38-fec5fcc09952",[],[],[],"Device List","device-list","**Device Tracking & Compliance**\n\nIt’s important to keep and maintain an up-to-date inventory of all devices in your organization, including laptops, desktops, and servers. This is a critical part of maintaining both operational visibility and regulatory compliance.\n\n- **Recommended Approach: Install the Comp AI Device Agent**\\\n Instead of manually updating spreadsheets or saving screenshots of devices, we strongly recommend installing the **Comp AI Device Agent** on each of your systems. Once installed, the agent automatically registers and tracks your devices directly within the Comp AI platform. This ensures:\n\n - Real-time visibility into the hardware and systems across your organization\n - Automatic updates whenever devices are added, removed, or reconfigured\n - Elimination of human error and outdated records\n - Simplified compliance reporting without the need for manual documentation\n\n- **For HIPAA Compliance:**\\\n Knowing exactly which devices are used to access or store patient data is essential. HIPAA requires that organizations maintain a current system for identifying and tracking these devices. By deploying the **Comp AI Device Agent**, you create a continuous, automated device inventory that helps ensure you remain compliant while reducing administrative overhead.\n\n- **Accessing the Agent**\\\n The Comp AI Device Agent can be downloaded and installed from:\\\n [**portal.trycomp.ai**](http://portal.trycomp.ai)\n\nIf you install the agent across your devices, this tracking task becomes automated, and you can confidently mark it as **completed/not relevant for manual action**.\n\n\\\n\\\nThis action would need to be completed for each employee device in your org.","2025-10-02T21:29:32.724Z","2025-10-03T19:22:49.240Z","59ef6551-5e47-4ff0-b6cf-3efd60ba3247",[],[],[],"Data Masking","data-masking","To reduce the risk of exposing sensitive or regulated information, **sensitive fields must be hidden or truncated wherever possible** when displayed, logged, or transmitted outside of secure environments.\n\n- **General Requirement:**\n\n - Sensitive data (e.g., personally identifiable information, PHI, cardholder data, authentication data) must be **masked, truncated, or anonymized** when displayed in user interfaces or application logs.\n - Full values may **only be visible if strictly necessary**, and only to users with an essential business or system role (audited access).\n\n- **PCI DSS (Payment Card Data Requirement):**\n\n - **Primary Account Number (PAN):**\n - **Outside the Cardholder Data Environment (CDE):** Display must be **masked**.\n - Allowed format: **first 6 and last 4 digits only** (example: 411111\\*\\*\\*\\*\\*\\*1111).\n - Full PAN **must never be displayed** in logs, applications, or reports outside a secure CDE.\n - **In Secure CDE:** Full PAN may only be accessible to roles with documented, approved business needs (segregation of duties and audit logging apply).\n - **Evidence:** Screenshots or configuration snippets showing:\n - PAN masking in user interfaces (customer portal, admin console).\n - Logs / reports that truncate instead of outputting full PAN.\n - Code snippets, data model configs, or security tool documentation enforcing masking.\n\n### Mapping to Standards\n\n- **PCI DSS:** Explicitly requires **PAN masking outside the CDE** (first 6 / last 4 only).\n- **ISO/IEC 27001:** Supports data minimization and concealment of sensitive information.\n- **HIPAA:** PHI must not be unnecessarily exposed in logs, displays, or non‑clinical contexts (data minimization & masking strongly recommended).\n- **ISO/IEC 42001:** For AI systems using sensitive or regulated data (e.g., payments, PHI, government IDs), implement **masking/pseudonymization** in training and inference datasets to reduce ethical and compliance risks.\n- **GDPR:** Masking/pseudonymization is one method encouraged to meet *data minimization* and *security of processing* obligations (Articles 5 & 32).\n\n### Where to Configure / Implement\n\n- **Applications (Frontend / API):**\n\n - Use built‑in masking utilities in frameworks (e.g., RegEx replacement, UI display formatters).\n - Enforce masking in serializers and API responses.\n\n- **Databases:**\n\n - Use **column masking / dynamic data masking**:\n - SQL Server → Dynamic Data Masking rules.\n - Oracle DB → Virtual Private Database (redaction policies).\n - PostgreSQL/MySQL → Implement through views or stored procedures.\n\n- **Logs / Event Systems:**\n\n - Central logging pipelines (e.g., ELK stack, Cloud Logging, CloudWatch) must filter/redact PAN before indexing.\n - Configure regex or masking function in log forwarders (Fluentd, Logstash).\n\n- **AI / Data Science Pipelines (ISO 42001):**\n\n - Pre‑processing scripts enforce masking/pseudonymization of sensitive data before including it in datasets.\n - Store original vs. masked datasets separately with strict access controls.\n\n✅ **Suggested Evidence for Audits**\n\n1. Screenshot of **user interface** showing masked PAN (first 6 / last 4 only).\n2. Screenshot of **system logs** showing masking (no full PAN).\n3. **Code/config snippet** showing masking function (substring + mask, regex).\n4. **DB masking policy export** (SQL Server, Oracle, PostgreSQL views).\n5. For AI systems: Notebook/script output showing data was masked before use.","2025-10-03T19:17:32.679Z","2025-10-03T19:22:49.239Z","ed765881-74e8-4c4a-9733-d5e383670e60",[],[],[],"Contact Information","contact-information","\n### Customer Support & Communication Requirements\n\nYou need to demonstrate that you provide your customers with a clear and accessible way to reach you for **support, inquiries, issues, or complaints**. This not only ensures transparency and good customer service practices, but also helps meet compliance requirements for handling and documenting customer communications.\n\nAt a minimum, your website should include:\n\n1. **Description of Your Services/Software**\n\n - Clearly outline the services or software solutions you provide so that customers understand what you do and know they are in the right place when they arrive on your site.\n - This should be visible on your homepage, product/service pages, or a dedicated \"What We Do\" section.\n\n2. **Visible Customer Contact Methods**\n\n - Provide customers with **at least one direct contact channel** where they can submit support requests, report issues, or file complaints. Common options include:\n - A dedicated **Contact Us** or **Customer Support** page with a form or instructions\n - A [**support@yourcompany.com**](mailto:support@yourcompany.com) style email address listed clearly in the site footer, header, or on a Support page\n - A helpdesk or ticketing system portal linked directly from your site\n - (Optional) Additional methods such as a phone number, live chat widget, or knowledge base/FAQ section\n\n3. **Instructions for Use**\n\n - Alongside the contact details, include clear guidance such as “For any issues, support inquiries, or complaints, please use the form on this page or email us at [support@yourcompany.com](mailto:support@yourcompany.com).”\n - This ensures customers know which method to use and what kind of issues can be sent through each channel.\n\n4. **Logging and Tracking Customer Requests**\n\n - Your organization must also maintain a record (log) of all customer requests, complaints, and issues. This can be done through:\n - An integrated ticketing system (e.g., Zendesk, Freshdesk, Help Scout, etc.)\n - An internal spreadsheet or CRM system where requests are documented and tracked until resolved\n - Email archiving, if support is handled primarily via a direct contact email\n\n**Acceptable evidence for this requirement can include:**\n\n- A working **“Contact Us” / “Support” page link** visible on your live site *(Add as a comment to the bottom of the task)*\n- A **clear contact email address** (such as [support@yourcompany.com](mailto:support@yourcompany.com)) displayed in the footer of your website\n- Screenshots or records showing that incoming support requests are being logged and tracked\n\n ","2025-10-03T13:58:07.532Z","2025-10-03T19:22:49.238Z","786e4729-ba6f-4978-888a-e514b51dfaaa",[],[],[],"Code Changes","code-changes","To reduce the risk of errors and unauthorized changes, enforce branch protection and formal change management practices:\n\n- **Branch Protection (Source Control):**\n\n - Enable branch protection rules for your **main (production) branch.**\n - Disallow direct pushes.\n - Require **pull requests (PRs)** with at least one peer review/approval before merging.\n - **Evidence:** Upload a screenshot of branch protection settings showing \"no direct pushes\" and \"PR required.\"\n\n- **ISO/IEC 27001 (Information Security Management):**\n\n - Maintain evidence of formal change control, including:\n - Peer review/approval of changes.\n - Testing evidence (e.g., successful regression/QA run).\n - A rollback plan documented for production changes.\n - Impact assessment (security, performance, availability).\n\n- **ISO/IEC 42001 (AI Management):**\n\n - Extend change management processes to cover **AI-specific components**, including:\n - Modifications to **models, training data, and algorithms.**\n - Documentation of risks (e.g., bias, data drift, ethics, regulatory impact).\n - Review/approval to ensure AI changes align with compliance, ethics, and performance requirements.\n\n- **PCI DSS (Payment Cards):**\n\n - For **cardholder data applications or infrastructure:**\n - Enforce documented change control.\n - Require approvals and regression testing prior to acceptance.\n - Maintain rollback plans.\n - Demonstrate **segregation of duties** (e.g., developer cannot both approve and deploy).\n - **Evidence:** Change request logs, configuration management tickets, and approvals from a change management system (e.g., Jira, ServiceNow).\n\n### Where to Configure / Locate These Controls\n\n**GitHub:**\n\n- Repository -> *Settings -> Branches -> Branch protection rules*\n - Check: \"Require pull request before merging\"\n - Check: \"Require status checks to pass\"\n - Disable direct pushes\n- Evidence: Screenshot of branch protection rules + action workflow output (tests).\n\n**GitHub (Rulesets — recommended method):**\n\n- Repository -> *Settings -> Rules -> Rulesets* -> Create a new ruleset targeting the `main` branch:\n - Require pull requests before merging.\n - Require at least 1 approval before merging.\n- Evidence: Screenshot of the active ruleset configuration.\n\n**GitLab:**\n\n- Project -> *Settings -> Repository -> Protected branches*\n - Restrict \"main/master\" branch from direct push.\n - Configure approvals via *Merge request settings.*\n- Evidence: Screenshot of branch rules + Merge Request settings (approvals required).\n\n**Bitbucket:**\n\n- Repository settings -> *Branch permissions*\n - Disallow direct pushes and enforce PR approvals.\n\n**Change Management Systems (ISO & PCI):**\n\n- Jira / ServiceNow / Azure DevOps -> Change tickets with:\n - Approvals logged\n - Pre-deployment testing evidence\n - Rollback steps\n - Risk/impact assessment\n\n**AI-Specific Change Tracking (ISO 42001):**\n\n- Store AI change records in:\n - MLflow, Weights & Biases, or internal model registry.\n - Documentation of training data changes, new model releases, and approvals.\n\n**Suggested Evidence for Audits**\n\n1. Screenshot of **branch protection rules** (GitHub/GitLab/Bitbucket). *(This alone is sufficient for SOC2 evidence)*\n2. For ISO 42001: Document **AI change review** (e.g., approval workflow with bias/risk review notes).\n3. For PCI: Evidence of **segregation of duties** (different people between dev, approver, deployer).\n\n---\n\n### Common Misconception: Describing Test Gates Is Not Enough\n\nA comment or PR description that explains your manual and automated test gates is **helpful context**, but it **does not substitute for technically enforced branch protection**. Auditors require that branch protection is actually configured and enforced in your source control system — not just described.\n\nIf automation checks confirm that branch protection is **not enabled** on your main branch, you must enable it regardless of how well your testing process is documented elsewhere.\n\n---\n\n### Solo Founders and Fully Automated Pipelines\n\nIf you operate as a solo founder with a fully automated CI/CD pipeline (no second human available to act as a peer reviewer), the accepted pattern is:\n\n1. **Enable branch protection on main:** No direct pushes; all changes must go through a pull request.\n2. **Require status checks:** The full CI suite (tests, lint, etc.) and any automated code-review steps must pass before a merge is allowed.\n3. **Automated approver identity:** An approval granted by a dedicated bot or service account — separate from the authoring identity — that only approves once all required checks are green, is a **defensible control design** for SOC 2 Change Management. SOC 2 does not strictly mandate that the approver be a human.\n\n> **Note:** Whether an automated approver fully satisfies the control is ultimately assessed by your auditor. Submit your enforced PR flow and required status checks as evidence, and allow the auditor to raise any findings if they require a human approver instead.","2025-10-03T16:16:37.209Z","2026-07-07T15:12:04.180Z","81f31032-7017-4889-9f89-715d14d6dee4",[],[],[],"App Availability","app-availability","# App Availability\n\nOrganizations must ensure that their websites and applications remain available and performant under high usage or attack conditions.\n\n---\n\n## 🔧 Core Requirements\n\n### ⚡ Scalability\n\nConfigure **auto-scaling** where supported so services can handle traffic spikes without downtime.\n\n### 🛡️ DDoS Protection\n\nEnable **DDoS mitigation** to protect against denial-of-service attacks.\n\n### 📸 Evidence Required\n\nProvide a screenshot or export showing that **DDoS protection** and/or **auto-scaling** is enabled in your infrastructure.\n\n---\n\n## 📋 ISO 27001 — Firewall Configuration Evidence\n\nShow documented evidence of **firewall configuration** to demonstrate that:\n\n- Inbound and outbound traffic is restricted to **authorized ports and services**\n- Rules are **periodically reviewed and updated**\n- **Default-deny policies** are enforced where feasible\n\n> **Accepted evidence formats:** Firewall rule exports, screenshots of configuration panels, or policy documents describing firewall rules and change management.\n\n---\n\n## 🔍 What Is (and Isn't) in Scope\n\nApp Availability covers only the infrastructure, sites, and APIs that **your organization physically deploys and controls**. Third-party vendor services are **not** in scope for this evidence item.\n\n> **Example:** If your application depends on an external service such as **OpenAI**, **Shopify**, or **Sage Accounting**, you do **not** need to include those integrations in your App Availability evidence. Because these are third-party vendors, you have no ability to monitor or act if their service goes down — availability of their platforms is outside your control.\n\n> ℹ️ If you have connected a third-party integration to the App Availability check and it is failing or generating errors, you can safely **disconnect or remove** that automation. It is not required for this evidence item.\n\n---\n\n## 🗺️ Where to Locate These Settings\n\n### ☁️ Google Cloud (GCP)\n\n| Category | Location |\n| --- | --- |\n| **DDoS Protection** | Google Cloud Armor → Security Policies |\n| **Auto-Scaling** | Compute Engine → Instance Groups → Autoscaling tab |\n| **Firewall Evidence** | VPC Network → Firewall Rules → Export configuration |\n\n---\n\n### 🔺 Vercel\n\n| Category | Location |\n| --- | --- |\n| **DDoS Protection** | Built-in via Vercel Edge Network (show screenshot of Firewall tab) |\n| **Auto-Scaling** | Automatically included — show via deployment analytics or docs reference |\n| **Firewall Configuration** | Firewall tab on project dashboard |\n\n---\n\n### 🟠 AWS\n\n| Category | Location |\n| --- | --- |\n| **DDoS Protection** | AWS Shield (Standard included, Advanced optional) → *AWS Shield Console* |\n| **Auto-Scaling** | EC2 → Auto Scaling Groups → Scaling policies |\n| **Firewall Evidence** | Security Groups and NACLs under *VPC* — screenshot of rules showing restricted ports |\n\n---\n\n### 🔵 Azure\n\n| Category | Location |\n| --- | --- |\n| **DDoS Protection** | Azure DDoS Protection → \"Enabled\" under the Virtual Network |\n| **Auto-Scaling** | Azure VM Scale Sets or App Service → Scale-out settings |\n| **Firewall Evidence** | Azure Firewall rules → Export or screenshot of policy |\n\n---\n\n## ✅ Suggested Evidence for Audits\n\n1. 📸 Screenshot of **auto-scaling policy** or service dashboard\n\n > If using a vendor such as Vercel that handles this automatically, notate in the comments that auto-scaling is provided by said vendor.\n\n2. 📸 Screenshot of **DDoS protection enabled** *(GCP Armor, AWS Shield, Azure DDoS Protection, or Vercel Firewall tab)*\n\n3. 📸 Screenshot or export of **firewall rules/configuration** *(showing least privilege + review date)*\n\n4. 📄 Internal policy or wiki page documenting **firewall management practices**","2025-10-03T15:42:17.498Z","2026-07-07T15:49:10.814Z","b6d5f439-25ec-47c9-98ab-e47228d00194",[],[],[],"2FA","2fa","## Overview\n\nMulti-Factor Authentication (MFA) must be enabled **wherever available** — including Google Workspace, cloud services, admin consoles, and business-critical apps. MFA provides an essential additional layer of protection against credential theft and account compromise.\n\n---\n\n## General Requirements\n\n- Enable MFA on **all user accounts** that can access sensitive data.\n- Pay special attention to **administrator accounts** and **remote access connections**.\n- Collect screenshots or configuration exports from each platform as evidence of MFA enforcement.\n\n---\n\n## Compliance-Specific Requirements\n\n### 🏥 HIPAA (Healthcare)\n\n- Ensure a designated **break-glass account** exists to allow emergency access to Protected Health Information (PHI) when normal access processes fail.\n\n**Break-glass accounts must:**\n\n- Be tightly controlled and monitored, with alerts triggered on usage.\n- Have MFA enabled, while still being designed to allow access in emergencies.\n- Be documented in the HIPAA security plan with proper justification and periodic review.\n\n---\n\n### 💳 PCI DSS (Payment Cards)\n\nMFA must be enabled for:\n\n- **All administrative access** into the Cardholder Data Environment (CDE).\n- **All remote access** into CDE systems — internal or external, for both users and vendors.\n\n**Acceptable forms of evidence include:**\n\n- Access control policies.\n- Screenshots of MFA settings.\n- System exports from IAM tools.\n\n---\n\n## Where to Configure MFA by Platform\n\n### Google Workspace (Admin Console)\n\n| Detail | Info |\n| --- | --- |\n| **Path** | Admin Console → Security → Authentication → 2-Step Verification |\n| **Options** | Enforce MFA for all users, or apply conditional rules via Context-Aware Access |\n| **Evidence** | Screenshot of the \"2-Step Verification Enforcement\" page |\n\n---\n\n### Vercel\n\n| Detail | Info |\n| --- | --- |\n| **Path (User)** | Account Settings → Security → Two-Factor Authentication |\n| **Path (Team)** | Organization Settings → Security → SSO & MFA Options |\n| **Evidence** | Screenshot of user or team security settings |\n\n---\n\n### AWS (IAM & SSO)\n\n| Detail | Info |\n| --- | --- |\n| **Path (Per User)** | IAM → Users → Security Credentials → MFA |\n| **Path (All Accounts)** | AWS SSO / Identity Center |\n| **CLI Check** | `aws iam list-virtual-mfa-devices` |\n| **Evidence** | Console screenshot or CLI output |\n\n---\n\n### Azure (Entra ID / Formerly Azure AD)\n\n| Detail | Info |\n| --- | --- |\n| **Path** | Azure AD → Security → MFA, or via Conditional Access Policies |\n| **Scope** | Enforce MFA for all admins and privileged roles |\n| **Evidence** | Screenshot of Conditional Access policy or MFA status page |\n\n---\n\n### Other Apps (GitHub, Slack, Jira, etc.)\n\n| Detail | Info |\n| --- | --- |\n| **Path** | Account Settings → Security → Two-Factor Authentication |\n| **Evidence** | Organization-level enforcement screenshot showing MFA is required for all members |\n\n---\n\n## ✅ Suggested Evidence for Audits\n\nCollect and retain the following evidence to support audit readiness:\n\n1. **MFA configuration exports or screenshots** for:\n - Identity providers (Google Workspace, Microsoft Entra, Okta)\n - Cloud platforms (AWS, Azure, GCP, Vercel)\n - Key SaaS apps (GitHub, Jira, Slack)\n2. **Break-glass account controls documentation** *(HIPAA)*\n3. **Config screenshots or reports** showing MFA enforcement for admin and remote access into the CDE *(PCI DSS)*\n\n---\n\n## Troubleshooting: MFA Compliance Check Showing as \"Failed\"\n\n### Symptom\n\nThe MFA/2FA compliance check continues to show as **\"Failed\"** even after enabling 2FA enforcement at the Google Workspace organization level.\n\n---\n\n### Cause\n\n> ⚠️ **Important:** The compliance check verifies that MFA is enabled on **each individual account**, not just that enforcement is turned on at the org level. If any individual accounts — including shared mailboxes — do not have MFA actively enabled, the check will continue to fail.\n\n---\n\n### Resolution\n\n1. Review the failure logs to identify which specific accounts do not have MFA enabled.\n - Contact support if you need help retrieving these logs.\n2. Enable 2FA on each of the identified failing accounts.\n3. Once all accounts have MFA enabled, the task status will automatically return from **\"Failed\"** to **\"Done\"**.\n\n---\n\n### Special Case: Shared Mailboxes\n\n> 💡 **Note:** Shared mailboxes can be **omitted** from the workspace integration configuration rather than requiring MFA to be enabled on them. Contact support to have specific accounts flagged as omitted.","2025-10-03T15:36:19.598Z","2026-07-07T15:46:40.118Z","25ff6661-d4b7-418d-9998-00de3bdfa8fa",[],[],[],"GDPR","gdpr","2025-10-03T19:23:04.391Z","2025-10-03T21:09:28.673Z","97136b09-262c-4e77-ae4b-6bdd8c9a5601",6,[1002,1003,1004,1005,1006,1007],[],{"_74":1053,"_162":1054,"_164":-5,"_166":1055,"_168":998,"_169":-5,"_170":1056,"_172":1057,"_15":1058,"_17":18,"_176":1059,"_178":-5,"_179":1060,"_181":1061},{"_74":994,"_162":1044,"_164":1045,"_166":1046,"_168":998,"_169":-5,"_170":1047,"_172":1048,"_15":1049,"_17":18,"_176":1050,"_178":-5,"_179":1051,"_181":1052},{"_74":1035,"_162":1036,"_164":-5,"_166":1037,"_168":998,"_169":-5,"_170":1038,"_172":1039,"_15":1040,"_17":18,"_176":1041,"_178":-5,"_179":1042,"_181":1043},{"_74":1025,"_162":1026,"_164":1027,"_166":1028,"_168":998,"_169":-5,"_170":1029,"_172":1030,"_15":1031,"_17":18,"_176":1032,"_178":-5,"_179":1033,"_181":1034},{"_74":1016,"_162":1017,"_164":-5,"_166":1018,"_168":998,"_169":-5,"_170":1019,"_172":1020,"_15":1021,"_17":18,"_176":1022,"_178":-5,"_179":1023,"_181":1024},{"_74":1008,"_162":1009,"_164":-5,"_166":1010,"_168":998,"_169":-5,"_170":1011,"_172":1011,"_15":1012,"_17":18,"_176":1013,"_178":-5,"_179":1014,"_181":1015},"Review International Data Transfers","review-international-data-transfers","Organizations must document and ensure lawful handling of all personal data transfers to third countries outside the EU/EEA, in alignment with **GDPR Chapter V** requirements.\n\n- **General Requirement:**\n\n - Identify and review all **international data flows** (inbound and outbound to/from the EU/EEA).\n - Confirm that each transfer relies on a **valid transfer mechanism**, such as:\n - **Adequacy Decision** — EU Commission recognizes recipient country as having adequate protections.\n - **Standard Contractual Clauses (SCCs)** — adopted in contracts with non‑EU processors/controllers.\n - **Binding Corporate Rules (BCRs)** — for intra‑group transfers.\n - **Derogations** (Art. 49 GDPR) — used only in exceptional cases.\n - Document safeguards, contractual updates, and mapping to relevant vendors/services.\n - Review regularly (at least annually or upon provider/system changes).\n\n- **If Not Applicable:**\n\n - If **no personal data leaves or enters the EU/EEA**, mark the task as **“Not Relevant”** and log your reasoning (e.g., “All processing is within EU cloud providers, no data transfers outside EU”).\n\n### Mapping to Standards\n\n- **GDPR Chapter V:** Rules on international data transfers.\n- **ISO/IEC 27001:** A.5.31 — *Compliance with legal and contractual requirements for data transfers.*\n- **ISO/IEC 42001 (AI Governance):**\n - Any AI systems trained/processed on cross‑border data must also document safeguards.\n - Consider ethical risks of transfers where laws/standards differ (e.g., surveillance jurisdictions).\n- **HIPAA:** Covered entities and BAs must also evaluate cross‑border transfers of PHI (though less common).\n- **PCI DSS:** Requires documentation if CHD is processed internationally or via cross‑border service providers.\n\n### Where to Document\n\n- **Data Processing Inventory / RoPA (Records of Processing Activities):**\n - Add a **“Transfer Mechanism”** column to your vendor/system list (Adequacy, SCC, BCR, Derogation).\n- **Vendor Management System:**\n - Ensure DPAs include SCCs or country adequacy references for relevant vendors.\n- **Legal/Compliance Files:**\n - Maintain signed SCCs and contracts in a central folder.\n- **Privacy Policy / Public Communications:**\n - If applicable, disclose categories of transfers and lawful basis.\n\n✅ **Suggested Evidence for Audits**\n\n1. Spreadsheet or system report listing:\n - Vendor/System\n - Data Category\n - Country Location\n - Transfer Mechanism (Adequacy, SCC, BCR, Derogation)\n - Last Review Date\n2. Copies of **signed SCCs or BCR approvals** for relevant transfers.\n3. Screenshot of **EU Commission adequacy country list** (if applicable).\n4. Change log showing updates when vendors or transfer mechanisms changed.\n5. For “Not Relevant” cases: Written statement explaining that no data is transferred internationally.","2025-10-03T19:32:14.751Z","30a0ec62-44f5-42a4-a489-ebe40c545404",[],[],[],"Manage Third-party and EU Representative Relationships","manage-third-party-and-eu-representative-relationships","Organizations must manage vendor and representative relationships to ensure personal data is processed lawfully and securely.\n\n- **Third‑Party Processor Compliance**\n\n - All third‑party processors handling personal data on your behalf must have a **GDPR‑compliant Data Processing Agreement (DPA)** in place.\n - DPAs must outline:\n - Nature, purpose, and duration of processing.\n - Categories of personal data and data subjects.\n - Security measures to protect data.\n - Rights and obligations of both the controller and processor.\n - Sub‑processor approval/notification mechanisms.\n - Contracts must be **reviewed regularly** (at least annually or upon material change).\n\n- **EU Representative Requirement (GDPR Article 27)**\n\n - If your organization is **established outside the EU/EEA but processes EU/EEA residents’ personal data**, you must appoint an **EU Representative**.\n - The EU Representative must:\n - Be located in the EU.\n - Be authorized in writing to act on your behalf regarding GDPR obligations.\n - Serve as the contact point for Supervisory Authorities and data subjects.\n - The arrangement must be **formally documented** (appointment letter, contract, or agreement).\n\n- **Review Requirement**\n\n - Conduct periodic reviews (e.g., once per year) to confirm:\n - DPAs remain GDPR‑compliant.\n - EU Representative appointment is still valid/required.\n - Contracts reflect current services and risks.\n\n### Mapping to Standards\n\n- **GDPR:**\n - Article 28 → Processors must act only under written contract (DPA).\n - Article 27 → EU Representative requirement for non‑EU organizations processing EU personal data.\n- **ISO/IEC 27001:**\n - A.15 — Supplier relationships: requires contracts including information security requirements aligned to legal/compliance obligations.\n- **ISO/IEC 42001 (AI Governance):**\n - Third‑party vendors supplying **AI models, training datasets, or cloud AI platforms** must also be under DPAs or contractual safeguards.\n - EU rep obligations extend if AI models process EU personal data.\n- **HIPAA:**\n - Equivalent discipline: Business Associate Agreements (BAAs).\n- **PCI DSS:**\n - Service provider agreements for CHD responsibilities.\n\n### Where to Document\n\n- **Vendor Management:**\n - Maintain a **Vendor & Processor Register** listing all third‑party processors and status of their DPA.\n - Store signed DPAs in a central contract repository (e.g., SharePoint, Confluence, OneTrust, Ironclad).\n- **EU Representative:**\n - Keep **appointment documentation** (contract/letter of authority).\n - Include **EU Representative contact details** in your Privacy Policy.\n- **Compliance Records:**\n - Attach periodic contract reviews (e.g., annual audit checklist).\n\n✅ **Suggested Evidence for Audits**\n\n1. List of all third‑party processors with DPA status (spreadsheet or vendor register).\n2. Copies/screenshots of signed **DPAs** with vendors handling personal data.\n3. Document or contract appointing **EU Representative** (if applicable).\n4. Screenshot of Privacy Policy showing published EU Representative contact information.\n5. Evidence of vendor review (e.g., meeting notes, compliance checklist, or renewal log).","2025-10-03T19:21:27.290Z","2025-10-03T19:23:15.775Z","2762b705-5a94-4dd4-8da3-363e0aae3ade",[],[],[],"GDPR Templates","gdpr-templates","https://kb.trycomp.ai/GDPR-Templates-388a1b1858b88119bd44f3662ac507bb","GDPR templates. Copy/paste starting points for the documents and registers GDPR asks you to produce. These are working artifacts (registers, logs, assessments), not policies: your formal policies (privacy policy, retention policy, incident response, and so on) are generated and signed inside Comp AI. Copy a template into your own doc or sheet and adapt it to how you actually work.\n","2026-06-23T17:25:33.704Z","2026-07-07T19:00:59.984Z","9c39bec5-8bdd-45cd-91a3-4688e5e4752c",[],[],[],"GDPR: Data protection explained\n","gdpr-data-protection-explained","## What is personal data?\n\nPersonal data is any information that relates to an identified or identifiable living individual (data subject). Different pieces of information, which together can lead to the identification of a particular person, may also be considered personal data.\n\nPersonal data that has been de-identified, encrypted or **pseudonymised** but can be used to re-identify a person remains personal data and falls within the scope of the General Data Protection Regulation (GDPR), the EU's main data protection law.\n\n**Examples of personal data**\n\n- a name and surname\n- a home address\n- an email address such as '[name.surname@company.com](mailto:name.surname@company.com)'\n- an Internet Protocol (IP) address\n- an identification card number\n- a cookie ID\n- the advertising identifier of your phone\n- data held by a hospital or doctor, which could be a symbol that uniquely identifies a person\n\nPersonal data that has been rendered **anonymous** in such a way that the individual is no longer identifiable is not considered personal data. For data to be truly anonymised, the anonymisation must be irreversible.\n\n**Examples of data that is *not*** **considered personal data**\n\n- a company registration number\n- an email address such as '[info@company.com](mailto:info@company.com)'\n- anonymised data, if anonymisation is irreversible\n\n**References**\n\n- [Article 4(1) and (5)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN#d1e1489-1-1) and [Recitals (14), (26) to (30)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN#rct_14) of the GDPR\n- [Article 29 Working Party Opinion 4/2007 on the concept of personal data](https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2007/wp136_en.pdf)\n- [Article 29 Working Party Opinion 05/2014 on Anonymisation Techniques](https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp216_en.pdf)\n\n## What is data processing?\n\n### What constitutes personal data processing?\n\nData processing is any operation performed on personal data. It includes the **collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination** or otherwise making available, **alignment or combination, restriction, erasure or destruction** of personal data.\n\nThe GDPR protects personal data **regardless of the technology used for processing that data**. It is technology neutral and applies to both automated and manual processing, provided the data is organised in accordance with pre-defined criteria (for example in an alphabetical order). It also does not matter how the data is stored – in an IT system, through video surveillance, or on paper; in all cases, personal data is subject to the protection requirements set out in the GDPR.\n\n**Examples of data processing**\n\n- staff management and payroll administration\n- accessing or consulting a contacts database containing personal data\n- shredding documents containing personal data\n- posting a photo of a person on a website\n- storing IP addresses or MAC addresses\n- video recording (CCTV)\n\n**References**\n\n- [Articles 2](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN#art_2), [4(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN#art_4) and [(6)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN#art_6) and [Recital (15)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN#rct_15) of the GDPR\n\n### Who processes personal data?\n\nPersonal data processing can be carried out by individuals, or by private or public organisations, such as companies or public authorities. Their responsibilities and liability for specific data processing depend on the role that they play in the processing in question.\n\nData controller\n\nThe data controller determines the **purposes** for which and the **means** by which personal data is processed.\n\nData processor\n\nThe data processor processes personal data **on behalf** **of the controller,** on that controller’s documented instructions. \n\n**Example: Data controller and processor**\n\nA brewery has many employees. It signs a contract with a payroll company to pay the wages. The brewery tells the payroll company when the wages should be paid, when an employee leaves or has a pay rise, and provides all other details for the salary slip and payment. The payroll company provides the IT system and stores the employees’ data. \n\nIn this case, the brewery is the data controller and the payroll company is the data processor.\n\n[Read more about the role of the data controller and processor](https://commission.europa.eu/law/law-topic/data-protection/rules-business-and-organisations/obligations/controllerprocessor/what-data-controller-or-data-processor_en)\n\n**References**\n\n- [Articles 4(7)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN#art_4) and [(8)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN#art_8) and [24, 26 and 28](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN#art_24) of the GDPR\n- [EDPB Guidelines 7/2020 on the concepts of controller and processor in the GDPR](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en)\n\n## When and to whom does EU data protection law apply?\n\nThe GDPR applies to:\n\n1. A controller or a processor, such as an individual or a private or public organisation, established in the EU which processes personal data as part of its activities, regardless of whether the data is processed in the EU; and\n2. A controller or a processor, such as an individual or a private or public organisation, established outside the EU when it is offering goods/services (paid or for free) to individuals in the EU or monitoring the behaviour of individuals in the EU.\n\n**Example of when the GDPR applies**\n\nA small, tertiary education company, operating online with an establishment based outside the EU targets mainly students in Spanish and Portuguese language universities in the EU. \n\nA company with an establishment in the EU provides travel services to customers based in the Baltic countries and in that context processes personal data of natural persons.\n\n**Example of when the GDPR *does not* apply**\n\nA company, which is a service provider based outside the EU, provides services to customers outside the EU. Its clients can use its services when they travel to other countries, including within the EU. Provided that the company does not specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR. \n\nIf a company is a **small and medium-sized enterprise (SME)** processing personal data, it must comply with the GDPR. However, some obligations of the GDPR do not apply if the processing is not a core part of the SME’s business, or if its activity is not likely to create risks for individuals. \n\n[Read more about specific rules for SMEs.](https://commission.europa.eu/law/law-topic/data-protection/rules-business-and-organisations_en)\n\nThe GDPR does not apply to data processed by an individual for **purely personal reasons or for activities carried out in one's home**, if there is no connection to a professional or commercial activity. When an individual uses personal data outside the personal sphere, for socio-cultural or financial activities, for example, then the data protection law has to be respected.\n\nThe GDPR does not apply to the processing of personal **data of deceased persons**.\n\n**References**\n\n- [Articles 2 and 3](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN#art_2) and [Recitals (13), (18), (22) to (25) and (27)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN#rct_13) of the GDPR\n\n## How is personal data protected?\n\n### Principles of personal data processing\n\nTo ensure the protection of your personal data when it is collected or used, the GDPR sets out 7 key principles that individuals and private or public organisations must comply with when they process personal data.\n\n**The principles of personal data processing under the GDPR**\n\n- Lawfulness, fairness and transparency\n- Purpose limitation\n- Data minimisation\n- Storage limitation\n- Accuracy\n- Integrity and confidentiality\n- Accountability\n\n[Read more about the principles of the GDPR](https://commission.europa.eu/law/law-topic/data-protection/rules-business-and-organisations/principles-gdpr_en)\n\n### Data protection rights\n\nUnder the GDPR, individuals have several rights over their personal data. \n\n**The rights of individuals**\n\n- Right to be informed\n- Right of access\n- Right to rectification\n- Right to erasure\n- Right to restriction of processing\n- Right to data portability\n- Right to object\n- Rights in relation to automated decision-making and profiling","2026-03-17T12:29:36.986Z","2026-07-07T19:00:59.985Z","343a5b1b-1de8-4a14-b051-aa6a0950025f",[],[],[],"gdpr-2","https://kb.trycomp.ai/GDPR-388a1b1858b88154b587e5f24fbbd4ea","# 🇪🇺 GDPR\n\n**Your complete guide to GDPR with Comp AI.**\n\nGDPR can feel enormous. It isn't, once it's broken down. This guide turns the regulation into your broken-down platform tasks, grouped into 3 short pages and explained in plain English — with exactly what to do at every level: from the bare minimum for a small team all the way up to the full setup for high-risk processing.\n\n---\n\n## Does GDPR Apply to You?\n\nGDPR applies if you offer goods or services to, or monitor the behaviour of, people in the EU or UK, regardless of where your company is based. If you have EU/UK users, customers, or employees, assume it applies.\n\nHandling EU/UK data on behalf of customers? You're most likely a **processor**, and the bulk of this still applies to you.\n\n---\n\n## How to Use This Guide\n\nEvery task is answered at three levels. Aim for the tier that matches your size and risk:\n\n| Tier | Who It's For |\n| --- | --- |\n| 🟢 **Tier 1 — Minimum Viable** | Small or early-stage team, low-risk processing (e.g. basic B2B SaaS with no special-category data). The defensible floor. |\n| 🔵 **Tier 2 — Recommended** | A growing company handling meaningful volumes of customer personal data. The standard most companies should aim for. |\n| 🟣 **Tier 3 — Advanced / High-Risk** | Large scale, special-category data (health, biometrics), automated decision-making, or significant international transfers. |\n\nJump to the page that covers the task you're stuck on. Each section is named exactly as the task appears in your platform.\n\n---\n\n## Pages in This Guide\n\n- 📄 [**Security & Operations**](https://kb.trycomp.ai/388a1b1858b881aeac8afc87b7c04d1d) — encryption at rest, secure code, app availability, monitoring & alerting, incident response.\n\n- 📄 [**GDPR Templates**](https://kb.trycomp.ai/388a1b1858b88119bd44f3662ac507bb) — a library of copy/paste registers, logs, and assessments for the tasks that need a supporting document.\n\n---\n\n## Need Help?\n\n💬 Reach out in your shared Slack channel!","2026-06-23T17:25:30.922Z","2026-07-07T19:00:59.983Z","af102355-991b-4d7f-9461-4e66f42786c5",[],[],[],"Appoint or Review Data Protection Officer","appoint-or-review-data-protection-officer","Organizations must assess whether the appointment of a **Data Protection Officer (DPO)** is required based on the scale and nature of their personal/sensitive data processing activities.\n\n- **GDPR Requirement:**\n\n - A DPO **must** be appointed if your organization:\n - Engages in **large‑scale, regular, or systematic monitoring** of individuals (e.g., behavioral tracking, large analytics platforms).\n - Processes **large‑scale special categories of data** (e.g., health, biometric, financial, racial/ethnic data).\n - Is a **public authority or body**.\n - **If Required:**\n - Formally appoint a **qualified DPO** (internal employee or external provider).\n - Document:\n - Name/role or vendor\n - Responsibilities (advising on GDPR, monitoring compliance, liaising with authorities, supporting DPIAs)\n - Reporting line (must report independently to senior management)\n - Ensure DPO contact details are published in your Privacy Policy and available to data subjects.\n - **If Not Required:**\n - Record a written assessment stating “**Not Relevant**” and explain why GDPR DPO requirements do not apply to your processing.\n - Example justification: “Company does not conduct large‑scale monitoring or handle special categories of personal data under Article 37 GDPR.”\n\n- **Review Requirement:**\n\n - Assess **annually** or sooner if there are significant changes (e.g., expansion into EU markets, launch of new data‑intensive services, or AI tools processing sensitive data).\n - Update documentation accordingly.\n\n### Mapping to Standards\n\n- **GDPR:** Articles 37–39 explicitly define DPO appointment obligations.\n- **ISO/IEC 27001:** Clause 5 (Leadership) & A.5 (Information security policies) require definition of roles and responsibilities for data protection, even if not formally a DPO.\n- **ISO/IEC 42001 (AI Governance):** If AI systems process sensitive data or personal data at scale, the DPO (or equivalent stakeholder) should be included in governance reviews and AI impact assessments.\n- **HIPAA/PCI:** While no DPO equivalent is mandated, roles like **Privacy Officer** (HIPAA) or **Security Officer** (PCI DSS) overlap. Alignment with those roles should be documented if applicable.\n\n### Where to Document\n\n- **Governance Documents:**\n - Policy manual or compliance charter should note DPO required/not required.\n - If required: Appointment letter or HR / contract record.\n - If external: DPO service provider agreement.\n- **Privacy Policy:**\n - Include DPO contact information, typically [privacy@company.com](mailto:privacy@company.com) or dedicated DPO email.\n- **Records of Processing Activities (RoPA):**\n - Mark DPO status under GDPR Article 30 logs.\n- **Change Management:**\n - Track reviews/decisions annually in compliance tracker or board minutes.\n\n✅ **Suggested Evidence for Audits**\n\n1. **If Required:**\n - Appointment letter or HR record naming DPO.\n - DPO role description + reporting line in org chart.\n - Privacy Policy screenshot showing DPO contact info.\n2. **If Not Required:**\n - Written risk assessment stating “Not Relevant” + justification (e.g., “no large‑scale monitoring” / “no special‑category data”).\n3. **Ongoing:**\n - Change log or review record showing last DPO assessment decision.","2025-10-03T19:19:35.280Z","2025-10-03T19:23:15.776Z","6182974a-c250-434f-811b-a27187f35f05",[],[],[],"Documentation","documentation","Comp AI platform docs","2026-07-07T16:00:47.505Z","b9ee0b63-6c0e-4341-8357-f7b1184ab3c0",112,[1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1088,1089,1090,1091,1092,1093,1094,1095,1096,1097,1098,1099,1100,1101,1102,1103,1104,1105,1106,1107,1108,1109,1110,1111,1112,1113,1114,1115,1116,1117,1118,1119,1120],[],{"_74":1603,"_162":1604,"_164":1605,"_166":1606,"_168":1066,"_169":-5,"_170":1607,"_172":1608,"_15":1609,"_17":18,"_176":1610,"_178":-5,"_179":1611,"_181":1612},{"_74":1593,"_162":1594,"_164":1595,"_166":1596,"_168":1066,"_169":-5,"_170":1597,"_172":1598,"_15":1599,"_17":18,"_176":1600,"_178":-5,"_179":1601,"_181":1602},{"_74":1583,"_162":1584,"_164":1585,"_166":1586,"_168":1066,"_169":-5,"_170":1587,"_172":1588,"_15":1589,"_17":18,"_176":1590,"_178":-5,"_179":1591,"_181":1592},{"_74":1573,"_162":1574,"_164":1575,"_166":1576,"_168":1066,"_169":-5,"_170":1577,"_172":1578,"_15":1579,"_17":18,"_176":1580,"_178":-5,"_179":1581,"_181":1582},{"_74":1555,"_162":1565,"_164":1566,"_166":1567,"_168":1066,"_169":-5,"_170":1568,"_172":1560,"_15":1569,"_17":18,"_176":1570,"_178":-5,"_179":1571,"_181":1572},{"_74":1555,"_162":1556,"_164":1557,"_166":1558,"_168":1066,"_169":-5,"_170":1559,"_172":1560,"_15":1561,"_17":18,"_176":1562,"_178":-5,"_179":1563,"_181":1564},{"_74":1536,"_162":1546,"_164":1547,"_166":1548,"_168":1066,"_169":-5,"_170":1549,"_172":1550,"_15":1551,"_17":18,"_176":1552,"_178":-5,"_179":1553,"_181":1554},{"_74":1536,"_162":1537,"_164":1538,"_166":1539,"_168":1066,"_169":-5,"_170":1540,"_172":1541,"_15":1542,"_17":18,"_176":1543,"_178":-5,"_179":1544,"_181":1545},{"_74":1510,"_162":1529,"_164":1530,"_166":1522,"_168":1066,"_169":-5,"_170":1531,"_172":1524,"_15":1532,"_17":18,"_176":1533,"_178":-5,"_179":1534,"_181":1535},{"_74":1510,"_162":1520,"_164":1521,"_166":1522,"_168":1066,"_169":-5,"_170":1523,"_172":1524,"_15":1525,"_17":18,"_176":1526,"_178":-5,"_179":1527,"_181":1528},{"_74":1510,"_162":1511,"_164":1512,"_166":1513,"_168":1066,"_169":-5,"_170":1514,"_172":1515,"_15":1516,"_17":18,"_176":1517,"_178":-5,"_179":1518,"_181":1519},{"_74":1483,"_162":1501,"_164":1502,"_166":1503,"_168":1066,"_169":-5,"_170":1504,"_172":1505,"_15":1506,"_17":18,"_176":1507,"_178":-5,"_179":1508,"_181":1509},{"_74":1483,"_162":1493,"_164":1494,"_166":1486,"_168":1066,"_169":-5,"_170":1495,"_172":1496,"_15":1497,"_17":18,"_176":1498,"_178":-5,"_179":1499,"_181":1500},{"_74":1483,"_162":1484,"_164":1485,"_166":1486,"_168":1066,"_169":-5,"_170":1487,"_172":1488,"_15":1489,"_17":18,"_176":1490,"_178":-5,"_179":1491,"_181":1492},{"_74":1457,"_162":1475,"_164":1476,"_166":1477,"_168":1066,"_169":-5,"_170":1478,"_172":1470,"_15":1479,"_17":18,"_176":1480,"_178":-5,"_179":1481,"_181":1482},{"_74":1457,"_162":1467,"_164":1468,"_166":1460,"_168":1066,"_169":-5,"_170":1469,"_172":1470,"_15":1471,"_17":18,"_176":1472,"_178":-5,"_179":1473,"_181":1474},{"_74":1457,"_162":1458,"_164":1459,"_166":1460,"_168":1066,"_169":-5,"_170":1461,"_172":1462,"_15":1463,"_17":18,"_176":1464,"_178":-5,"_179":1465,"_181":1466},{"_74":1448,"_162":1449,"_164":1362,"_166":1450,"_168":1066,"_169":-5,"_170":1451,"_172":1452,"_15":1453,"_17":18,"_176":1454,"_178":-5,"_179":1455,"_181":1456},{"_74":1429,"_162":1439,"_164":1440,"_166":1441,"_168":1066,"_169":-5,"_170":1442,"_172":1443,"_15":1444,"_17":18,"_176":1445,"_178":-5,"_179":1446,"_181":1447},{"_74":1429,"_162":1430,"_164":1431,"_166":1432,"_168":1066,"_169":-5,"_170":1433,"_172":1434,"_15":1435,"_17":18,"_176":1436,"_178":-5,"_179":1437,"_181":1438},{"_74":1419,"_162":1420,"_164":1421,"_166":1422,"_168":1066,"_169":-5,"_170":1423,"_172":1424,"_15":1425,"_17":18,"_176":1426,"_178":-5,"_179":1427,"_181":1428},{"_74":1409,"_162":1410,"_164":1411,"_166":1412,"_168":1066,"_169":-5,"_170":1413,"_172":1414,"_15":1415,"_17":18,"_176":1416,"_178":-5,"_179":1417,"_181":1418},{"_74":1400,"_162":1401,"_164":1402,"_166":1403,"_168":1066,"_169":-5,"_170":1404,"_172":1395,"_15":1405,"_17":18,"_176":1406,"_178":-5,"_179":1407,"_181":1408},{"_74":1390,"_162":1391,"_164":1392,"_166":1393,"_168":1066,"_169":-5,"_170":1394,"_172":1395,"_15":1396,"_17":18,"_176":1397,"_178":-5,"_179":1398,"_181":1399},{"_74":1380,"_162":1381,"_164":1382,"_166":1383,"_168":1066,"_169":-5,"_170":1384,"_172":1385,"_15":1386,"_17":18,"_176":1387,"_178":-5,"_179":1388,"_181":1389},{"_74":1370,"_162":1371,"_164":1372,"_166":1373,"_168":1066,"_169":-5,"_170":1374,"_172":1375,"_15":1376,"_17":18,"_176":1377,"_178":-5,"_179":1378,"_181":1379},{"_74":1360,"_162":1361,"_164":1362,"_166":1363,"_168":1066,"_169":-5,"_170":1364,"_172":1365,"_15":1366,"_17":18,"_176":1367,"_178":-5,"_179":1368,"_181":1369},{"_74":1350,"_162":1351,"_164":1352,"_166":1353,"_168":1066,"_169":-5,"_170":1354,"_172":1355,"_15":1356,"_17":18,"_176":1357,"_178":-5,"_179":1358,"_181":1359},{"_74":1340,"_162":1341,"_164":1342,"_166":1343,"_168":1066,"_169":-5,"_170":1344,"_172":1345,"_15":1346,"_17":18,"_176":1347,"_178":-5,"_179":1348,"_181":1349},{"_74":1330,"_162":1331,"_164":1332,"_166":1333,"_168":1066,"_169":-5,"_170":1334,"_172":1335,"_15":1336,"_17":18,"_176":1337,"_178":-5,"_179":1338,"_181":1339},{"_74":1320,"_162":1321,"_164":1322,"_166":1323,"_168":1066,"_169":-5,"_170":1324,"_172":1325,"_15":1326,"_17":18,"_176":1327,"_178":-5,"_179":1328,"_181":1329},{"_74":1310,"_162":1311,"_164":1312,"_166":1313,"_168":1066,"_169":-5,"_170":1314,"_172":1315,"_15":1316,"_17":18,"_176":1317,"_178":-5,"_179":1318,"_181":1319},{"_74":1300,"_162":1301,"_164":1302,"_166":1303,"_168":1066,"_169":-5,"_170":1304,"_172":1305,"_15":1306,"_17":18,"_176":1307,"_178":-5,"_179":1308,"_181":1309},{"_74":1290,"_162":1291,"_164":1292,"_166":1293,"_168":1066,"_169":-5,"_170":1294,"_172":1295,"_15":1296,"_17":18,"_176":1297,"_178":-5,"_179":1298,"_181":1299},{"_74":1280,"_162":1281,"_164":1282,"_166":1283,"_168":1066,"_169":-5,"_170":1284,"_172":1285,"_15":1286,"_17":18,"_176":1287,"_178":-5,"_179":1288,"_181":1289},{"_74":1270,"_162":1271,"_164":1272,"_166":1273,"_168":1066,"_169":-5,"_170":1274,"_172":1275,"_15":1276,"_17":18,"_176":1277,"_178":-5,"_179":1278,"_181":1279},{"_74":1260,"_162":1261,"_164":1262,"_166":1263,"_168":1066,"_169":-5,"_170":1264,"_172":1265,"_15":1266,"_17":18,"_176":1267,"_178":-5,"_179":1268,"_181":1269},{"_74":1250,"_162":1251,"_164":1252,"_166":1253,"_168":1066,"_169":-5,"_170":1254,"_172":1255,"_15":1256,"_17":18,"_176":1257,"_178":-5,"_179":1258,"_181":1259},{"_74":1240,"_162":1241,"_164":1242,"_166":1243,"_168":1066,"_169":-5,"_170":1244,"_172":1245,"_15":1246,"_17":18,"_176":1247,"_178":-5,"_179":1248,"_181":1249},{"_74":1221,"_162":1231,"_164":1232,"_166":1233,"_168":1066,"_169":-5,"_170":1234,"_172":1235,"_15":1236,"_17":18,"_176":1237,"_178":-5,"_179":1238,"_181":1239},{"_74":1221,"_162":1222,"_164":1223,"_166":1224,"_168":1066,"_169":-5,"_170":1225,"_172":1226,"_15":1227,"_17":18,"_176":1228,"_178":-5,"_179":1229,"_181":1230},{"_74":1211,"_162":1212,"_164":1213,"_166":1214,"_168":1066,"_169":-5,"_170":1215,"_172":1216,"_15":1217,"_17":18,"_176":1218,"_178":-5,"_179":1219,"_181":1220},{"_74":1201,"_162":1202,"_164":1203,"_166":1204,"_168":1066,"_169":-5,"_170":1205,"_172":1206,"_15":1207,"_17":18,"_176":1208,"_178":-5,"_179":1209,"_181":1210},{"_74":1191,"_162":1192,"_164":1193,"_166":1194,"_168":1066,"_169":-5,"_170":1195,"_172":1196,"_15":1197,"_17":18,"_176":1198,"_178":-5,"_179":1199,"_181":1200},{"_74":1181,"_162":1182,"_164":1183,"_166":1184,"_168":1066,"_169":-5,"_170":1185,"_172":1186,"_15":1187,"_17":18,"_176":1188,"_178":-5,"_179":1189,"_181":1190},{"_74":1171,"_162":1172,"_164":1173,"_166":1174,"_168":1066,"_169":-5,"_170":1175,"_172":1176,"_15":1177,"_17":18,"_176":1178,"_178":-5,"_179":1179,"_181":1180},{"_74":1161,"_162":1162,"_164":1163,"_166":1164,"_168":1066,"_169":-5,"_170":1165,"_172":1166,"_15":1167,"_17":18,"_176":1168,"_178":-5,"_179":1169,"_181":1170},{"_74":1151,"_162":1152,"_164":1153,"_166":1154,"_168":1066,"_169":-5,"_170":1155,"_172":1156,"_15":1157,"_17":18,"_176":1158,"_178":-5,"_179":1159,"_181":1160},{"_74":1141,"_162":1142,"_164":1143,"_166":1144,"_168":1066,"_169":-5,"_170":1145,"_172":1146,"_15":1147,"_17":18,"_176":1148,"_178":-5,"_179":1149,"_181":1150},{"_74":1131,"_162":1132,"_164":1133,"_166":1134,"_168":1066,"_169":-5,"_170":1135,"_172":1136,"_15":1137,"_17":18,"_176":1138,"_178":-5,"_179":1139,"_181":1140},{"_74":1121,"_162":1122,"_164":1123,"_166":1124,"_168":1066,"_169":-5,"_170":1125,"_172":1126,"_15":1127,"_17":18,"_176":1128,"_178":-5,"_179":1129,"_181":1130},"Get all vendors - Comp AI - Documentation","get-all-vendors-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/vendors/get-all-vendors","# Get all vendors - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Response\n\nVendors retrieved successfully\n\nHide child attributes\n\nVendor ID\n\nExample:\n\n`\"vnd_abc123def456\"`\n\nVendor name\n\nExample:\n\n`\"CloudTech Solutions Inc.\"`\n\nVendor description\n\nExample:\n\n`\"Cloud infrastructure provider offering AWS-like services\"`\n\nAvailable options:\n\n`cloud`,\n\n`infrastructure`,\n\n`software_as_a_service`,\n\n`finance`,\n\n`marketing`,\n\n`sales`,\n\n`hr`,\n\n`other`\n\nAvailable options:\n\n`not_assessed`,\n\n`in_progress`,\n\n`assessed`\n\nAvailable options:\n\n`very_unlikely`,\n\n`unlikely`,\n\n`possible`,\n\n`likely`,\n\n`very_likely`\n\nAvailable options:\n\n`insignificant`,\n\n`minor`,\n\n`moderate`,\n\n`major`,\n\n`severe`\n\nAvailable options:\n\n`very_unlikely`,\n\n`unlikely`,\n\n`possible`,\n\n`likely`,\n\n`very_likely`\n\nAvailable options:\n\n`insignificant`,\n\n`minor`,\n\n`moderate`,\n\n`major`,\n\n`severe`\n\nExample:\n\n`\"https://www.cloudtechsolutions.com\"`\n\nID of the user assigned to manage this vendor\n\nExample:\n\n`\"mem_abc123def456\"`\n\nWhen the vendor was created\n\nWhen the vendor was last updated\n\nHow the request was authenticated\n\nAvailable options\n\n:\n\n`api-key`,\n\n`session`\n\nUser information (only for session auth)\n\nHide child attributes\n\nExample:\n\n`\"usr_def456ghi789\"`\n\nExample:\n\n`\"user@example.com\"`","2025-11-25T14:46:38.018Z","2026-07-07T16:13:16.829Z","bd2871b6-74ac-4c7e-9d93-ad60b7f34a46",[],[],[],"Get all tasks - Comp AI - Documentation","get-all-tasks-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/tasks/get-all-tasks","# Get all tasks - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Response\n\nTasks retrieved successfully\n\nUnique identifier for the task\n\nExample:\n\n`\"tsk_abc123def456\"`\n\nTask title\n\nExample:\n\n`\"Implement user authentication\"`\n\nTask status\n\nAvailable options:\n\n`todo`,\n\n`in_progress`,\n\n`done`,\n\n`blocked`\n\ncreatedAt\n\nstring\n\nrequired\n\nTask creation timestamp\n\nExample:\n\n`\"2024-01-15T10:30:00Z\"`\n\nupdatedAt\n\nstring\n\nrequired\n\nTask last update timestamp\n\nExample:\n\n`\"2024-01-15T10:30:00Z\"`\n\nTask description\n\nExample:\n\n`\"Add OAuth 2.0 authentication to the platform\"`\n\nTask template ID\n\nExample:\n\n`\"frk_tt_68406e353df3bc002994acef\"`","2025-11-25T14:46:34.294Z","2026-07-07T16:13:16.828Z","5aad5f6f-b2cc-4bcc-b0fc-6f9ea6d33b4a",[],[],[],"Get all risks - Comp AI - Documentation","get-all-risks-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/risks/get-all-risks","# Get all risks - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Response\n\nRisks retrieved successfully\n\nHide child attributes\n\nRisk ID\n\nExample:\n\n`\"rsk_abc123def456\"`\n\nRisk title\n\nExample:\n\n`\"Data breach vulnerability in user authentication system\"`\n\nRisk description\n\nExample:\n\n`\"Weak password requirements could lead to unauthorized access to user accounts\"`\n\nAvailable options:\n\n`customer`,\n\n`governance`,\n\n`operations`,\n\n`other`,\n\n`people`,\n\n`regulatory`,\n\n`reporting`,\n\n`resilience`,\n\n`technology`,\n\n`vendor_management`\n\nAvailable options:\n\n`open`,\n\n`pending`,\n\n`closed`,\n\n`archived`\n\nAvailable options:\n\n`very_unlikely`,\n\n`unlikely`,\n\n`possible`,\n\n`likely`,\n\n`very_likely`\n\nAvailable options:\n\n`insignificant`,\n\n`minor`,\n\n`moderate`,\n\n`major`,\n\n`severe`\n\nAvailable options:\n\n`accept`,\n\n`avoid`,\n\n`mitigate`,\n\n`transfer`\n\nID of the user assigned to this risk\n\nExample:\n\n`\"mem_abc123def456\"`\n\nWhen the risk was created\n\nWhen the risk was last updated\n\nHow the request was authenticated\n\nAvailable options\n\n:\n\n`api-key`,\n\n`session`\n\nUser information (only for session auth)\n\nHide child attributes\n\nExample:\n\n`\"usr_def456ghi789\"`\n\nExample:\n\n`\"user@example.com\"`","2025-11-25T14:46:39.149Z","2026-07-07T16:13:16.827Z","7c6313c6-14a8-4d15-92b1-40b276550d84",[],[],[],"Get all policies - Comp AI - Documentation","get-all-policies-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/policies/get-all-policies","# Get all policies - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Response\n\nPolicies retrieved successfully\n\nThe policy ID\n\nExample:\n\n`\"pol_abc123def456\"`\n\nName of the policy\n\nExample:\n\n`\"Data Privacy Policy\"`\n\nDescription of the policy\n\nExample:\n\n`\"This policy outlines how we handle and protect personal data\"`\n\nStatus of the policy\n\nAvailable options:\n\n`draft`,\n\n`published`,\n\n`needs_review`\n\nContent of the policy as TipTap JSON (array of nodes)\n\nExample:\n\n```\n[ { \"type\": \"heading\", \"attrs\": { \"level\": 2, \"textAlign\": null }, \"content\": [{ \"type\": \"text\", \"text\": \"Purpose\" }] }, { \"type\": \"paragraph\", \"attrs\": { \"textAlign\": null }, \"content\": [ { \"type\": \"text\", \"text\": \"Verify workforce integrity and grant the right access at start, revoke at end.\" } ] }]\n```\n\nfrequency\n\nenum | null\n\nrequired\n\nReview frequency of the policy\n\nAvailable options:\n\n`monthly`,\n\n`quarterly`,\n\n`yearly`\n\ndepartment\n\nenum | null\n\nrequired\n\nDepartment this policy applies to\n\nAvailable options:\n\n`none`,\n\n`admin`,\n\n`gov`,\n\n`hr`,\n\n`it`,\n\n`itsm`,\n\n`qms`\n\nWhether this policy requires a signature\n\nList of user IDs who have signed this policy\n\nreviewDate\n\nstring | null\n\nrequired\n\nReview date for the policy\n\nExample:\n\n`\"2024-12-31T00:00:00.000Z\"`\n\nWhether this policy is archived\n\ncreatedAt\n\nstring\n\nrequired\n\nWhen the policy was created\n\nExample:\n\n`\"2024-01-01T00:00:00.000Z\"`\n\nupdatedAt\n\nstring\n\nrequired\n\nWhen the policy was last updated\n\nExample:\n\n`\"2024-01-15T00:00:00.000Z\"`\n\nlastArchivedAt\n\nstring | null\n\nrequired\n\nWhen the policy was last archived\n\nExample:\n\n`\"2024-02-01T00:00:00.000Z\"`\n\nlastPublishedAt\n\nstring | null\n\nrequired\n\nWhen the policy was last published\n\nExample:\n\n`\"2024-01-10T00:00:00.000Z\"`\n\nOrganization ID this policy belongs to\n\nExample:\n\n`\"org_abc123def456\"`\n\nID of the user assigned to this policy\n\nExample:\n\n`\"usr_abc123def456\"`\n\nID of the user who approved this policy\n\nExample:\n\n`\"usr_xyz789abc123\"`\n\nID of the policy template this policy is based on\n\nExample:\n\n`\"plt_template123\"`","2025-11-25T14:46:32.970Z","2026-07-07T16:13:16.825Z","e16883c6-9c6c-49ee-b37e-21bd6dba8399",[],[],[],"Get all people - Comp AI - Documentation","get-all-people-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/people/get-all-people","# Get all people - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Response\n\nPeople retrieved successfully\n\nHide child attributes\n\nMember ID\n\nExample:\n\n`\"mem_abc123def456\"`\n\nOrganization ID this member belongs to\n\nExample:\n\n`\"org_abc123def456\"`\n\nUser ID associated with member\n\nExample:\n\n`\"usr_abc123def456\"`\n\ncreatedAt\n\nstring\n\nrequired\n\nWhen the member was created\n\nExample:\n\n`\"2024-01-01T00:00:00Z\"`\n\nMember department\n\nAvailable options:\n\n`none`,\n\n`admin`,\n\n`gov`,\n\n`hr`,\n\n`it`,\n\n`itsm`,\n\n`qms`\n\nFleetDM label ID for member devices\n\nUser information\n\nHide child attributes\n\nUser ID\n\nExample:\n\n`\"usr_abc123def456\"`\n\nUser email\n\nExample:\n\n`\"john.doe@company.com\"`\n\nWhether email is verified\n\nUser profile image URL\n\nExample:\n\n`\"https://example.com/avatar.jpg\"`\n\nuser.createdAt\n\nstring\n\nrequired\n\nWhen the user was created\n\nExample:\n\n`\"2024-01-01T00:00:00Z\"`\n\nuser.updatedAt\n\nstring\n\nrequired\n\nWhen the user was last updated\n\nExample:\n\n`\"2024-01-15T00:00:00Z\"`\n\nLast login time\n\nExample:\n\n`\"2024-01-15T12:00:00Z\"`\n\nHow the request was authenticated\n\nAvailable options\n\n:\n\n`api-key`,\n\n`session`\n\nHide child attributes\n\nUser ID\n\nExample:\n\n`\"usr_abc123def456\"`\n\nUser email\n\nExample:\n\n`\"user@company.com\"`","2025-11-25T14:46:39.799Z","2026-07-07T16:13:16.824Z","154d9b15-97d1-4ae5-badd-b986857f17fa",[],[],[],"Get all framework editor task templates - Comp AI - Documentation","get-all-framework-editor-task-templates-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/framework-editor-task-templates/get-all-framework-editor-task-templates","# Get all framework editor task templates - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Response\n\nSuccessfully retrieved all framework editor task templates\n\nThe response is of type `any`.","2025-11-25T14:46:32.161Z","2026-07-07T16:13:16.823Z","70ba4b1f-4b2f-4bf3-b8ff-26a8d7ba081d",[],[],[],"Get all context entries - Comp AI - Documentation","get-all-context-entries-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/context/get-all-context-entries","# Get all context entries - Comp AI\n\n```\n{\n \"data\": [\n {\n \"id\": \"ctx_abc123def456\",\n \"organizationId\": \"org_xyz789uvw012\",\n \"question\": \"How do we handle user authentication in our application?\",\n \"answer\": \"We use a hybrid authentication system supporting both API keys and session-based authentication.\",\n \"tags\": [\n \"authentication\",\n \"security\",\n \"api\",\n \"sessions\"\n ],\n \"createdAt\": \"2024-01-15T10:30:00.000Z\",\n \"updatedAt\": \"2024-01-15T14:20:00.000Z\"\n },\n {\n \"id\": \"ctx_ghi789jkl012\",\n \"organizationId\": \"org_xyz789uvw012\",\n \"question\": \"What database do we use and why?\",\n \"answer\": \"We use PostgreSQL as our primary database with Prisma as the ORM.\",\n \"tags\": [\n \"database\",\n \"postgresql\",\n \"prisma\",\n \"architecture\"\n ],\n \"createdAt\": \"2024-01-14T09:15:00.000Z\",\n \"updatedAt\": \"2024-01-14T09:15:00.000Z\"\n }\n ],\n \"count\": 2,\n \"authType\": \"apikey\"\n}\n```","2025-11-25T14:46:36.714Z","2026-07-07T16:13:16.821Z","f6c24769-32d9-49c3-8316-63c770bc26cc",[],[],[],"Get all automations for a task - Comp AI - Documentation","get-all-automations-for-a-task-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/task-automations/get-all-automations-for-a-task","# Get all automations for a task - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nUnique task identifier\n\nExample:\n\n`\"tsk_abc123def456\"`\n\n#### Response\n\nAutomations retrieved successfully","2025-11-25T14:46:35.220Z","2026-07-07T16:13:16.820Z","4a98755e-4a57-4b56-82c7-64a45490253b",[],[],[],"Get all automation runs for a task - Comp AI - Documentation","get-all-automation-runs-for-a-task-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/task-automations/get-all-automation-runs-for-a-task","# Get all automation runs for a task - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nTask ID\n\nExample:\n\n`\"tsk_abc123def456\"`\n\n#### Response\n\nAutomation runs retrieved successfully\n\nExample:\n\n`\"ear_abc123def456\"`\n\nAvailable options\n\n:\n\n`PENDING`,\n\n`RUNNING`,\n\n`COMPLETED`,\n\n`FAILED`\n\nAvailable options\n\n:\n\n`MANUAL`,\n\n`SCHEDULED`,\n\n`EVENT`","2025-11-25T14:46:35.496Z","2026-07-07T16:13:16.819Z","6e5e70ff-c328-4340-9b6b-14a69a67cdd5",[],[],[],"Get access request details - Comp AI - Documentation","get-access-request-details-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/trust-access/get-access-request-details","# Get access request details - Comp AI\n\n[Skip to main content](https://trycomp.ai/docs/api-reference/trust-access/get-access-request-details#content-area)\n\n[Comp AI - Documentation home page![light logo](https://mintcdn.com/bubbaaiinc/K62d4Im87dsqHChw/logo/compai-white.png?fit=max&auto=format&n=K62d4Im87dsqHChw&q=85&s=474d8b432f94b87ab4b32f18061dce83)![dark logo](https://mintcdn.com/bubbaaiinc/K62d4Im87dsqHChw/logo/compai-dark.png?fit=max&auto=format&n=K62d4Im87dsqHChw&q=85&s=abe217a77ac02bd308c8b8e5d77e1b13)](https://trycomp.ai/docs)\n\n[Guides](https://trycomp.ai/docs/introduction)[Cloud Tests](https://trycomp.ai/docs/cloud-tests)[API](https://trycomp.ai/docs/api-reference/organization/get-organization-information)\n\n* [Join us on Discord](https://discord.gg/compai)\n\n##### Organization\n\n* [GET\n \n Get organization information\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/get-organization-information)\n* [DEL\n \n Delete organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/delete-organization)\n* [PATCH\n \n Update organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/update-organization)\n\n##### People\n\n* [GET\n \n Get all people\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/get-all-people)\n* [POST\n \n Create a new member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/create-a-new-member)\n* [POST\n \n Add multiple members to organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/add-multiple-members-to-organization)\n* [GET\n \n Get person by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/get-person-by-id)\n* [DEL\n \n Delete member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/delete-member)\n* [PATCH\n \n Update member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/update-member)\n\n##### Risks\n\n* [GET\n \n Get all risks\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/get-all-risks)\n* [POST\n \n Create a new risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/create-a-new-risk)\n* [GET\n \n Get risk by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/get-risk-by-id)\n* [DEL\n \n Delete risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/delete-risk)\n* [PATCH\n \n Update risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/update-risk)\n\n##### Vendors\n\n* [GET\n \n Get all vendors\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/get-all-vendors)\n* [POST\n \n Create a new vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/create-a-new-vendor)\n* [GET\n \n Get vendor by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/get-vendor-by-id)\n* [DEL\n \n Delete vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/delete-vendor)\n* [PATCH\n \n Update vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/update-vendor)\n\n##### Context\n\n* [GET\n \n Get all context entries\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/get-all-context-entries)\n* [POST\n \n Create a new context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/create-a-new-context-entry)\n* [GET\n \n Get context entry by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/get-context-entry-by-id)\n* [DEL\n \n Delete context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/delete-context-entry)\n* [PATCH\n \n Update context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/update-context-entry)\n\n##### Devices\n\n* [GET\n \n Get all devices\n \n \n \n ](https://trycomp.ai/docs/api-reference/devices/get-all-devices)\n* [GET\n \n Get devices by member ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/devices/get-devices-by-member-id)\n\n##### Policies\n\n* [GET\n \n Get all policies\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/get-all-policies)\n* [POST\n \n Create a new policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/create-a-new-policy)\n* [GET\n \n Get policy by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/get-policy-by-id)\n* [DEL\n \n Delete policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/delete-policy)\n* [PATCH\n \n Update policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/update-policy)\n\n##### Device Agent\n\n* [GET\n \n Download macOS Device Agent\n \n \n \n ](https://trycomp.ai/docs/api-reference/device-agent/download-macos-device-agent)\n* [GET\n \n Download Windows Device Agent ZIP\n \n \n \n ](https://trycomp.ai/docs/api-reference/device-agent/download-windows-device-agent-zip)\n\n##### Attachments\n\n* [GET\n \n Get attachment download URL\n \n \n \n ](https://trycomp.ai/docs/api-reference/attachments/get-attachment-download-url)\n\n##### Tasks\n\n* [GET\n \n Get all tasks\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-all-tasks)\n* [GET\n \n Get task by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-task-by-id)\n* [GET\n \n Get task attachments\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-task-attachments)\n* [POST\n \n Upload attachment to task\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/upload-attachment-to-task)\n* [GET\n \n Get attachment download URL\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-attachment-download-url)\n* [DEL\n \n Delete task attachment\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/delete-task-attachment)\n\n##### Task Automations\n\n* [GET\n \n Get all automations for a task\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-automations-for-a-task)\n* [POST\n \n Create a new evidence automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/create-a-new-evidence-automation)\n* [GET\n \n Get automation details\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-automation-details)\n* [DEL\n \n Delete an automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/delete-an-automation)\n* [PATCH\n \n Update an existing automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/update-an-existing-automation)\n* [GET\n \n Get all versions for an automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-versions-for-an-automation)\n* [GET\n \n Get all automation runs for a task\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-automation-runs-for-a-task)\n\n##### Comments\n\n* [GET\n \n Get comments for an entity\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/get-comments-for-an-entity)\n* [POST\n \n Create a new comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/create-a-new-comment)\n* [PUT\n \n Update a comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/update-a-comment)\n* [DEL\n \n Delete a comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/delete-a-comment)\n\n##### Health\n\n* [GET\n \n Health check\n \n \n \n ](https://trycomp.ai/docs/api-reference/health/health-check)\n\n##### Trust Portal\n\n* [GET\n \n Get domain verification status\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-portal/get-domain-verification-status)\n\n##### Trust Access\n\n* [POST\n \n Submit data access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/submit-data-access-request)\n* [GET\n \n List access requests\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-access-requests)\n* [GET\n \n Get access request details\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-access-request-details)\n* [POST\n \n Approve access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/approve-access-request)\n* [POST\n \n Deny access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/deny-access-request)\n* [GET\n \n List access grants\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-access-grants)\n* [POST\n \n Revoke access grant\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/revoke-access-grant)\n* [GET\n \n Get NDA details by token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-nda-details-by-token)\n* [POST\n \n Preview NDA by token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/preview-nda-by-token)\n* [POST\n \n Sign NDA\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/sign-nda)\n* [POST\n \n Resend NDA email\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/resend-nda-email)\n* [POST\n \n Preview NDA PDF\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/preview-nda-pdf)\n* [POST\n \n Reclaim access\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/reclaim-access)\n* [GET\n \n Get grant data by access token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-grant-data-by-access-token)\n* [GET\n \n List policies by access token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-policies-by-access-token)\n* [GET\n \n Download all policies as watermarked PDF\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/download-all-policies-as-watermarked-pdf)\n\n##### Framework Editor Task Templates\n\n* [GET\n \n Get all framework editor task templates\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/get-all-framework-editor-task-templates)\n* [GET\n \n Get framework editor task template by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/get-framework-editor-task-template-by-id)\n* [DEL\n \n Delete framework editor task template\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/delete-framework-editor-task-template)\n* [PATCH\n \n Update framework editor task template\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/update-framework-editor-task-template)\n\nGet access request details\n\n```\ncurl --request GET \\\n --url https://api.trycomp.ai/v1/trust-access/admin/requests/{id} \\\n --header 'X-API-Key: ' \\\n --header 'X-Organization-Id: '\n```\n\nTrust Access\n\nGet detailed information about a specific access request\n\nGET\n\n/\n\nv1\n\n/\n\ntrust-access\n\n/\n\nadmin\n\n/\n\nrequests\n\n/\n\n{id}\n\nGet access request details\n\n```\ncurl --request GET \\\n --url https://api.trycomp.ai/v1/trust-access/admin/requests/{id} \\\n --header 'X-API-Key: ' \\\n --header 'X-Organization-Id: '\n```\n\n#### Authorizations\n\n[](https://trycomp.ai/docs/api-reference/trust-access/get-access-request-details#authorization-x-api-key)\n\nX-API-Key\n\nstring\n\nheader\n\nrequired\n\nAPI key for authentication\n\n#### Headers\n\n[](https://trycomp.ai/docs/api-reference/trust-access/get-access-request-details#parameter-x-organization-id)\n\nX-Organization-Id\n\nstring\n\nrequired\n\nOrganization ID\n\n#### Path Parameters\n\n[](https://trycomp.ai/docs/api-reference/trust-access/get-access-request-details#parameter-id)\n\nid\n\nstring\n\nrequired\n\n#### Response\n\n200\n\nRequest details returned\n\nWas this page helpful?\n\n[List access requests](https://trycomp.ai/docs/api-reference/trust-access/list-access-requests)[Approve access request](https://trycomp.ai/docs/api-reference/trust-access/approve-access-request)\n\n⌘I","2025-11-25T14:41:40.063Z","2026-07-07T16:13:16.818Z","f8400c34-c7bf-46ef-bf51-cf0f004b7913",[],[],[],"GCP Cloud Tests - Comp AI - Documentation","gcp-cloud-tests-comp-ai-documentation","https://trycomp.ai/docs/cloud-tests/gcp","\nThe Google Cloud Platform (GCP) Cloud Test allows you to connect your GCP projects to Comp AI for automated compliance monitoring and risk assessment. Comp AI connects over OAuth 2.0 and reads findings from Security Command Center (SCC). No service account JSON key is required — you sign in with a Google account that has access to the organization and projects you want to monitor.\n\n## Setup Process\n\n### Prerequisites\n\nBefore setting up the Cloud Test, ensure you have:\n\n- A GCP organization with **Security Command Center enabled** — confirm at GCP Console → Security → Risk Overview\n- A Google account with **roles/securitycenter.findingsViewer** on the organization and **roles/viewer** (or equivalent) on the projects you want to scan\n- Permission to enable APIs on at least one project in the organization\n- Admin access to your Comp AI workspace\n\n### Connect GCP\n\n1. **Start the connection** — In Comp AI, go to Cloud Tests → GCP → Connect. Click **Sign in with Google**.\n2. **Authorize with Google** — Sign in with a Google account that meets the prerequisites above and approve the consent screen. Comp AI stores the resulting refresh token (never the password) so it can run scheduled scans.\n3. **Select projects** — Comp AI auto-detects your organization and lists the projects that account can access. Pick the ones you want scanned.\n4. **Let auto-setup run** — Comp AI's setup guide runs automatically and shows a checklist: Connected via OAuth, Organization detected, Required APIs enabled (Security Command Center, Cloud Resource Manager, Service Usage), and roles/securitycenter.findingsViewer granted at the organization level. Any step that fails is shown with a one-click Resolve button or a link to the GCP console page to fix it manually.\n5. **Run your first scan** — When all required steps pass, the first scan starts automatically. You can re-run it any time from the connection's page.\n\n## Capabilities\n\n# \n\n### Security Tests\n\n# \n\nThe GCP Cloud Test performs the following security assessments via Security Command Center:\n\n| Test Category | Description |\n| --- | --- |\n| IAM Analysis | Review IAM roles, over-privileged accounts, and service account keys |\n| GCS Security | Identify improperly configured bucket permissions and encryption |\n| Compute Security | Analyze Compute Engine and GKE configurations |\n| Database Security | Check Cloud SQL, BigQuery, and other database security settings |\n| Network | Assess VPC configurations, firewall rules, and Cloud Armor settings |\n| Cloud Logging | Verify proper logging and monitoring configuration |\n| KMS | Validate encryption key usage and rotation policies |\n| DNS | Cloud DNS and DNSSEC configuration |\n\n### Compliance Frameworks\n\n# \n\nThe Cloud Test checks compliance against:\n\n- CIS GCP Foundations Benchmark\n- SOC 2\n- HIPAA (where applicable)\n- PCI DSS\n- GDPR\n- ISO 27001\n\n## Managing Access\n\n### How Access Works\n\nComp AI connects via OAuth 2.0 with Google using the cloud-platform scope. Refresh tokens are stored in an encrypted vault so scans can run on a schedule without re-prompting. Actual access is gated by the IAM roles assigned to the signed-in account — Comp AI only makes read calls.\n\n### Required Permissions\n\n- **roles/securitycenter.findingsViewer** at the organization level (required to read SCC findings)\n- **roles/viewer** (or equivalent) at the project level (recommended)\n\nThe integration does NOT have permissions to:\n\n- Modify any resources\n- Create new resources\n- Delete existing resources\n\n### Revoking Access\n\nYou can revoke access at any time by removing the IAM role, revoking the token at myaccount.google.com/permissions, or deleting the connection in Comp AI.\n\n## Troubleshooting\n\n# \n\n**Issue: Security Command Center findings not appearing**\\\nSolution: Confirm SCC is enabled at the organization level (not just one project). Open GCP Console → Security → Risk Overview and check that the organization shows findings.\n\n**Issue: Setup step — roles/securitycenter.findingsViewer cannot be granted**\\\nSolution: The signed-in account does not have permission to manage IAM at the organization level. Ask a GCP organization admin to grant roles/securitycenter.findingsViewer to the account you connected with.\n\n**Issue: APIs could not be enabled**\\\nSolution: The signed-in account lacks the serviceusage.services.enable permission. Either sign in with an account that has roles/serviceusage.serviceUsageAdmin, or enable these APIs manually from the API Library: Security Command Center API, Cloud Resource Manager API, Service Usage API.\n\n**Issue: No projects listed after OAuth**\\\nSolution: Comp AI only lists projects the signed-in account has IAM access to. Sign in with a different Google account, or ask an admin to add your account as roles/viewer on the relevant projects.\n\n## Support\n\nFor additional assistance with your GCP integration:\n\n- Check our Knowledge Base\n- Contact support at support@trycomp.ai\n- Join our Discord community for peer support","2025-12-17T15:55:07.159Z","2026-07-07T16:13:16.817Z","dd807886-8665-4b1c-a933-00a4cd2f9a64",[],[],[],"gcp-cloud-tests-comp-ai-documentation-2","https://www.trycomp.ai/docs/cloud-tests/gcp","# GCP Cloud Tests - Comp AI\n\n> ## Documentation Index\n>\n> Fetch the complete documentation index at: \n>\n> Use this file to discover all available pages before exploring further.\n\n## About the GCP integration\n\nComp AI connects to Google Cloud Platform over **OAuth 2.0** and reads findings from **Security Command Center (SCC)**. No service account JSON key is uploaded — you sign in with a Google account that has access to the organization and projects you want to monitor. After you connect, Comp AI auto-detects your organization, lets you pick projects, then runs a setup step that enables the required APIs and verifies IAM access. Findings are mapped to common frameworks (SOC 2, ISO 27001, CIS GCP Foundations, PCI DSS, HIPAA).\n\n## How access works\n\n- **Auth model**: OAuth 2.0 with Google, using the `cloud-platform` scope plus `openid`, `email`, `profile` for account identification. Refresh tokens are stored so scans can run without re-prompting.\n- **Real permissions**: The OAuth scope only enables API calls — actual access is gated by the **IAM roles** assigned to the signed-in account. Comp AI only makes read calls.\n- **Required role**: `roles/securitycenter.findingsViewer` on the **organization** (needed to read SCC findings). Project-level `roles/viewer` is also recommended.\n- **Scope**: Comp AI scans the projects you select inside the organization the signed-in account belongs to.\n\n## Prerequisites\n\nBefore connecting GCP, make sure you have:\n\n1. A **GCP organization** with **Security Command Center** enabled — confirm at **GCP Console → Security → Risk Overview**\n2. A Google account with:\n - `roles/securitycenter.findingsViewer` on the organization\n - `roles/viewer` (or equivalent) on the projects you want to scan\n3. Permission to enable APIs on at least one project in the organization (so Comp AI’s setup step can enable SCC, Cloud Resource Manager, and Service Usage APIs if they are not already on)\n4. Admin access to your Comp AI workspace\n\n## Connect GCP\n\n1\n\n2\n\n3\n\n4\n\n5\n\n## What gets scanned\n\nComp AI consumes findings from Security Command Center across services including:\n\n| Area | Services |\n| ------------- | ---------------------------------------------------- |\n| Identity | IAM (over-privileged accounts, service account keys) |\n| Storage | Cloud Storage (ACLs, public access, encryption) |\n| Compute | Compute Engine, GKE |\n| Network | VPC Network (firewall rules, flow logs), Cloud Armor |\n| Data | Cloud SQL, BigQuery, Pub/Sub |\n| Cryptography | Cloud KMS |\n| Observability | Cloud Logging, Cloud Monitoring |\n| DNS | Cloud DNS (DNSSEC) |\n\nThe **Services** tab inside the connection lets you enable or disable specific check categories.\n\n## Compliance frameworks\n\nFindings are mapped to the controls used by:\n\n- CIS GCP Foundations Benchmark\n- SOC 2\n- ISO 27001\n- PCI DSS\n- HIPAA (where applicable)\n\n## Security model\n\n- **Read-only in practice** — Comp AI only issues read API calls against SCC and resource manager\n- **IAM-bounded** — access is limited to what the signed-in account’s IAM roles permit\n- **Token storage** — refresh tokens are stored in an encrypted vault; they are never returned to the UI\n- **Revocable at any time** — remove the IAM role, revoke the token at [myaccount.google.com/permissions](https://myaccount.google.com/permissions), or delete the connection in Comp AI\n\n## Troubleshooting\n\nSecurity Command Center findings not appearing\n\nConfirm SCC is enabled at the organization level (not just one project). Open **GCP Console → Security → Risk Overview** and check that the organization shows findings.\n\nSetup step: 'roles/securitycenter.findingsViewer' cannot be granted\n\nThe signed-in account does not have permission to manage IAM at the organization level. Ask a GCP organization admin to grant `roles/securitycenter.findingsViewer` to the account (or service account) you connected with. Copy the email shown in the setup guide — that is exactly who needs the role.\n\nSetup step: APIs could not be enabled\n\nThe signed-in account lacks the `serviceusage.services.enable` permission on the target project. Either sign in with an account that has `roles/serviceusage.serviceUsageAdmin` on the project, or enable the three APIs manually from the [API Library](https://console.cloud.google.com/apis/library):\n\n- Security Command Center API\n- Cloud Resource Manager API\n- Service Usage API\n\nNo projects listed after OAuth\n\nComp AI only lists projects the signed-in account has IAM access to. Sign in with a different Google account, or ask an admin to add your account as `roles/viewer` on the relevant projects.\n\n## Support\n\n1. Email \n2. Join our [Discord community](https://discord.gg/compai)\n","2026-05-19T19:45:06.995Z","2026-07-07T16:13:16.812Z","3c5a867e-af1a-4ae3-87d8-c1bd43098289",[],[],[],"Download all policies as watermarked PDF - Comp AI - Documentation","download-all-policies-as-watermarked-pdf-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/trust-access/download-all-policies-as-watermarked-pdf","# Download all policies as watermarked PDF - Comp AI\n\n[Skip to main content](https://trycomp.ai/docs/api-reference/trust-access/download-all-policies-as-watermarked-pdf#content-area)\n\n[Comp AI - Documentation home page![light logo](https://mintcdn.com/bubbaaiinc/K62d4Im87dsqHChw/logo/compai-white.png?fit=max&auto=format&n=K62d4Im87dsqHChw&q=85&s=474d8b432f94b87ab4b32f18061dce83)![dark logo](https://mintcdn.com/bubbaaiinc/K62d4Im87dsqHChw/logo/compai-dark.png?fit=max&auto=format&n=K62d4Im87dsqHChw&q=85&s=abe217a77ac02bd308c8b8e5d77e1b13)](https://trycomp.ai/docs)\n\n[Guides](https://trycomp.ai/docs/introduction)[Cloud Tests](https://trycomp.ai/docs/cloud-tests)[API](https://trycomp.ai/docs/api-reference/organization/get-organization-information)\n\n* [Join us on Discord](https://discord.gg/compai)\n\n##### Organization\n\n* [GET\n \n Get organization information\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/get-organization-information)\n* [DEL\n \n Delete organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/delete-organization)\n* [PATCH\n \n Update organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/update-organization)\n\n##### People\n\n* [GET\n \n Get all people\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/get-all-people)\n* [POST\n \n Create a new member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/create-a-new-member)\n* [POST\n \n Add multiple members to organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/add-multiple-members-to-organization)\n* [GET\n \n Get person by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/get-person-by-id)\n* [DEL\n \n Delete member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/delete-member)\n* [PATCH\n \n Update member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/update-member)\n\n##### Risks\n\n* [GET\n \n Get all risks\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/get-all-risks)\n* [POST\n \n Create a new risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/create-a-new-risk)\n* [GET\n \n Get risk by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/get-risk-by-id)\n* [DEL\n \n Delete risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/delete-risk)\n* [PATCH\n \n Update risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/update-risk)\n\n##### Vendors\n\n* [GET\n \n Get all vendors\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/get-all-vendors)\n* [POST\n \n Create a new vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/create-a-new-vendor)\n* [GET\n \n Get vendor by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/get-vendor-by-id)\n* [DEL\n \n Delete vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/delete-vendor)\n* [PATCH\n \n Update vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/update-vendor)\n\n##### Context\n\n* [GET\n \n Get all context entries\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/get-all-context-entries)\n* [POST\n \n Create a new context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/create-a-new-context-entry)\n* [GET\n \n Get context entry by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/get-context-entry-by-id)\n* [DEL\n \n Delete context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/delete-context-entry)\n* [PATCH\n \n Update context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/update-context-entry)\n\n##### Devices\n\n* [GET\n \n Get all devices\n \n \n \n ](https://trycomp.ai/docs/api-reference/devices/get-all-devices)\n* [GET\n \n Get devices by member ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/devices/get-devices-by-member-id)\n\n##### Policies\n\n* [GET\n \n Get all policies\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/get-all-policies)\n* [POST\n \n Create a new policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/create-a-new-policy)\n* [GET\n \n Get policy by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/get-policy-by-id)\n* [DEL\n \n Delete policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/delete-policy)\n* [PATCH\n \n Update policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/update-policy)\n\n##### Device Agent\n\n* [GET\n \n Download macOS Device Agent\n \n \n \n ](https://trycomp.ai/docs/api-reference/device-agent/download-macos-device-agent)\n* [GET\n \n Download Windows Device Agent ZIP\n \n \n \n ](https://trycomp.ai/docs/api-reference/device-agent/download-windows-device-agent-zip)\n\n##### Attachments\n\n* [GET\n \n Get attachment download URL\n \n \n \n ](https://trycomp.ai/docs/api-reference/attachments/get-attachment-download-url)\n\n##### Tasks\n\n* [GET\n \n Get all tasks\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-all-tasks)\n* [GET\n \n Get task by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-task-by-id)\n* [GET\n \n Get task attachments\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-task-attachments)\n* [POST\n \n Upload attachment to task\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/upload-attachment-to-task)\n* [GET\n \n Get attachment download URL\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-attachment-download-url)\n* [DEL\n \n Delete task attachment\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/delete-task-attachment)\n\n##### Task Automations\n\n* [GET\n \n Get all automations for a task\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-automations-for-a-task)\n* [POST\n \n Create a new evidence automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/create-a-new-evidence-automation)\n* [GET\n \n Get automation details\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-automation-details)\n* [DEL\n \n Delete an automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/delete-an-automation)\n* [PATCH\n \n Update an existing automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/update-an-existing-automation)\n* [GET\n \n Get all versions for an automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-versions-for-an-automation)\n* [GET\n \n Get all automation runs for a task\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-automation-runs-for-a-task)\n\n##### Comments\n\n* [GET\n \n Get comments for an entity\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/get-comments-for-an-entity)\n* [POST\n \n Create a new comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/create-a-new-comment)\n* [PUT\n \n Update a comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/update-a-comment)\n* [DEL\n \n Delete a comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/delete-a-comment)\n\n##### Health\n\n* [GET\n \n Health check\n \n \n \n ](https://trycomp.ai/docs/api-reference/health/health-check)\n\n##### Trust Portal\n\n* [GET\n \n Get domain verification status\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-portal/get-domain-verification-status)\n\n##### Trust Access\n\n* [POST\n \n Submit data access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/submit-data-access-request)\n* [GET\n \n List access requests\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-access-requests)\n* [GET\n \n Get access request details\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-access-request-details)\n* [POST\n \n Approve access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/approve-access-request)\n* [POST\n \n Deny access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/deny-access-request)\n* [GET\n \n List access grants\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-access-grants)\n* [POST\n \n Revoke access grant\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/revoke-access-grant)\n* [GET\n \n Get NDA details by token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-nda-details-by-token)\n* [POST\n \n Preview NDA by token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/preview-nda-by-token)\n* [POST\n \n Sign NDA\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/sign-nda)\n* [POST\n \n Resend NDA email\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/resend-nda-email)\n* [POST\n \n Preview NDA PDF\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/preview-nda-pdf)\n* [POST\n \n Reclaim access\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/reclaim-access)\n* [GET\n \n Get grant data by access token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-grant-data-by-access-token)\n* [GET\n \n List policies by access token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-policies-by-access-token)\n* [GET\n \n Download all policies as watermarked PDF\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/download-all-policies-as-watermarked-pdf)\n\n##### Framework Editor Task Templates\n\n* [GET\n \n Get all framework editor task templates\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/get-all-framework-editor-task-templates)\n* [GET\n \n Get framework editor task template by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/get-framework-editor-task-template-by-id)\n* [DEL\n \n Delete framework editor task template\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/delete-framework-editor-task-template)\n* [PATCH\n \n Update framework editor task template\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/update-framework-editor-task-template)\n\nDownload all policies as watermarked PDF\n\n```\ncurl --request GET \\\n --url https://api.trycomp.ai/v1/trust-access/access/{token}/policies/download-all\n```\n\nTrust Access\n\nGenerate combined PDF from all published policy content with watermark\n\nGET\n\n/\n\nv1\n\n/\n\ntrust-access\n\n/\n\naccess\n\n/\n\n{token}\n\n/\n\npolicies\n\n/\n\ndownload-all\n\nDownload all policies as watermarked PDF\n\n```\ncurl --request GET \\\n --url https://api.trycomp.ai/v1/trust-access/access/{token}/policies/download-all\n```\n\n#### Path Parameters\n\n[](https://trycomp.ai/docs/api-reference/trust-access/download-all-policies-as-watermarked-pdf#parameter-token)\n\ntoken\n\nstring\n\nrequired\n\n#### Response\n\n200\n\nDownload URL for watermarked PDF returned\n\nWas this page helpful?\n\n[List policies by access token](https://trycomp.ai/docs/api-reference/trust-access/list-policies-by-access-token)[Get all framework editor task templates](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/get-all-framework-editor-task-templates)\n\n⌘I","2025-11-25T14:46:30.559Z","2026-07-07T16:13:16.811Z","671e481f-17cc-4f53-b4c0-52964bf91da5",[],[],[],"Deny access request - Comp AI - Documentation","deny-access-request-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/trust-access/deny-access-request","# Deny access request - Comp AI\n\n* [Join us on Discord](https://discord.gg/compai)\n\n##### Organization\n\n* [GET\n \n Get organization information\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/get-organization-information)\n* [DEL\n \n Delete organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/delete-organization)\n* [PATCH\n \n Update organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/update-organization)\n\n##### People\n\n* [GET\n \n Get all people\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/get-all-people)\n* [POST\n \n Create a new member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/create-a-new-member)\n* [POST\n \n Add multiple members to organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/add-multiple-members-to-organization)\n* [GET\n \n Get person by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/get-person-by-id)\n* [DEL\n \n Delete member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/delete-member)\n* [PATCH\n \n Update member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/update-member)\n\n##### Risks\n\n* [GET\n \n Get all risks\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/get-all-risks)\n* [POST\n \n Create a new risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/create-a-new-risk)\n* [GET\n \n Get risk by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/get-risk-by-id)\n* [DEL\n \n Delete risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/delete-risk)\n* [PATCH\n \n Update risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/update-risk)\n\n##### Vendors\n\n* [GET\n \n Get all vendors\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/get-all-vendors)\n* [POST\n \n Create a new vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/create-a-new-vendor)\n* [GET\n \n Get vendor by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/get-vendor-by-id)\n* [DEL\n \n Delete vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/delete-vendor)\n* [PATCH\n \n Update vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/update-vendor)\n\n##### Context\n\n* [GET\n \n Get all context entries\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/get-all-context-entries)\n* [POST\n \n Create a new context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/create-a-new-context-entry)\n* [GET\n \n Get context entry by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/get-context-entry-by-id)\n* [DEL\n \n Delete context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/delete-context-entry)\n* [PATCH\n \n Update context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/update-context-entry)\n\n##### Devices\n\n* [GET\n \n Get all devices\n \n \n \n ](https://trycomp.ai/docs/api-reference/devices/get-all-devices)\n* [GET\n \n Get devices by member ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/devices/get-devices-by-member-id)\n\n##### Policies\n\n* [GET\n \n Get all policies\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/get-all-policies)\n* [POST\n \n Create a new policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/create-a-new-policy)\n* [GET\n \n Get policy by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/get-policy-by-id)\n* [DEL\n \n Delete policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/delete-policy)\n* [PATCH\n \n Update policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/update-policy)\n\n##### Device Agent\n\n* [GET\n \n Download macOS Device Agent\n \n \n \n ](https://trycomp.ai/docs/api-reference/device-agent/download-macos-device-agent)\n* [GET\n \n Download Windows Device Agent ZIP\n \n \n \n ](https://trycomp.ai/docs/api-reference/device-agent/download-windows-device-agent-zip)\n\n##### Attachments\n\n* [GET\n \n Get attachment download URL\n \n \n \n ](https://trycomp.ai/docs/api-reference/attachments/get-attachment-download-url)\n\n##### Tasks\n\n* [GET\n \n Get all tasks\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-all-tasks)\n* [GET\n \n Get task by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-task-by-id)\n* [GET\n \n Get task attachments\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-task-attachments)\n* [POST\n \n Upload attachment to task\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/upload-attachment-to-task)\n* [GET\n \n Get attachment download URL\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-attachment-download-url)\n* [DEL\n \n Delete task attachment\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/delete-task-attachment)\n\n##### Task Automations\n\n* [GET\n \n Get all automations for a task\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-automations-for-a-task)\n* [POST\n \n Create a new evidence automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/create-a-new-evidence-automation)\n* [GET\n \n Get automation details\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-automation-details)\n* [DEL\n \n Delete an automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/delete-an-automation)\n* [PATCH\n \n Update an existing automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/update-an-existing-automation)\n* [GET\n \n Get all versions for an automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-versions-for-an-automation)\n* [GET\n \n Get all automation runs for a task\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-automation-runs-for-a-task)\n\n##### Comments\n\n* [GET\n \n Get comments for an entity\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/get-comments-for-an-entity)\n* [POST\n \n Create a new comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/create-a-new-comment)\n* [PUT\n \n Update a comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/update-a-comment)\n* [DEL\n \n Delete a comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/delete-a-comment)\n\n##### Health\n\n* [GET\n \n Health check\n \n \n \n ](https://trycomp.ai/docs/api-reference/health/health-check)\n\n##### Trust Portal\n\n* [GET\n \n Get domain verification status\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-portal/get-domain-verification-status)\n\n##### Trust Access\n\n* [POST\n \n Submit data access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/submit-data-access-request)\n* [GET\n \n List access requests\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-access-requests)\n* [GET\n \n Get access request details\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-access-request-details)\n* [POST\n \n Approve access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/approve-access-request)\n* [POST\n \n Deny access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/deny-access-request)\n* [GET\n \n List access grants\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-access-grants)\n* [POST\n \n Revoke access grant\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/revoke-access-grant)\n* [GET\n \n Get NDA details by token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-nda-details-by-token)\n* [POST\n \n Preview NDA by token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/preview-nda-by-token)\n* [POST\n \n Sign NDA\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/sign-nda)\n* [POST\n \n Resend NDA email\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/resend-nda-email)\n* [POST\n \n Preview NDA PDF\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/preview-nda-pdf)\n* [POST\n \n Reclaim access\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/reclaim-access)\n* [GET\n \n Get grant data by access token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-grant-data-by-access-token)\n* [GET\n \n List policies by access token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-policies-by-access-token)\n* [GET\n \n Download all policies as watermarked PDF\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/download-all-policies-as-watermarked-pdf)\n\n##### Framework Editor Task Templates\n\n* [GET\n \n Get all framework editor task templates\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/get-all-framework-editor-task-templates)\n* [GET\n \n Get framework editor task template by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/get-framework-editor-task-template-by-id)\n* [DEL\n \n Delete framework editor task template\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/delete-framework-editor-task-template)\n* [PATCH\n \n Update framework editor task template\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/update-framework-editor-task-template)\n\nDeny access request\n\n```\ncurl --request POST \\\n --url https://api.trycomp.ai/v1/trust-access/admin/requests/{id}/deny \\\n --header 'Content-Type: application/json' \\\n --header 'X-API-Key: ' \\\n --header 'X-Organization-Id: ' \\\n --data '{\n \"reason\": \"\"\n}'\n```\n\nTrust Access\n\nReject access request with reason\n\nPOST\n\n/\n\nv1\n\n/\n\ntrust-access\n\n/\n\nadmin\n\n/\n\nrequests\n\n/\n\n{id}\n\n/\n\ndeny\n\nDeny access request\n\n```\ncurl --request POST \\\n --url https://api.trycomp.ai/v1/trust-access/admin/requests/{id}/deny \\\n --header 'Content-Type: application/json' \\\n --header 'X-API-Key: ' \\\n --header 'X-Organization-Id: ' \\\n --data '{\n \"reason\": \"\"\n}'\n```\n\n#### Authorizations\n\n[](https://trycomp.ai/docs/api-reference/trust-access/deny-access-request#authorization-x-api-key)\n\nX-API-Key\n\nstring\n\nheader\n\nrequired\n\nAPI key for authentication\n\n#### Headers\n\n[](https://trycomp.ai/docs/api-reference/trust-access/deny-access-request#parameter-x-organization-id)\n\nX-Organization-Id\n\nstring\n\nrequired\n\nOrganization ID\n\n#### Path Parameters\n\n[](https://trycomp.ai/docs/api-reference/trust-access/deny-access-request#parameter-id)\n\nid\n\nstring\n\nrequired\n\n#### Body\n\napplication/json\n\n[](https://trycomp.ai/docs/api-reference/trust-access/deny-access-request#body-reason)\n\nreason\n\nstring\n\nrequired\n\n#### Response\n\n200\n\nRequest denied\n\nWas this page helpful?\n\n[Approve access request](https://trycomp.ai/docs/api-reference/trust-access/approve-access-request)[List access grants](https://trycomp.ai/docs/api-reference/trust-access/list-access-grants)\n\n⌘I","2025-11-25T14:41:42.341Z","2026-07-07T16:13:16.792Z","b7a0e0eb-b5c7-4225-918b-ecb3e5f8473e",[],[],[],"Delete vendor - Comp AI - Documentation","delete-vendor-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/vendors/delete-vendor","# Delete vendor - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nVendor ID\n\nExample:\n\n`\"vnd_abc123def456\"`\n\n#### Response\n\nVendor deleted successfully\n\nExample:\n\n`\"Vendor deleted successfully\"`\n\nHide child attributes\n\nDeleted vendor ID\n\nExample:\n\n`\"vnd_abc123def456\"`\n\nDeleted vendor name\n\nExample:\n\n`\"CloudTech Solutions Inc.\"`\n\nHow the request was authenticated\n\nAvailable options\n\n:\n\n`api-key`,\n\n`session`\n\nUser information (only for session auth)\n\nHide child attributes\n\nExample:\n\n`\"usr_def456ghi789\"`\n\nExample:\n\n`\"user@example.com\"`","2025-11-25T14:46:39.899Z","2026-07-07T16:13:16.791Z","054a50a0-ddf7-4359-b98d-40f7ef543bbb",[],[],[],"Delete task attachment - Comp AI - Documentation","delete-task-attachment-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/tasks/delete-task-attachment","# Delete task attachment - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nUnique task identifier\n\nExample:\n\n`\"tsk_abc123def456\"`\n\nUnique attachment identifier\n\nExample:\n\n`\"att_abc123def456\"`\n\n#### Response\n\nAttachment deleted successfully\n\nExample:\n\n`\"att_abc123def456\"`\n\nExample:\n\n`\"Attachment deleted successfully\"`","2025-11-25T14:46:34.810Z","2026-07-07T16:13:16.790Z","665fd310-dcc6-4af0-9007-8c3609828111",[],[],[],"Delete risk - Comp AI - Documentation","delete-risk-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/risks/delete-risk","# Delete risk - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nRisk ID\n\nExample:\n\n`\"rsk_abc123def456\"`\n\n#### Response\n\nRisk deleted successfully\n\nExample:\n\n`\"Risk deleted successfully\"`\n\nHide child attributes\n\nDeleted risk ID\n\nExample:\n\n`\"rsk_abc123def456\"`\n\nDeleted risk title\n\nExample:\n\n`\"Data breach vulnerability in user authentication system\"`\n\nHow the request was authenticated\n\nAvailable options\n\n:\n\n`api-key`,\n\n`session`\n\nUser information (only for session auth)\n\nHide child attributes\n\nExample:\n\n`\"usr_def456ghi789\"`\n\nExample:\n\n`\"user@example.com\"`","2025-11-25T14:46:40.535Z","2026-07-07T16:13:16.789Z","3667edc2-3731-42f7-ad19-7183383d8dd6",[],[],[],"Delete policy - Comp AI - Documentation","delete-policy-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/policies/delete-policy","# Delete policy - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nPolicy ID\n\nExample:\n\n`\"pol_abc123def456\"`\n\n#### Response\n\nPolicy deleted successfully\n\nIndicates successful deletion\n\nHide child attributes\n\nThe deleted policy ID\n\nExample:\n\n`\"pol_abc123def456\"`\n\nThe deleted policy name\n\nExample:\n\n`\"Data Privacy Policy\"`\n\nHow the request was authenticated\n\nAvailable options\n\n:\n\n`api-key`,\n\n`session`","2025-11-25T14:46:33.752Z","2026-07-07T16:13:16.788Z","c3436e96-15fe-4577-97cd-628f04b3c6bc",[],[],[],"Delete organization - Comp AI - Documentation","delete-organization-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/organization/delete-organization","# Delete organization - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Response\n\nOrganization deleted successfully\n\nIndicates successful deletion\n\nHow the request was authenticated\n\nAvailable options\n\n:\n\n`api-key`,\n\n`session`","2025-11-25T14:46:36.038Z","2026-07-07T16:13:16.786Z","8938b33c-d1b0-4f51-8979-edfbac21e41c",[],[],[],"Delete member - Comp AI - Documentation","delete-member-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/people/delete-member","# Delete member - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nMember ID\n\nExample:\n\n`\"mem_abc123def456\"`\n\n#### Response\n\nMember deleted successfully\n\nIndicates successful deletion\n\nHide child attributes\n\nThe deleted member ID\n\nExample:\n\n`\"mem_abc123def456\"`\n\nThe deleted member email\n\nExample:\n\n`\"john.doe@company.com\"`\n\nHow the request was authenticated\n\nAvailable options\n\n:\n\n`api-key`,\n\n`session`","2025-11-25T14:46:40.625Z","2026-07-07T16:13:16.785Z","e8d03bff-153a-45c1-aaa4-8173d714e847",[],[],[],"Delete framework editor task template - Comp AI - Documentation","delete-framework-editor-task-template-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/framework-editor-task-templates/delete-framework-editor-task-template","# Delete framework editor task template - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nFramework editor task template ID\n\nExample:\n\n`\"frk_tt_abc123def456\"`\n\n#### Response\n\nSuccessfully deleted framework editor task template\n\nThe response is of type `any`.","2025-11-25T14:46:32.280Z","2026-07-07T16:13:16.783Z","97cbd43b-623f-4a90-860d-3b1a73c077e1",[],[],[],"Delete context entry - Comp AI - Documentation","delete-context-entry-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/context/delete-context-entry","# Delete context entry - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nContext entry ID\n\nExample:\n\n`\"ctx_abc123def456\"`\n\n#### Response\n\nContext entry deleted successfully\n\nAvailable options\n\n:\n\n`api-key`,\n\n`session`","2025-11-25T14:46:36.834Z","2026-07-07T16:13:16.767Z","03f717e4-0e6d-4b69-830a-2fdc775fb1ba",[],[],[],"Delete an automation - Comp AI - Documentation","delete-an-automation-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/task-automations/delete-an-automation","# Delete an automation - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nUnique task identifier\n\nExample:\n\n`\"tsk_abc123def456\"`\n\nUnique automation identifier\n\nExample:\n\n`\"auto_abc123def456\"`\n\n#### Response\n\nAutomation deleted successfully","2025-11-25T14:46:35.415Z","2026-07-07T16:13:16.760Z","14a7eb5f-a487-4d85-a21e-86bd2e3c151e",[],[],[],"Delete a comment - Comp AI - Documentation","delete-a-comment-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/comments/delete-a-comment","# Delete a comment - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nUnique comment identifier\n\nExample:\n\n`\"cmt_abc123def456\"`\n\n#### Response\n\nComment deleted successfully\n\nExample:\n\n`\"cmt_abc123def456\"`\n\nExample:\n\n`\"Comment deleted successfully\"`","2025-11-25T14:46:35.955Z","2026-07-07T16:13:16.759Z","7d93c415-8f77-4db7-867a-42bf89b20f95",[],[],[],"Create a new vendor - Comp AI - Documentation","create-a-new-vendor-comp-ai-documentation","https://www.trycomp.ai/docs/api-reference/overview","# Create a new vendor - Comp AI\n\n[Skip to main content](https://trycomp.ai/docs/api-reference/vendors/create-a-new-vendor#content-area)\n\nAuthorizations\n\nAPI key for authentication\n\nHeaders\n\nOrganization ID (required for session auth, optional for API key auth)\n\nBody\n\nVendor name\n\nExample:\n\n`\"CloudTech Solutions Inc.\"`\n\nDetailed description of the vendor and services provided\n\nExample:\n\n`\"Cloud infrastructure provider offering AWS-like services including compute, storage, and networking solutions for enterprise customers.\"`\n\ncategory\n\nenum\n\ndefault:other\n\nrequired\n\nVendor category\n\nAvailable options\n\n:\n\n`cloud`,\n\n`infrastructure`,\n\n`software_as_a_service`,\n\n`finance`,\n\n`marketing`,\n\n`sales`,\n\n`hr`,\n\n`other`\n\nstatus\n\nenum\n\ndefault:not_assessed\n\nrequired\n\nAssessment status of the vendor\n\nAvailable options\n\n:\n\n`not_assessed`,\n\n`in_progress`,\n\n`assessed`\n\ninherentProbability\n\nenum\n\ndefault:very_unlikely\n\nrequired\n\nInherent probability of risk before controls\n\nAvailable options\n\n:\n\n`very_unlikely`,\n\n`unlikely`,\n\n`possible`,\n\n`likely`,\n\n`very_likely`\n\ninherentImpact\n\nenum\n\ndefault:insignificant\n\nrequired\n\nInherent impact of risk before controls\n\nAvailable options\n\n:\n\n`insignificant`,\n\n`minor`,\n\n`moderate`,\n\n`major`,\n\n`severe`\n\nresidualProbability\n\nenum\n\ndefault:very_unlikely\n\nrequired\n\nResidual probability after controls are applied\n\nAvailable options\n\n:\n\n`very_unlikely`,\n\n`unlikely`,\n\n`possible`,\n\n`likely`,\n\n`very_likely`\n\nresidualImpact\n\nenum\n\ndefault:insignificant\n\nrequired\n\nResidual impact after controls are applied\n\nAvailable options\n\n:\n\n`insignificant`,\n\n`minor`,\n\n`moderate`,\n\n`major`,\n\n`severe`\n\nVendor website URL\n\nExample:\n\n`\"https://www.cloudtechsolutions.com\"`\n\nID of the user assigned to manage this vendor\n\nExample:\n\n`\"mem_abc123def456\"`\n\nResponse\n\nVendor created successfully\n\nVendor ID\n\nExample:\n\n`\"vnd_abc123def456\"`\n\nVendor name\n\nExample:\n\n`\"CloudTech Solutions Inc.\"`\n\nVendor description\n\nExample:\n\n`\"Cloud infrastructure provider offering AWS-like services including compute, storage, and networking solutions for enterprise customers.\"`\n\nAvailable options\n\n:\n\n`cloud`,\n\n`infrastructure`,\n\n`software_as_a_service`,\n\n`finance`,\n\n`marketing`,\n\n`sales`,\n\n`hr`,\n\n`other`\n\nAvailable options\n\n:\n\n`not_assessed`,\n\n`in_progress`,\n\n`assessed`\n\nAvailable options\n\n:\n\n`very_unlikely`,\n\n`unlikely`,\n\n`possible`,\n\n`likely`,\n\n`very_likely`\n\nAvailable options\n\n:\n\n`insignificant`,\n\n`minor`,\n\n`moderate`,\n\n`major`,\n\n`severe`\n\nAvailable options\n\n:\n\n`very_unlikely`,\n\n`unlikely`,\n\n`possible`,\n\n`likely`,\n\n`very_likely`\n\nAvailable options\n\n:\n\n`insignificant`,\n\n`minor`,\n\n`moderate`,\n\n`major`,\n\n`severe`\n\nExample:\n\n`\"https://www.cloudtechsolutions.com\"`\n\nExample:\n\n`\"org_abc123def456\"`\n\nID of the user assigned to manage this vendor\n\nExample:\n\n`\"mem_abc123def456\"`\n\nWhen the vendor was created\n\nWhen the vendor was last updated\n\nHow the request was authenticated\n\nAvailable options\n\n:\n\n`api-key`,\n\n`session`\n\nUser information (only for session auth)","2025-11-25T14:46:38.121Z","2026-07-07T16:01:51.842Z","89b020a0-7f38-418b-9e87-59047a627c38",[],[],[],"Create a new risk - Comp AI - Documentation","create-a-new-risk-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/risks/create-a-new-risk","# Create a new risk - Comp AI\n\n[Skip to main content](https://trycomp.ai/docs/api-reference/risks/create-a-new-risk#content-area)\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Body\n\nRisk title\n\nExample:\n\n`\"Data breach vulnerability in user authentication system\"`\n\nDetailed description of the risk\n\nExample:\n\n`\"Weak password requirements could lead to unauthorized access to user accounts\"`\n\nRisk category\n\nAvailable options\n\n:\n\n`customer`,\n\n`fraud`,\n\n`governance`,\n\n`operations`,\n\n`other`,\n\n`people`,\n\n`regulatory`,\n\n`reporting`,\n\n`resilience`,\n\n`technology`,\n\n`vendor_management`\n\nstatus\n\nenum\n\ndefault:open\n\nrequired\n\nCurrent status of the risk\n\nAvailable options\n\n:\n\n`open`,\n\n`pending`,\n\n`closed`,\n\n`archived`\n\nlikelihood\n\nenum\n\ndefault:very\\_unlikely\n\nrequired\n\nLikelihood of the risk occurring\n\nAvailable options\n\n:\n\n`very_unlikely`,\n\n`unlikely`,\n\n`possible`,\n\n`likely`,\n\n`very_likely`\n\nimpact\n\nenum\n\ndefault:insignificant\n\nrequired\n\nImpact if the risk materializes\n\nAvailable options\n\n:\n\n`insignificant`,\n\n`minor`,\n\n`moderate`,\n\n`major`,\n\n`severe`\n\nresidualLikelihood\n\nenum\n\ndefault:very\\_unlikely\n\nrequired\n\nResidual likelihood after treatment\n\nAvailable options\n\n:\n\n`very_unlikely`,\n\n`unlikely`,\n\n`possible`,\n\n`likely`,\n\n`very_likely`\n\nresidualImpact\n\nenum\n\ndefault:insignificant\n\nrequired\n\nResidual impact after treatment\n\nAvailable options\n\n:\n\n`insignificant`,\n\n`minor`,\n\n`moderate`,\n\n`major`,\n\n`severe`\n\ntreatmentStrategy\n\nenum\n\ndefault:accept\n\nrequired\n\nRisk treatment strategy\n\nAvailable options\n\n:\n\n`accept`,\n\n`avoid`,\n\n`mitigate`,\n\n`transfer`\n\nDepartment responsible for the risk\n\nAvailable options\n\n:\n\n`none`,\n\n`admin`,\n\n`gov`,\n\n`hr`,\n\n`it`,\n\n`itsm`,\n\n`qms`\n\ntreatmentStrategyDescription\n\nDescription of the treatment strategy\n\nExample:\n\n`\"Implement multi-factor authentication and strengthen password requirements\"`\n\nID of the user assigned to this risk\n\nExample:\n\n`\"mem_abc123def456\"`\n\n#### Response\n\nRisk created successfully\n\nRisk ID\n\nExample:\n\n`\"rsk_abc123def456\"`\n\nRisk title\n\nExample:\n\n`\"Data breach vulnerability in user authentication system\"`\n\nRisk description\n\nExample:\n\n`\"Weak password requirements could lead to unauthorized access to user accounts\"`\n\nAvailable options\n\n:\n\n`customer`,\n\n`governance`,\n\n`operations`,\n\n`other`,\n\n`people`,\n\n`regulatory`,\n\n`reporting`,\n\n`resilience`,\n\n`technology`,\n\n`vendor_management`\n\nAvailable options\n\n:\n\n`none`,\n\n`admin`,\n\n`gov`,\n\n`hr`,\n\n`it`,\n\n`itsm`,\n\n`qms`\n\nAvailable options\n\n:\n\n`open`,\n\n`pending`,\n\n`closed`,\n\n`archived`\n\nAvailable options\n\n:\n\n`very_unlikely`,\n\n`unlikely`,\n\n`possible`,\n\n`likely`,\n\n`very_likely`\n\nAvailable options\n\n:\n\n`insignificant`,\n\n`minor`,\n\n`moderate`,\n\n`major`,\n\n`severe`\n\nAvailable options\n\n:\n\n`very_unlikely`,\n\n`unlikely`,\n\n`possible`,\n\n`likely`,\n\n`very_likely`\n\nAvailable options\n\n:\n\n`insignificant`,\n\n`minor`,\n\n`moderate`,\n\n`major`,\n\n`severe`\n\ntreatmentStrategyDescription\n\nExample:\n\n`\"Implement multi-factor authentication and strengthen password requirements\"`\n\nAvailable options\n\n:\n\n`accept`,\n\n`avoid`,\n\n`mitigate`,\n\n`transfer`\n\nExample:\n\n`\"org_abc123def456\"`\n\nID of the user assigned to this risk\n\nExample:\n\n`\"mem_abc123def456\"`\n\nWhen the risk was created\n\nWhen the risk was last updated\n\nHow the request was authenticated\n\nAvailable options\n\n:\n\n`api-key`,\n\n`session`\n\nUser information (only for session auth)","2025-11-25T14:46:39.493Z","2026-07-07T16:01:51.841Z","ef060f7c-4247-41b4-a3de-2ca7733e60c7",[],[],[],"Create a new policy - Comp AI - Documentation","create-a-new-policy-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/policies/create-a-new-policy","# Create a new policy - Comp AI\n\n[Skip to main content](https://trycomp.ai/docs/api-reference/policies/create-a-new-policy#content-area)\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Body\n\nName of the policy\n\nExample:\n\n`\"Data Privacy Policy\"`\n\nContent of the policy as TipTap JSON (array of nodes)\n\nExample:\n\n```\n[ { \"type\": \"heading\", \"attrs\": { \"level\": 2, \"textAlign\": null }, \"content\": [{ \"type\": \"text\", \"text\": \"Purpose\" }] }, { \"type\": \"paragraph\", \"attrs\": { \"textAlign\": null }, \"content\": [ { \"type\": \"text\", \"text\": \"Verify workforce integrity and grant the right access at start, revoke at end.\" } ] }]\n```\n\nDescription of the policy\n\nExample:\n\n`\"This policy outlines how we handle and protect personal data\"`\n\nStatus of the policy\n\nAvailable options\n\n:\n\n`draft`,\n\n`published`,\n\n`needs_review`\n\nReview frequency of the policy\n\nAvailable options\n\n:\n\n`monthly`,\n\n`quarterly`,\n\n`yearly`\n\nDepartment this policy applies to\n\nAvailable options\n\n:\n\n`none`,\n\n`admin`,\n\n`gov`,\n\n`hr`,\n\n`it`,\n\n`itsm`,\n\n`qms`\n\nWhether this policy requires a signature\n\nReview date for the policy\n\nExample:\n\n`\"2024-12-31T00:00:00.000Z\"`\n\nID of the user assigned to this policy\n\nExample:\n\n`\"usr_abc123def456\"`\n\nID of the user who approved this policy\n\nExample:\n\n`\"usr_xyz789abc123\"`\n\nID of the policy template this policy is based on\n\nExample:\n\n`\"plt_template123\"`\n\nList of user IDs who have signed this policy\n\n#### Response\n\nPolicy created successfully\n\nThe policy ID\n\nExample:\n\n`\"pol_abc123def456\"`\n\nName of the policy\n\nExample:\n\n`\"Data Privacy Policy\"`\n\nDescription of the policy\n\nExample:\n\n`\"This policy outlines how we handle and protect personal data\"`\n\nStatus of the policy\n\nAvailable options\n\n:\n\n`draft`,\n\n`published`,\n\n`needs_review`\n\nContent of the policy as TipTap JSON (array of nodes)\n\nExample:\n\n```\n[ { \"type\": \"heading\", \"attrs\": { \"level\": 2, \"textAlign\": null }, \"content\": [{ \"type\": \"text\", \"text\": \"Purpose\" }] }, { \"type\": \"paragraph\", \"attrs\": { \"textAlign\": null }, \"content\": [ { \"type\": \"text\", \"text\": \"Verify workforce integrity and grant the right access at start, revoke at end.\" } ] }]\n```\n\nfrequency\n\nenum | null\n\nrequired\n\nReview frequency of the policy\n\nAvailable options\n\n:\n\n`monthly`,\n\n`quarterly`,\n\n`yearly`\n\ndepartment\n\nenum | null\n\nrequired\n\nDepartment this policy applies to\n\nAvailable options\n\n:\n\n`none`,\n\n`admin`,\n\n`gov`,\n\n`hr`,\n\n`it`,\n\n`itsm`,\n\n`qms`\n\nWhether this policy requires a signature\n\nList of user IDs who have signed this policy\n\nreviewDate\n\nstring | null\n\nrequired\n\nReview date for the policy\n\nExample:\n\n`\"2024-12-31T00:00:00.000Z\"`\n\nWhether this policy is archived\n\ncreatedAt\n\nstring\n\nrequired\n\nWhen the policy was created\n\nExample:\n\n`\"2024-01-01T00:00:00.000Z\"`\n\nupdatedAt\n\nstring\n\nrequired\n\nWhen the policy was last updated\n\nExample:\n\n`\"2024-01-15T00:00:00.000Z\"`\n\nlastArchivedAt\n\nstring | null\n\nrequired\n\nWhen the policy was last archived\n\nExample:\n\n`\"2024-02-01T00:00:00.000Z\"`\n\nlastPublishedAt\n\nstring | null\n\nrequired\n\nWhen the policy was last published\n\nExample:\n\n`\"2024-01-10T00:00:00.000Z\"`\n\nOrganization ID this policy belongs to\n\nExample:\n\n`\"org_abc123def456\"`\n\nID of the user assigned to this policy\n\nExample:\n\n`\"usr_abc123def456\"`\n\nID of the user who approved this policy\n\nExample:\n\n`\"usr_xyz789abc123\"`\n\nID of the policy template this policy is based on\n\nExample:\n\n`\"plt_template123\"`","2025-11-25T14:46:32.655Z","2026-07-07T16:01:51.840Z","7c1cef47-bc22-43cf-a685-46f0b6f64ae5",[],[],[],"Create a new member - Comp AI - Documentation","create-a-new-member-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/people/create-a-new-member","# Create a new member - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Body\n\nUser ID to associate with this member\n\nExample:\n\n`\"usr_abc123def456\"`\n\nMember department\n\nAvailable options\n\n:\n\n`none`,\n\n`admin`,\n\n`gov`,\n\n`hr`,\n\n`it`,\n\n`itsm`,\n\n`qms`\n\nFleetDM label ID for member devices\n\n#### Response\n\nMember created successfully\n\nMember ID\n\nExample:\n\n`\"mem_abc123def456\"`\n\nOrganization ID this member belongs to\n\nExample:\n\n`\"org_abc123def456\"`\n\nUser ID associated with member\n\nExample:\n\n`\"usr_abc123def456\"`\n\ncreatedAt\n\nstring\n\nrequired\n\nWhen the member was created\n\nExample:\n\n`\"2024-01-01T00:00:00Z\"`\n\nMember department\n\nAvailable options\n\n:\n\n`none`,\n\n`admin`,\n\n`gov`,\n\n`hr`,\n\n`it`,\n\n`itsm`,\n\n`qms`\n\nFleetDM label ID for member devices\n\nUser information\n\nHide child attributes\n\nUser ID\n\nExample:\n\n`\"usr_abc123def456\"`\n\nUser email\n\nExample:\n\n`\"john.doe@company.com\"`\n\nWhether email is verified\n\nUser profile image URL\n\nExample:\n\n`\"https://example.com/avatar.jpg\"`\n\nuser.createdAt\n\nstring\n\nrequired\n\nWhen the user was created\n\nExample:\n\n`\"2024-01-01T00:00:00Z\"`\n\nuser.updatedAt\n\nstring\n\nrequired\n\nWhen the user was last updated\n\nExample:\n\n`\"2024-01-15T00:00:00Z\"`\n\nLast login time\n\nExample:\n\n`\"2024-01-15T12:00:00Z\"`","2025-11-25T14:46:39.392Z","2026-07-07T16:01:51.839Z","92aa91a3-89a4-4eb4-aca7-9eddaf538605",[],[],[],"Create a new evidence automation - Comp AI - Documentation","create-a-new-evidence-automation-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/task-automations/create-a-new-evidence-automation","# Create a new evidence automation - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nUnique task identifier\n\nExample:\n\n`\"tsk_abc123def456\"`\n\n#### Response\n\nAutomation created successfully\n\nHide child attributes\n\nExample:\n\n`\"auto_abc123def456\"`\n\nExample:\n\n`\"Task Name - Evidence Collection\"`","2025-11-25T14:46:34.899Z","2d87f975-1f7b-40af-880a-4c91dbec1661",[],[],[],"Create a new context entry - Comp AI - Documentation","create-a-new-context-entry-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/context/create-a-new-context-entry","# Create a new context entry - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Body\n\nThe question or topic this context entry addresses\n\nExample:\n\n`\"How do we handle user authentication in our application?\"`\n\nThe answer or detailed explanation for the question\n\nExample:\n\n`\"We use a hybrid authentication system supporting both API keys and session-based authentication. API keys are used for programmatic access while sessions are used for web interface interactions.\"`\n\nTags to categorize and help search this context entry\n\nExample:\n\n```\n[ \"authentication\", \"security\", \"api\", \"sessions\"]\n```\n\n#### Response\n\nContext entry created successfully\n\nAvailable options\n\n:\n\n`api-key`,\n\n`session`","2025-11-25T14:46:40.728Z","2026-07-07T16:01:51.838Z","7cb2f337-f59d-4443-ace1-b1b10dd4e7fc",[],[],[],"Create a new comment - Comp AI - Documentation","create-a-new-comment-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/comments/create-a-new-comment","# Create a new comment - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Body\n\nContent of the comment\n\nMaximum length: `2000`\n\nExample:\n\n`\"This task needs to be completed by end of week\"`\n\nID of the entity to comment on\n\nExample:\n\n`\"tsk_abc123def456\"`\n\nType of entity being commented on\n\nAvailable options\n\n:\n\n`task`,\n\n`vendor`,\n\n`risk`,\n\n`policy`\n\nOptional attachments to include with the comment\n\n#### Response\n\nComment created successfully\n\nUnique identifier for the comment\n\nExample:\n\n`\"cmt_abc123def456\"`\n\nComment content\n\nExample:\n\n`\"This task needs to be completed by end of week\"`\n\nComment author information\n\nAttachment metadata (URLs generated on-demand)\n\ncreatedAt\n\nstring\n\nrequired\n\nComment creation timestamp\n\nExample:\n\n`\"2024-01-15T10:30:00Z\"`","2025-11-25T14:46:35.763Z","2026-07-07T16:01:51.837Z","400396cb-e1ea-4f85-a86e-e5dbf6fb929f",[],[],[],"Contributing Integrations - Comp AI - Documentation","contributing-integrations-comp-ai-documentation","https://trycomp.ai/docs/integrations/contributing","# Contributing Integrations - Comp AI\n\n## Before You Start\n\n**Check if the integration already exists** by looking in `packages/integration-platform/src/manifests/`. **Good integration candidates:**\n\n* Service has a public API\n* Service provides compliance/security data\n* Maps to existing compliance tasks\n* Widely used in B2B/enterprise\n\n**Not a good fit:**\n\n* Service requires paid enterprise plan for API access\n* No security/compliance data available via API\n* Consumer-focused service with no business use case\n\n## Contribution Checklist\n\nYour PR should include:\n\n### 1\\. Integration Manifest\n\n**Required:**\n\n* Manifest file (`manifests/your-service/index.ts`)\n* Valid integration ID (kebab-case, unique)\n* Clear name and description\n* Working logo URL\n* Documentation URL\n* Correct category\n* Proper auth configuration\n\n### 2\\. At Least One Check\n\n**Required:**\n\n* Check file(s) in `checks/` folder\n* Descriptive check IDs\n* Clear error messages\n* Proper error handling\n* Task mapping (if applicable)\n* Evidence includes useful data\n\n### 3\\. Types\n\n**Required:**\n\n* TypeScript types file (`types.ts`)\n* Types for API responses\n* Types for credentials\n* No `any` types\n\n### 4\\. Testing\n\n**Required:**\n\n* Tested with real credentials\n* OAuth flow works (if OAuth)\n* Checks run successfully\n* Error cases handled gracefully\n* Variables work (if using variables)\n\n**Include in PR description:**\n\n* Screenshot of successful connection\n* Screenshot of check results\n* Test account details (if applicable)\n\n### 5\\. Documentation\n\n**Required:**\n\n* Setup instructions in manifest (for OAuth)\n* Clear credential field labels and help text\n* Variable help text explains what they do\n* Remediation steps are actionable\n\n**Nice to have:**\n\n* MDX doc in `packages/docs/integrations/your-service.mdx`\n* Examples in PR description\n\n### 6\\. Code Quality\n\n**Required:**\n\n* TypeScript with no errors\n* ESLint passes\n* Follows existing code patterns\n* No hardcoded values\n* Proper error handling\n\n## PR Template\n\n```\n## Integration: [Service Name]\n\n### Overview\n- **Service**: [Service Name]\n- **Auth Type**: OAuth 2.0 / API Key / Custom\n- **Category**: Cloud / Identity & Access / Developer Tools\n- **Checks**: [List check names]\n\n### What This Integration Does\n[Brief description of what checks are included and what they validate]\n\n### Testing\n- [x] Connected successfully with OAuth/credentials\n- [x] All checks run without errors\n- [x] Error handling works for common failure cases\n- [x] Variables configured and working (if applicable)\n\n**Screenshots:**\n[Add screenshots of connection flow and check results]\n\n### Task Mapping\n- Check: [Check Name] → Task: [Task Template Name]\n- Check: [Check Name] → Task: [Task Template Name]\n\n### Breaking Changes\nNone / [Describe any breaking changes]\n\n### Notes\n[Any additional context, limitations, or future improvements]\n```\n\n## Review Criteria\n\nReviewers will check for:\n\n### Functionality\n\n* Integration connects successfully\n* Checks run and produce expected results\n* OAuth flow works (if OAuth)\n* Error states are handled\n\n### Code Quality\n\n* TypeScript types are correct\n* No `any` types\n* Follows existing patterns\n* Proper error handling\n* Code is readable and maintainable\n\n### User Experience\n\n* Clear, friendly error messages\n* Helpful remediation steps\n* Good variable labels and help text\n* Reasonable defaults\n\n### Security\n\n* Credentials handled securely\n* API calls use HTTPS\n* No secrets in code\n* Proper scope requests (OAuth)\n\n## Common Review Feedback\n\n### ”Add error handling for X”\n\n**Before:**\n\n```\nconst data = await ctx.fetch('/endpoint');\n// Process data\n```\n\n**After:**\n\n```\ntry {\n const data = await ctx.fetch('/endpoint');\n // Process data\n} catch (error) {\n ctx.fail({\n title: 'Failed to Fetch Data',\n // ... proper error handling\n });\n}\n```\n\n### “Make error messages user-friendly”\n\n**Before:**\n\n```\ndescription: `API error: ${error.message}` // Raw error\n```\n\n**After:**\n\n```\ndescription: 'Your account does not have permission to access this resource',\nremediation: 'Grant the \"Admin\" role in Service Settings → Users',\nevidence: { error: errorMessage }, // Store raw error in evidence\n```\n\n### “Add task mapping”\n\n**Before:**\n\n```\nexport const check: IntegrationCheck = {\n id: 'two-factor',\n // No task mapping\n};\n```\n\n**After:**\n\n```\nimport { TASK_TEMPLATES } from '../../../task-mappings';\n\nexport const check: IntegrationCheck = {\n id: 'two-factor',\n taskMapping: TASK_TEMPLATES['2fa'], // Maps to 2FA task\n};\n```\n\n## Getting Your PR Merged\n\n1. **Create a draft PR early** - Get feedback before spending too much time\n2. **Test thoroughly** - Include test results in PR\n3. **Follow the template** - Makes review faster\n4. **Respond to feedback** - Reviewers are trying to help\n5. **Keep it focused** - One integration per PR\n\n## After Your PR is Merged\n\n**For OAuth integrations:**\n\n* Platform admins need to configure OAuth credentials\n* Your integration will show “Coming Soon” until configured\n* Update documentation with OAuth setup steps\n\n**For all integrations:**\n\n* Integration appears in the integrations page\n* Users can connect and start using it\n* Checks run automatically or on-demand\n\n## Questions?\n\n* Check existing integrations for patterns\n* Ask in discussions/issues\n* Tag maintainers for help\n\nThank you for contributing!","2025-12-16T19:35:48.248Z","2026-07-07T16:01:51.836Z","b8b989f7-ab6a-4381-ae2d-d568917f07f0",[],[],[],"contributing-integrations-comp-ai-documentation-2","https://www.trycomp.ai/docs/integrations/contributing","# Contributing Integrations - Comp AI\n\n> ## Documentation Index\n>\n> Fetch the complete documentation index at: \n>\n> Use this file to discover all available pages before exploring further.\n\n## Before You Start\n\n**Check if the integration already exists** by looking in `packages/integration-platform/src/manifests/`. **Good integration candidates:**\n\n- Service has a public API\n- Service provides compliance/security data\n- Maps to existing compliance tasks\n- Widely used in B2B/enterprise\n\n**Not a good fit:**\n\n- Service requires paid enterprise plan for API access\n- No security/compliance data available via API\n- Consumer-focused service with no business use case\n\n## Contribution Checklist\n\nYour PR should include:\n\n### 1. Integration Manifest\n\n**Required:**\n\n- Manifest file (`manifests/your-service/index.ts`)\n- Valid integration ID (kebab-case, unique)\n- Clear name and description\n- Working logo URL\n- Documentation URL\n- Correct category\n- Proper auth configuration\n\n### 2. At Least One Check\n\n**Required:**\n\n- Check file(s) in `checks/` folder\n- Descriptive check IDs\n- Clear error messages\n- Proper error handling\n- Task mapping (if applicable)\n- Evidence includes useful data\n\n### 3. Types\n\n**Required:**\n\n- TypeScript types file (`types.ts`)\n- Types for API responses\n- Types for credentials\n- No `any` types\n\n### 4. Testing\n\n**Required:**\n\n- Tested with real credentials\n- OAuth flow works (if OAuth)\n- Checks run successfully\n- Error cases handled gracefully\n- Variables work (if using variables)\n\n**Include in PR description:**\n\n- Screenshot of successful connection\n- Screenshot of check results\n- Test account details (if applicable)\n\n### 5. Documentation\n\n**Required:**\n\n- Setup instructions in manifest (for OAuth)\n- Clear credential field labels and help text\n- Variable help text explains what they do\n- Remediation steps are actionable\n\n**Nice to have:**\n\n- MDX doc in `packages/docs/integrations/your-service.mdx`\n- Examples in PR description\n\n### 6. Code Quality\n\n**Required:**\n\n- TypeScript with no errors\n- ESLint passes\n- Follows existing code patterns\n- No hardcoded values\n- Proper error handling\n\n## PR Template\n\n```\n## Integration: [Service Name]\n\n### Overview\n- **Service**: [Service Name]\n- **Auth Type**: OAuth 2.0 / API Key / Custom\n- **Category**: Cloud / Identity & Access / Developer Tools\n- **Checks**: [List check names]\n\n### What This Integration Does\n[Brief description of what checks are included and what they validate]\n\n### Testing\n- [x] Connected successfully with OAuth/credentials\n- [x] All checks run without errors\n- [x] Error handling works for common failure cases\n- [x] Variables configured and working (if applicable)\n\n**Screenshots:**\n[Add screenshots of connection flow and check results]\n\n### Task Mapping\n- Check: [Check Name] → Task: [Task Template Name]\n- Check: [Check Name] → Task: [Task Template Name]\n\n### Breaking Changes\nNone / [Describe any breaking changes]\n\n### Notes\n[Any additional context, limitations, or future improvements]\n```\n\n## Review Criteria\n\nReviewers will check for:\n\n### Functionality\n\n- Integration connects successfully\n- Checks run and produce expected results\n- OAuth flow works (if OAuth)\n- Error states are handled\n\n### Code Quality\n\n- TypeScript types are correct\n- No `any` types\n- Follows existing patterns\n- Proper error handling\n- Code is readable and maintainable\n\n### User Experience\n\n- Clear, friendly error messages\n- Helpful remediation steps\n- Good variable labels and help text\n- Reasonable defaults\n\n### Security\n\n- Credentials handled securely\n- API calls use HTTPS\n- No secrets in code\n- Proper scope requests (OAuth)\n\n## Common Review Feedback\n\n### ”Add error handling for X”\n\n**Before:**\n\n```\nconst data = await ctx.fetch('/endpoint');\n// Process data\n```\n\n**After:**\n\n```\ntry {\n const data = await ctx.fetch('/endpoint');\n // Process data\n} catch (error) {\n ctx.fail({\n title: 'Failed to Fetch Data',\n // ... proper error handling\n });\n}\n```\n\n### “Make error messages user-friendly”\n\n**Before:**\n\n```\ndescription: `API error: ${error.message}` // Raw error\n```\n\n**After:**\n\n```\ndescription: 'Your account does not have permission to access this resource',\nremediation: 'Grant the \"Admin\" role in Service Settings → Users',\nevidence: { error: errorMessage }, // Store raw error in evidence\n```\n\n### “Add task mapping”\n\n**Before:**\n\n```\nexport const check: IntegrationCheck = {\n id: 'two-factor',\n // No task mapping\n};\n```\n\n**After:**\n\n```\nimport { TASK_TEMPLATES } from '../../../task-mappings';\n\nexport const check: IntegrationCheck = {\n id: 'two-factor',\n taskMapping: TASK_TEMPLATES['2fa'], // Maps to 2FA task\n};\n```\n\n## Getting Your PR Merged\n\n1. **Create a draft PR early** - Get feedback before spending too much time\n2. **Test thoroughly** - Include test results in PR\n3. **Follow the template** - Makes review faster\n4. **Respond to feedback** - Reviewers are trying to help\n5. **Keep it focused** - One integration per PR\n\n## After Your PR is Merged\n\n**For OAuth integrations:**\n\n- Platform admins need to configure OAuth credentials\n- Your integration will show “Coming Soon” until configured\n- Update documentation with OAuth setup steps\n\n**For all integrations:**\n\n- Integration appears in the integrations page\n- Users can connect and start using it\n- Checks run automatically or on-demand\n\n## Questions?\n\n- Check existing integrations for patterns\n- Ask in discussions/issues\n- Tag maintainers for help\n\nThank you for contributing!\n","2026-05-19T19:46:40.470Z","2026-07-07T16:01:51.835Z","b03a1abc-211c-4d3e-9f27-398c2e66457f",[],[],[],"Compliance Automation API - Comp AI - Documentation","compliance-automation-api-comp-ai-documentation","# Compliance Automation API - Comp AI\n\nThe Comp AI API lets engineering, security, and compliance teams connect their internal systems to the compliance workflows they run in Comp AI. Use it to automate evidence collection, manage policies, coordinate compliance tasks, answer security questionnaires, configure Trust Center access, track risks and vendors, and keep SOC 2, ISO 27001, HIPAA, GDPR, and custom framework programs connected to the systems where work actually happens.\n\n> **Prefer to drive Comp AI from an AI assistant?** The same endpoints documented here are also available as tools in the [Comp AI MCP server](https://www.trycomp.ai/docs/mcp-server) — install it once in Claude Desktop, Cursor, ChatGPT, Codex, or any MCP-compatible client and ask in plain language.\n\n## Authentication\n\nMost organization automation uses the `X-API-Key` header. Create scoped API keys inside your Comp AI organization, keep them server-side, and grant only the permissions needed for the workflow you are building.\n\n```\ncurl --request GET \\\n --url \"https://api.trycomp.ai/v1/organization\" \\\n --header \"X-API-Key: $COMP_AI_API_KEY\"\n```\n\nThe reference covers Comp AI’s product APIs across compliance operations, not just a single workflow. API-key backed endpoints are the integration contract for organization automation, while app session routes are kept out of the public reference.\n\n- Trust Access management, public Trust Center data, evidence, policies, questionnaires, vendors, risks, integrations, cloud checks, and device compliance are API-backed workflows.\n- Device Agent endpoints are used by signed-in employee devices.\n- Webhook endpoints are intentionally omitted from the public reference unless they are useful for implementers.\n- Internal, platform-admin, health, assistant, and browser automation routes are excluded from Mintlify docs.\n\n## API Surface\n\n| Area | What you can automate |\n| ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |\n| Evidence and tasks | List compliance tasks, upload evidence, export audit-ready evidence bundles, and create recurring evidence automations. |\n| Policies and knowledge base | Create, version, publish, export, and improve policies while keeping approved source material available for AI-assisted workflows. |\n| Security questionnaires | Upload questionnaires, extract questions, generate answers from approved evidence, review edits, and export completed files. |\n| Trust Center and Trust Access | Manage access requests, NDA signing, grants, document downloads, certificates, FAQs, custom links, and public overview content. |\n| Frameworks and controls | Track framework readiness, map controls to policies, tasks, requirements, and evidence expectations. |\n| Integrations and cloud checks | Connect providers, run compliance checks, trigger AWS, Azure, and GCP scans, and review cloud security findings. |\n| People, devices, and training | Track workforce members, device compliance, training completions, and endpoint evidence for people-security controls. |\n| Vendors, risks, and findings | Manage third-party risk, organizational risks, audit findings, remediation status, and supporting evidence. |\n| Penetration tests | Create security assessment runs, track progress, inspect findings, and download report artifacts. |\n\n## Common Workflows\n\n## Generated Reference Quality\n\nThe endpoint reference is generated from the NestJS OpenAPI specification used by the Comp AI API. Endpoint titles, descriptions, examples, visibility rules, and Mintlify metadata are maintained in the API source so generated pages stay aligned with product behavior as routes change. Public customer-facing endpoints are documented. Internal operations, admin tooling, health checks, webhooks that are not useful for implementers, and routes that would expose private implementation details are intentionally excluded or hidden.\n\n## Implementation Guidance\n\nStart with the workflow you want to automate, then create a scoped API key for that workflow. For most teams, the first high-value integrations are:\n\n1. Syncing evidence and task status into internal compliance reporting.\n2. Uploading source documents to improve questionnaire and policy workflows.\n3. Connecting Trust Center access approvals to CRM or customer-security processes.\n4. Exporting evidence, policies, or questionnaire results for auditor and customer reviews.\n\nUse production API calls against `https://api.trycomp.ai` and avoid storing API keys in client-side code.\n","2026-05-19T19:51:12.613Z","2026-07-07T16:01:51.834Z","e805c725-9899-4837-9c73-7c9ef9841932",[],[],[],"Cloud Tests - Comp AI - Documentation","cloud-tests-comp-ai-documentation-2","https://bubbaaiinc.mintlify.dev/docs/cloud-tests","# Cloud Tests - Comp AI\n\n## Supported Cloud Tests\n\nComp AI offers several Cloud Tests with third-party services to enhance your experience:\n\n### Cloud Provider Integrations\n\nComp AI integrates with major cloud providers to facilitate cloud security testing and compliance monitoring:\n\n#### AWS Cloud Test\n\n* **Purpose**: Perform security tests and compliance checks on AWS infrastructure\n* **Features**:\n * IAM policy analysis\n * S3 bucket security assessment\n * EC2 instance compliance monitoring\n * CloudTrail audit log analysis\n\nFor setup instructions, see the [AWS Cloud Tests Guide](https://trycomp.ai/docs/integrations/aws).\n\n#### Azure Cloud Test\n\n* **Purpose**: Perform security tests and compliance checks on Azure infrastructure\n* **Features**:\n * Resource group security assessment\n * Azure AD configuration analysis\n * Storage account compliance checks\n * Network security evaluation\n\nFor setup instructions, see the [Azure Cloud Tests Guide](https://trycomp.ai/docs/integrations/azure).\n\n#### GCP Cloud Test\n\n* **Purpose**: Perform security tests and compliance checks on Google Cloud Platform\n* **Features**:\n * IAM role analysis\n * GCS bucket security assessment\n * Compute Engine compliance monitoring\n * Cloud logging audit analysis\n\nFor setup instructions, see the [GCP Cloud Tests Guide](https://trycomp.ai/docs/integrations/gcp).","2025-11-25T14:33:57.111Z","2026-07-07T16:01:51.833Z","c96928b2-abe5-412e-a621-0ee90d33f031",[],[],[],"cloud-tests-comp-ai-documentation","https://trycomp.ai/docs/cloud-tests","2025-12-17T15:55:06.550Z","2026-07-07T16:01:51.832Z","b2ca74be-8f61-48b3-a74a-7f81dbd5ebf3",[],[],[],"cloud-tests-comp-ai-documentation-3","https://www.trycomp.ai/docs/cloud-tests","# Cloud Tests - Comp AI\n\n> ## Documentation Index\n>\n> Fetch the complete documentation index at: \n>\n> Use this file to discover all available pages before exploring further.\n\n## What Cloud Tests do\n\nCloud Tests connect your cloud accounts to Comp AI and continuously evaluate them against security and compliance controls. Each finding is mapped to the frameworks you track (SOC 2, ISO 27001, CIS, PCI DSS, HIPAA), so cloud misconfigurations show up directly in your compliance posture. All connections are **read-only by default**. Comp AI only makes `GET` / `list` calls against each cloud provider unless you explicitly opt in to auto-remediation (AWS).\n\n## Supported providers\n\n| Provider | Connection method | What you provide |\n| -------- | ---------------------------------------- | ---------------------------------------------------------- |\n| AWS | Cross-account IAM role (STS AssumeRole) | Role ARN + External ID (pre-filled in the UI) |\n| Azure | OAuth 2.0 (primary) or service principal | Microsoft sign-in, or Tenant + Client ID + Secret + Sub ID |\n| GCP | OAuth 2.0 | Google sign-in; org + projects auto-detected after consent |\n\n## Common capabilities\n\nRegardless of provider, each connection supports:\n\n- **Continuous scanning** on a schedule, with on-demand re-scans\n- **Per-service toggles** so you can enable only the checks you care about\n- **Findings mapped to frameworks** (SOC 2, ISO 27001, CIS, PCI DSS, HIPAA)\n- **Evidence collection** that plugs directly into the compliance module\n- **Multiple connections per provider** so you can monitor multiple accounts, subscriptions, or orgs separately\n\n## Next steps\n\n- [Set up AWS](https://trycomp.ai/docs/cloud-tests/aws)\n- [Set up Azure](https://trycomp.ai/docs/cloud-tests/azure)\n- [Set up GCP](https://trycomp.ai/docs/cloud-tests/gcp)\n","2026-05-19T19:45:06.658Z","02cccde7-b2de-4901-b23b-44e7606b7434",[],[],[],"Azure Cloud Tests - Comp AI - Documentation","azure-cloud-tests-comp-ai-documentation-2","https://trycomp.ai/docs/cloud-tests/azure","# Azure Cloud Tests - Comp AI\n\n## Azure Cloud Test\n\nThe Azure Cloud Test enables you to connect your Microsoft Azure cloud environment to Comp AI for comprehensive security testing, compliance monitoring, and risk assessment using Microsoft Defender for Cloud\n\n## Setup Process\n\n### Prerequisites\n\nBefore setting up the integration, ensure you have:\n\n1. Azure subscription with Owner or Contributor access\n2. Admin access to your Comp AI workspace\n3. Permissions to register applications in Azure AD\n\n### Configuration Steps\n\n1. **Log into your Azure Portal**\n * Visit [https://portal.azure.com](https://portal.azure.com/)\n2. **Enable Microsoft Defender for Cloud**\n * In the left-hand menu, search for and select **Microsoft Defender for Cloud**\n * Click **Getting started**\n * Select the subscription(s) you want to onboard\n * Enable **Microsoft Defender plans** (especially for relevant services like Compute, Storage, SQL, etc.)\n * Wait for the provisioning to complete (this may take a few minutes)\n3. **Register an Application in Azure AD**\n * Navigate to **Azure Active Directory > App registrations**\n * Click **\\+ New registration**\n * Name the app (e.g., `CompAIIntegrationApp`)\n * Choose **Accounts in this organizational directory only**\n * Click **Register**\n4. **Get the Client ID and Tenant ID**\n * After registration, go to the app’s **Overview** page\n * Copy the **Application (client) ID**\n * Copy the **Directory (tenant) ID**\n5. **Create a Client Secret**\n * In the app menu, go to **Certificates & secrets**\n * Under **Client secrets**, click **\\+ New client secret**\n * Add a description and set an expiration\n * Click **Add**\n * Copy the **Client secret value** — you won’t be able to see it again!\n6. **Assign the Application Access to a Subscription**\n * Go to **Subscriptions** in the Azure portal\n * Select the subscription you want to integrate\n * Copy the **Subscription ID**\n * Click **Access control (IAM)**\n * Click **\\+ Add > Add role assignment**\n * Select role: **Reader** (or **Security Reader** for enhanced visibility)\n * Assign access to: **User, group, or service principal**\n * Select your registered application\n7. **Connect Azure to Comp AI**\n * Go to **Settings > Integrations** in your Comp AI dashboard\n * Click **Connect** next to the Azure integration card\n * Paste the following values:\n * **Client ID**\n * **Client Secret**\n * **Tenant ID**\n * **Subscription ID**\n * Click **Save and Connect**\n\n## Capabilities\n\n### Security Tests\n\nThe Azure Cloud Test performs the following security assessments:\n\n| Test Category | Description |\n| --- | --- |\n| IAM Analysis | Review Azure AD roles and custom RBAC assignments |\n| Storage Security | Identify improperly configured storage account permissions and encryption |\n| VM Security | Analyze NSGs, VM configurations, and patch status |\n| Database Security | Check Azure SQL, Cosmos DB, and other database security settings |\n| Activity Logs | Verify proper logging and monitoring configuration |\n| Key Vault | Validate secret management and key rotation policies |\n| Network | Assess VNet configurations, NSGs, and service endpoints |\n\n### Compliance Frameworks\n\nThe Cloud Test checks compliance against:\n\n* Microsoft Cloud Security Benchmark\n* SOC 2\n* HIPAA (where applicable)\n* PCI DSS\n* GDPR\n* ISO 27001\n\n## Managing Access\n\n### Access Control\n\nComp AI requires read-only access to your Azure environment. The integration uses Azure’s built-in Reader role or custom roles with specific permissions that follow the principle of least privilege.\n\n### Permissions\n\nThe Azure application/service principal has permissions for:\n\n* Reading resource configurations\n* Listing resources and their attributes\n* Viewing diagnostic settings\n\nThe integration does NOT have permissions to:\n\n* Modify any resources\n* Create new resources\n* Delete existing resources\n\n## Troubleshooting\n\n### Common Issues\n\n**Issue**: Failed to connect Azure subscription \n**Solution**: Verify service principal credentials and role assignments **Issue**: Authentication errors \n**Solution**: Ensure the service principal hasn’t expired and secret is valid\n\n### Support\n\nFor additional assistance with your Azure Cloud Tests:\n\n1. Check our [Knowledge Base](https://help.trycomp.ai/azure-integration)\n2. Contact support at [support@trycomp.ai](mailto:support@trycomp.ai)\n3. Join our [Discord community](https://discord.gg/compai) for peer support","2025-12-17T15:55:07.744Z","2026-07-07T16:01:51.831Z","cab4636c-5c82-44a2-9e88-40de7eea0083",[],[],[],"azure-cloud-tests-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/cloud-tests/azure","2025-11-25T14:33:58.412Z","2026-07-07T16:01:51.830Z","c2548ac9-c2ef-4296-8bb2-4c1fb05b03a8",[],[],[],"azure-cloud-tests-comp-ai-documentation-3","https://www.trycomp.ai/docs/cloud-tests/azure","# Azure Cloud Tests - Comp AI\n\n> ## Documentation Index\n>\n> Fetch the complete documentation index at: \n>\n> Use this file to discover all available pages before exploring further.\n\n## About the Azure integration\n\nComp AI connects to Microsoft Azure to pull security posture, identity, network, and compliance data from **Microsoft Defender for Cloud** and related services. All access is read-only. The recommended connection method is **Microsoft OAuth** — you sign in with an Azure AD account that has the required roles, and Comp AI auto-detects your subscription. A **service principal** flow is also supported for customers who prefer to provision a dedicated identity.\n\n## How access works\n\n- **Primary flow**: OAuth 2.0 against `login.microsoftonline.com` using the `user_impersonation` scope on Azure Management API. Comp AI acts on behalf of the signed-in user, constrained by their Azure RBAC assignments.\n- **Alternative flow**: An Azure AD App Registration (service principal) with a client secret, assigned the required roles on a subscription.\n- **Scope**: A single Azure subscription per connection. Connect additional subscriptions by adding more connections.\n\n## Prerequisites\n\nBefore connecting Azure, make sure you have:\n\n1. An **Azure subscription** you want to monitor\n2. A user (or service principal) with the following roles on that subscription:\n - **Reader** — read resource metadata\n - **Security Reader** — read Microsoft Defender for Cloud findings\n - **Monitoring Reader** — read activity logs, alerts, and metrics\n3. **Microsoft Defender for Cloud** enabled on the subscription (the free tier is sufficient for most checks)\n4. Admin access to your Comp AI workspace\n\n## Connect with OAuth (recommended)\n\n1\n\n2\n\n3\n\n4\n\n## Connect with a service principal (alternative)\n\nUse this flow if you want a dedicated non-human identity or your tenant restricts user OAuth consent.\n\n1\n\n2\n\n3\n\n4\n\n5\n\n## What gets scanned\n\nThe Azure integration evaluates findings across services including:\n\n| Area | Services |\n| ------------- | ------------------------------------------------------ |\n| Posture | Microsoft Defender for Cloud (assessments + alerts) |\n| Identity | Microsoft Entra ID |\n| Governance | Azure Policy |\n| Data security | Key Vault, Storage Accounts, SQL Database, Cosmos DB |\n| Compute | Virtual Machines, App Service, AKS, Container Registry |\n| Network | Network Watcher (NSGs, flow logs) |\n| Observability | Azure Monitor (activity logs, diagnostic settings) |\n\nThe **Services** tab inside the connection lets you enable or disable specific checks.\n\n## Compliance frameworks\n\nFindings are mapped to the controls used by:\n\n- Microsoft Cloud Security Benchmark\n- SOC 2\n- ISO 27001\n- PCI DSS\n- HIPAA (where applicable)\n\n## Security model\n\n- **Read-only** — Comp AI makes no write calls, regardless of the roles you assign\n- **Scoped to one subscription per connection** — a connection cannot read data outside the subscription it was created for\n- **Secrets stay encrypted** — client secrets and refresh tokens are stored in an encrypted vault and never returned to the UI\n- **Revocable at any time** — remove the role assignments in the Azure portal, or delete the connection in Comp AI\n\n## Troubleshooting\n\nDefender for Cloud shows no assessments\n\nDefender for Cloud must be enabled on the subscription. Open the **Microsoft Defender for Cloud** blade, select the subscription, and confirm at least the free tier is turned on. Initial data can take up to 24 hours to appear.\n\nAuthentication failed\n\nFor OAuth: make sure your account still has the three required roles on the subscription — `User_impersonation` scope alone is not enough.For service principal: confirm the client secret has not expired and the app registration has not been disabled.\n\nSubscription not detected after sign-in\n\nComp AI only sees subscriptions your signed-in account has access to. If you manage multiple subscriptions, sign in with an account that has **Reader** on the one you want to monitor, or use the service principal flow to target it explicitly.\n\nMissing findings for a specific service\n\nCheck that the service is enabled under the **Services** tab for this connection. Some services also require Defender plans beyond the free tier — for example, Defender for Servers, SQL, or Containers.\n\n## Support\n\n1. Email \n2. Join our [Discord community](https://discord.gg/compai)\n","2026-05-19T19:45:07.149Z","2026-07-07T16:01:51.829Z","0804027e-9822-4157-8874-02567db6349b",[],[],[],"AWS Cloud Tests - Comp AI - Documentation","aws-cloud-tests-comp-ai-documentation-3","https://www.trycomp.ai/docs/cloud-tests/aws","# AWS Cloud Tests - Comp AI\n\n> ## Documentation Index\n>\n> Fetch the complete documentation index at: \n>\n> Use this file to discover all available pages before exploring further.\n\n## About the AWS integration\n\nComp AI connects to your AWS account using a **cross-account IAM role** with an **External ID**. No long-lived access keys are created, and all access is scoped to read-only unless you also opt in to auto-remediation with a separate role. Once connected, Comp AI scans the regions you select and produces findings mapped to common frameworks (SOC 2, ISO 27001, CIS AWS Foundations, PCI DSS, HIPAA).\n\n## How access works\n\n- **Auth model**: AWS STS `AssumeRole` from a Comp AI–managed principal into a role in your account\n- **External ID**: Required in the trust policy so only a specific Comp AI organization can assume the role\n- **Permissions**: `SecurityAudit` + `ViewOnlyAccess` managed policies, plus two small inline policies for Cost Explorer reads and SSM document metadata\n- **Optional auto-remediation**: A separate role (`CompAI-Remediator`) can be created to enable auto-fix actions — this role is **only used when you explicitly trigger a fix**. The audit role stays read-only.\n\n## Prerequisites\n\nBefore you begin, make sure you have:\n\n1. An AWS account with permission to create IAM roles\n2. Your Comp AI **organization ID** (used as the External ID — Comp AI’s connection form pre-fills this for you)\n3. Admin access to your Comp AI workspace\n\n## Connect AWS\n\nThe Comp AI UI walks you through the full flow and displays the exact CloudShell script to run. The summary below is for reference.\n\n1\n\n2\n\n3\n\n4\n\n5\n\n## What gets scanned\n\nThe AWS integration evaluates findings across a wide set of AWS services, including:\n\n| Area | Services |\n| ------------- | ------------------------------------------------------------------------------- |\n| Identity | IAM, IAM Access Analyzer, Cognito |\n| Storage | S3, EBS, EFS, DynamoDB, RDS, Redshift, OpenSearch, ElastiCache |\n| Compute | EC2 & VPC, Lambda, ECS & EKS, EMR, Elastic Beanstalk, CodeBuild, Step Functions |\n| Network | VPC, ELB/ALB, CloudFront, API Gateway, Route 53, WAF, Network Firewall, Shield |\n| Data security | KMS, Secrets Manager, ACM, Macie, Inspector |\n| Observability | CloudTrail, CloudWatch, AWS Config, GuardDuty, Security Hub |\n| Messaging | SNS, SQS, Kinesis, EventBridge, MSK |\n| Other | Backup, ECR, Glue, Athena, SageMaker, Systems Manager, Transfer Family, AppFlow |\n\nThe **Services** tab inside each connection lets you enable or disable specific checks per service.\n\n## Compliance frameworks\n\nFindings are mapped to the controls used by:\n\n- CIS AWS Foundations Benchmark\n- SOC 2\n- ISO 27001\n- PCI DSS\n- HIPAA (where applicable)\n\n## Security model\n\n- **Read-only by default** — the audit role cannot create, modify, or delete resources\n- **External ID enforced** — Comp AI refuses to connect unless the External ID in your trust policy matches the one stored against your Comp AI organization\n- **No static credentials** — Comp AI never stores AWS access keys; short-lived credentials are issued by STS on each scan\n- **Revocable at any time** — deleting the IAM role in your account immediately cuts off access\n\n## Troubleshooting\n\nAccess denied during AssumeRole\n\nThe most common cause is an External ID mismatch. Confirm the value in your role’s trust policy matches the External ID shown in the Comp AI connection form. If you recently rotated it, re-run the CloudShell script.\n\nRole ARN format error\n\nComp AI expects an ARN in the form `arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME`. Make sure you copied the role ARN from the CloudShell output, not the account or user ARN.\n\nFindings missing for a specific service\n\nCheck that:\n\n1. The role has `SecurityAudit` + `ViewOnlyAccess` attached (the script attaches both)\n2. The region is enabled on your connection\n3. The service is turned on in the **Services** tab for this connection\n\nAuto-remediation isn't available\n\nAuto-remediation requires the separate `CompAI-Remediator` role. Run the second CloudShell script shown in the UI, then paste its Role ARN into the **Remediation Role ARN** field.\n\n## Support\n\n1. Email \n2. Join our [Discord community](https://discord.gg/compai)\n","2026-05-19T19:45:06.809Z","2026-07-07T16:01:51.828Z","e6090ca8-c3a3-4aa0-b65b-47fce7ff7d5a",[],[],[],"aws-cloud-tests-comp-ai-documentation-2","https://bubbaaiinc.mintlify.dev/docs/cloud-tests/aws","# AWS Cloud Tests - Comp AI\n\n## Setup Process\n\n### Prerequisites\n\nBefore setting up the integration, ensure you have:\n\n1. An AWS account with administrator access\n2. Admin access to your Comp AI workspace\n3. IAM permissions to create and manage roles, policies, and trust relationships\n\n### Configuration Steps\n\n1. **Log into your AWS Management Console**\n2. **Enable Security Hub**\n * Navigate to **Security Hub** in the AWS Console\n * Click **Get Started**\n * Enable Security Hub in your **desired regions**\n * Optionally, enable **default security standards** (like CIS AWS Foundations)\n3. **Choose a Region Code**\n * Decide which AWS region you want Comp AI to use (e.g., `us-east-1`, `us-west-2`)\n * Copy this region code — you’ll need it in the Comp AI UI\n4. **Create an IAM User for Comp AI**\n * Go to **IAM > Users**, then click **Add user**\n * Enter a name like `CompAIIntegrationUser`\n * Choose **Programmatic access** (this generates the Access Key ID & Secret)\n5. **Set Permissions**\n * On the permissions screen, click **Attach policies directly**\n * Attach the following AWS managed policies:\n * `SecurityAudit`\n * `AmazonEC2ReadOnlyAccess & AWSSecurityHubReadOnlyAccess` _(Or use a custom least-privilege policy — see example below)_\n6. **Create the User**\n * Click **Next**, then **Create user**\n * Copy and securely store the **Access Key ID** and **Secret Access Key**\n * You will only see the secret once!\n7. **Connect AWS to Comp AI**\n * Go to **Settings > Integrations** in your Comp AI dashboard\n * Click **Connect** next to the AWS integration card\n * Paste the **Access Key ID**, **Secret Access Key**, and **Region Code**\n * Click **Save and Connect**\n\n## Capabilities\n\n### Security Tests\n\nThe AWS integration performs the following security assessments: | Test Category | Description | IAM Misconfigurations | Detects overly permissive roles, users, or policies | S3 Bucket Security | Checks for public access, encryption, and versioning | EC2 Instance | Analysis Reviews security group rules, instance metadata access | Security Hub | Findings Integrates AWS Security Hub findings for real-time insights | CloudTrail | Configuration Verifies CloudTrail logging and monitoring | Config & Compliance Checks | Audits AWS Config rules and compliance state\n\n### Compliance Frameworks\n\n* The integration checks compliance against:\n* CIS AWS Foundations Benchmark\n* SOC 2\n* HIPAA (where applicable)\n* PCI DSS\n* GDPR\n* ISO 27001\n\n## Managing Access\n\n### Access Control\n\nComp AI uses a cross-account IAM role with read-only permissions and a required external ID to ensure secure, scoped access. This approach follows AWS best practices for secure third-party integrations.\n\n### Permissions\n\nThe IAM role created for integration has permissions to:\n\n* Describe resources (EC2, S3, IAM, etc.)\n* Read configuration and audit logs\n* Access Security Hub and CloudTrail\n* List AWS Config and resource statuses\n* The integration does NOT have permissions to:\n\nModify any resources\n\n* Create or delete resources\n* Write to S3 or other services\n\n### Support\n\nFor additional assistance with your Azure integration:\n\n1. Check our [Knowledge Base](https://help.trycomp.ai/azure-integration)\n2. Contact support at [support@trycomp.ai](mailto:support@trycomp.ai)\n3. Join our [Discord community](https://discord.gg/compai) for peer support","2025-11-25T14:33:58.001Z","2026-07-07T16:01:51.827Z","df469839-c24d-4b53-843c-9931b75462e4",[],[],[],"aws-cloud-tests-comp-ai-documentation","https://trycomp.ai/docs/cloud-tests/aws","2025-12-17T15:55:06.726Z","4cb1f1c6-1f61-4ac0-9535-7f7555288051",[],[],[],"Automated Evidence - Comp AI - Documentation","automated-evidence-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/automated-evidence","# Automated Evidence - Comp AI\n\n### Automated Evidence Demo\n\n### Create Automations\n\nTo create automations for evidence collection, simply click into any task on the app, and click on the “Create Automation” button. This will take you to the chat agent, here, you will enter a prompt based on the task and evidence required for that task.\n\n### Example Prompt\n\nIn this example, we will use the project ‘Secure Code’ for this task. We need to show that Dependabot (or a similar tool) is enabled and scanning the dependencies in our codebase. For this prompt, we would say: \n“Check if Dependabot is enabled in my GitHub repository and return the results.”\n\n### Testing & Publishing Automations\n\nOnce prompted, the agent will run through the process of creating an automation to check for and return any Dependabot alerts, requesting any relevant keys or tokens required by that specific vendor to complete the automation. Once the automation is complete, click ‘Test’. This will display the first output for that automation. If the output is sufficient, click ‘Publish’. This will publish the automation to the task, which will then run automatically—updating the evidence for that task according to the frequency set.","2025-11-25T14:32:47.335Z","2026-07-07T16:01:51.825Z","b9792f0d-0b8d-417b-8961-51e1037c7dc0",[],[],[],"automated-evidence-comp-ai-documentation-2","https://www.trycomp.ai/docs/automated-evidence","# Automated Evidence - Comp AI\n\n> ## Documentation Index\n>\n> Fetch the complete documentation index at: \n>\n> Use this file to discover all available pages before exploring further.\n\nAutomated Evidence keeps compliance tasks current by collecting recurring proof from the systems your team already uses. Use it to reduce stale screenshots, manual follow-ups, and last-minute audit evidence work.\n\n### Automated Evidence Demo\n\n### Create Automations\n\nTo create automations for evidence collection, simply click into any task on the app, and click on the “Create Automation” button. This will take you to the chat agent, here, you will enter a prompt based on the task and evidence required for that task.\n\n### Example Prompt\n\nIn this example, we will use the project ‘Secure Code’ for this task. We need to show that Dependabot (or a similar tool) is enabled and scanning the dependencies in our codebase. For this prompt, we would say:\\\n“Check if Dependabot is enabled in my GitHub repository and return the results.”\n\n### Testing & Publishing Automations\n\nOnce prompted, the agent will run through the process of creating an automation to check for and return any Dependabot alerts, requesting any relevant keys or tokens required by that specific vendor to complete the automation. Once the automation is complete, click ‘Test’. This will display the first output for that automation. If the output is sufficient, click ‘Publish’. This will publish the automation to the task, which will then run automatically—updating the evidence for that task according to the frequency set.\n","2026-05-19T19:43:25.723Z","2026-07-07T16:01:51.824Z","b58aa495-739b-4cef-a8aa-908dd7eeb9d0",[],[],[],"Authentication Reference - Comp AI - Documentation","authentication-reference-comp-ai-documentation-2","https://www.trycomp.ai/docs/integrations/authentication","# Authentication Reference - Comp AI\n\n> ## Documentation Index\n>\n> Fetch the complete documentation index at: \n>\n> Use this file to discover all available pages before exploring further.\n\n## Overview\n\nThe integration platform supports **4 authentication strategies**. Choose based on what the third-party service offers.\n\n## Quick Comparison\n\n| Type | When to Use | User Setup | Platform Setup | Token Refresh |\n| -------------- | ------------------------------ | --------------------------- | -------------------------- | ----------------------- |\n| **OAuth 2.0** | Service has OAuth | 1-click connect | Admin configures OAuth app | Auto |\n| **API Key** | Service uses API keys | User enters key | None | N/A (keys don’t expire) |\n| **Basic Auth** | Service uses username/password | User enters creds | None | N/A |\n| **Custom** | Complex multi-field auth | User enters multiple fields | None | N/A |\n\n***\n\n## OAuth 2.0\n\n**Best for:** GitHub, Google, Linear, Vercel, most modern SaaS\n\n### Configuration\n\n```\nauth: {\n type: 'oauth2',\n config: {\n // Required\n authorizeUrl: 'https://provider.com/oauth/authorize',\n tokenUrl: 'https://provider.com/oauth/token',\n scopes: ['read:user', 'read:org'],\n\n // Optional\n pkce: false, // Use PKCE flow? (default: false)\n clientAuthMethod: 'body', // 'body' or 'header' (default: 'body')\n supportsRefreshToken: true, // Can tokens be refreshed? (default: true)\n\n // Additional params sent during authorization\n authorizationParams: {\n access_type: 'offline', // Request refresh token\n prompt: 'consent', // Force consent screen\n },\n\n // Additional params sent during token exchange\n tokenParams: {\n grant_type: 'authorization_code',\n },\n\n // Admin setup instructions (Markdown)\n setupInstructions: `...`,\n\n // URL to create OAuth app\n createAppUrl: 'https://provider.com/apps/new',\n\n // Custom settings (advanced)\n customSettings: [\n {\n id: 'app_name',\n label: 'App Name',\n type: 'text',\n required: true,\n token: '{APP_NAME}', // Replaces in authorizeUrl\n },\n ],\n },\n},\n```\n\n### Key Options Explained\n\n#### `pkce` (Proof Key for Code Exchange)\n\n**When to use:** Some providers require it (GitHub does NOT, Auth0 does)\n\n```\npkce: true; // Generates code_verifier and code_challenge\n```\n\n#### `clientAuthMethod`\n\n**How to send client credentials during token exchange:**\n\n- `'body'` (default): Send as form fields\n\n ```\n POST /token\n client_id=...&client_secret=...\n ```\n\n- `'header'`: Send as Basic Auth header\n\n ```\n POST /token\n Authorization: Basic base64(client_id:client_secret)\n ```\n\n**Use `header` for:** OAuth providers that require Basic Auth (some enterprise providers)\n\n#### `supportsRefreshToken`\n\n**Controls token refresh behavior:**\n\n- `true` (default): Platform auto-refreshes tokens before expiry\n- `false`: Tokens are long-lived (e.g., GitHub Personal Access Tokens)\n\n**Set to `false` if:** Provider doesn’t support refresh tokens or tokens never expire\n\n#### `customSettings`\n\n**For providers with non-standard OAuth requirements:** **Example:** Rippling needs app name in authorize URL:\n\n```\nauthorizeUrl: 'https://api.rippling.com/connect/authorize/{APP_NAME}',\ncustomSettings: [\n {\n id: 'app_name',\n label: 'Rippling App Name',\n type: 'text',\n required: true,\n token: '{APP_NAME}',\n },\n],\n```\n\nPlatform admin enters `app_name` → Platform replaces `{APP_NAME}` in URL.\n\n### Access Token in Checks\n\n```\nrun: async (ctx: CheckContext) => {\n // Access token is automatically available\n const token = ctx.accessToken;\n\n // ctx.fetch() automatically adds Bearer token\n const data = await ctx.fetch('/api/endpoint');\n\n // For custom headers\n const response = await fetch(url, {\n headers: {\n Authorization: `Bearer ${ctx.accessToken}`,\n },\n });\n};\n```\n\n***\n\n## API Key\n\n**Best for:** Simple REST APIs with static API keys (e.g., Stripe, SendGrid)\n\n### Configuration\n\n```\nauth: {\n type: 'api_key',\n config: {\n in: 'header', // or 'query'\n name: 'X-API-Key', // Header name or query param name\n prefix: 'Bearer ', // Optional prefix (e.g., \"Bearer \", \"Token \")\n },\n},\n```\n\n### Key Options\n\n#### `in` - Where to send the API key\n\n**Header (recommended):**\n\n```\nin: 'header',\nname: 'X-API-Key',\n\n// Results in:\n// X-API-Key: your-api-key-value\n```\n\n**Query parameter:**\n\n```\nin: 'query',\nname: 'api_key',\n\n// Results in:\n// GET /endpoint?api_key=your-api-key-value\n```\n\n**Use query for:** APIs that don’t accept custom headers (rare)\n\n#### `prefix` - Add a prefix to the key\n\n```\nprefix: 'Bearer ', // Common for tokens\nprefix: 'Token ', // Some APIs use this\nprefix: '', // No prefix (default)\n\n// Example with Bearer:\n// Authorization: Bearer sk_live_abc123...\n```\n\n### Credential Field\n\nUser will see a form field to enter the API key:\n\n```\n// Automatically generated credential field\n{\n id: 'api_key',\n label: 'API Key',\n type: 'password',\n required: true,\n placeholder: 'sk_live_...',\n helpText: 'Found in Settings → API Keys',\n}\n```\n\n### Access in Checks\n\n```\nrun: async (ctx: CheckContext) => {\n // API key is automatically added to requests\n const data = await ctx.fetch('/endpoint');\n\n // Or access it directly\n const apiKey = ctx.credentials.api_key;\n};\n```\n\n***\n\n## Basic Auth\n\n**Best for:** APIs using username/password authentication (e.g., some internal tools)\n\n### Configuration\n\n```\nauth: {\n type: 'basic',\n config: {\n usernameField: 'username', // Default, can customize\n passwordField: 'password', // Default, can customize\n },\n},\n```\n\n### Credential Fields\n\nUsers will see two fields:\n\n```\n// Automatically generated\n[\n {\n id: 'username',\n label: 'Username',\n type: 'text',\n required: true,\n },\n {\n id: 'password',\n label: 'Password',\n type: 'password',\n required: true,\n },\n];\n```\n\n### Custom Field Names\n\n```\nauth: {\n type: 'basic',\n config: {\n usernameField: 'email', // Use 'email' instead of 'username'\n passwordField: 'api_token', // Use 'api_token' instead of 'password'\n },\n},\n```\n\n### Access in Checks\n\n```\nrun: async (ctx: CheckContext) => {\n // Basic Auth header is automatically added\n // Authorization: Basic base64(username:password)\n const data = await ctx.fetch('/endpoint');\n\n // Or access credentials directly\n const username = ctx.credentials.username;\n const password = ctx.credentials.password;\n};\n```\n\n***\n\n## Custom Auth\n\n**Best for:** Complex authentication requiring multiple fields (AWS IAM Role, Azure Service Principal, GCP Service Account)\n\n### Configuration\n\n```\nauth: {\n type: 'custom',\n config: {\n description: 'AWS IAM Role for cross-account access',\n\n credentialFields: [\n {\n id: 'roleArn',\n label: 'IAM Role ARN',\n type: 'text',\n required: true,\n placeholder: 'arn:aws:iam::123456789012:role/MyRole',\n helpText: 'The ARN of the IAM role to assume',\n },\n {\n id: 'externalId',\n label: 'External ID',\n type: 'password',\n required: true,\n helpText: 'Unique identifier for security',\n },\n {\n id: 'region',\n label: 'AWS Region',\n type: 'combobox',\n required: true,\n placeholder: 'Select or type...',\n helpText: 'Primary region for API calls',\n options: [\n { value: 'us-east-1', label: 'US East (N. Virginia)' },\n { value: 'eu-west-1', label: 'Europe (Ireland)' },\n ],\n },\n ],\n\n setupInstructions: `## Setup Guide\n\n1. Create IAM role in AWS\n2. Copy the Role ARN\n3. Generate External ID\n4. Enter credentials below`,\n },\n},\n```\n\n### Field Types\n\n| Type | UI Component | When to Use | Example |\n| ---------- | --------------------------- | ---------------- | ------------------------- |\n| `text` | Text input | Single-line text | Project ID, Account ID |\n| `password` | Password input (hidden) | Secrets, tokens | API keys, passwords |\n| `textarea` | Multi-line textarea | Long text, JSON | Service account JSON key |\n| `select` | Dropdown (fixed options) | Choose from list | Environment (prod/dev) |\n| `combobox` | Dropdown + custom input | Choose or type | AWS region, timezone |\n| `number` | Number input | Numeric values | Port, timeout |\n| `url` | URL input (with validation) | Web addresses | Webhook URL, API endpoint |\n\n### Field Options\n\n```\n{\n id: 'field_name', // Unique identifier (snake_case)\n label: 'Field Label', // Shown to user\n type: 'text', // See table above\n required: true, // Is this field mandatory?\n placeholder: 'example...', // Placeholder text\n helpText: 'Explain where to find this', // Help text below field\n\n // For select/combobox only:\n options: [\n { value: 'val1', label: 'Option 1' },\n { value: 'val2', label: 'Option 2' },\n ],\n}\n```\n\n### Access in Checks\n\n```\nrun: async (ctx: CheckContext) => {\n // All fields available as key-value pairs\n const roleArn = ctx.credentials.roleArn;\n const externalId = ctx.credentials.externalId;\n const region = ctx.credentials.region;\n\n // Custom authentication logic\n const client = await createCustomClient({\n roleArn,\n externalId,\n region,\n });\n};\n```\n\n***\n\n## Choosing an Auth Type\n\n### Decision Tree\n\n```\nDoes the service have OAuth?\n├─ YES → Use OAuth 2.0\n│ └─ Best UX, auto token refresh, secure\n│\n└─ NO\n │\n Does it use a single API key?\n ├─ YES → Use API Key\n │ └─ Simple, user just pastes key\n │\n └─ NO\n │\n Does it use username + password?\n ├─ YES → Use Basic Auth\n │ └─ Two fields, encoded automatically\n │\n └─ NO → Use Custom Auth\n └─ Multiple fields, full control\n```\n\n### Comparison: OAuth vs API Key\n\n| Aspect | OAuth 2.0 | API Key |\n| ------------------- | ---------------------------- | ------------------------- |\n| **User Experience** | Best (1-click) | OK (find & paste key) |\n| **Security** | Tokens expire & refresh | Long-lived secrets |\n| **Platform Setup** | Admin must configure | None needed |\n| **Revocation** | User revokes in provider | User must regenerate key |\n| **Scope Control** | Request specific permissions | Key has fixed permissions |\n\n**Recommendation:** Use OAuth if the service supports it.\n\n### Comparison: Basic Auth vs Custom\n\n| Aspect | Basic Auth | Custom Auth |\n| ------------ | --------------------- | ------------------------- |\n| **Fields** | 2 (username/password) | Any number |\n| **Encoding** | Auto (Base64) | Manual in check code |\n| **Use Case** | Simple APIs | Complex auth (AWS, Azure) |\n| **Setup** | Minimal config | Define all fields |\n\n**Use Basic Auth for:** Simple username/password APIs\\\n**Use Custom Auth for:** Multi-field credentials, service accounts, IAM roles\n\n***\n\n## Examples by Service Type\n\n### Cloud Providers (AWS, Azure, GCP)\n\n**Use:** Custom Auth (service accounts, IAM roles) **Why:** These services use multi-field credentials that need custom authentication logic. OAuth is possible but service accounts are the recommended approach for programmatic access.\n\n### SaaS Tools (GitHub, Linear, Notion)\n\n**Use:** OAuth 2.0 **Why:** Best user experience, tokens auto-refresh, users can revoke access easily.\n\n### Internal Tools / Legacy APIs\n\n**Use:** Basic Auth or API Key **Why:** Simpler services often use these methods. Choose based on what the API supports.\n\n***\n\n## Advanced OAuth Options\n\n### PKCE (Proof Key for Code Exchange)\n\n**What it is:** Extra security for OAuth (prevents authorization code interception) **When to enable:**\n\n```\npkce: true; // Enable for: Auth0, Okta, some enterprise providers\npkce: false; // Default for: GitHub, Google, Linear\n```\n\n**How it works:** Platform generates a random `code_verifier`, hashes it to create `code_challenge`, sends challenge during authorization, sends verifier during token exchange.\n\n### Client Authentication Method\n\n**How platform authenticates itself to the provider:** **Body (default):**\n\n```\nPOST /token\nContent-Type: application/x-www-form-urlencoded\n\ngrant_type=authorization_code&code=...&client_id=...&client_secret=...\n```\n\n**Header (Basic Auth):**\n\n```\nPOST /token\nAuthorization: Basic base64(client_id:client_secret)\nContent-Type: application/x-www-form-urlencoded\n\ngrant_type=authorization_code&code=...\n```\n\n**Use `header` when:** Provider documentation explicitly requires Basic Auth for client authentication.\n\n**Add extra params to the authorization URL:**\n\n```\nauthorizationParams: {\n access_type: 'offline', // Google: Request refresh token\n prompt: 'consent', // Force consent screen (always request scopes)\n response_mode: 'query', // How to return auth code\n}\n```\n\n**Common use cases:**\n\n- `access_type: 'offline'` - Google APIs (get refresh token)\n- `prompt: 'consent'` - Always show consent screen (good for testing)\n- Custom provider-specific params\n\n***\n\n## Security Best Practices\n\n### API Keys\n\n- Use `type: 'password'` for sensitive fields (hidden input)\n- Store in credential vault (auto-encrypted)\n- Never log API keys\n- Add help text explaining where to find/generate the key\n\n### OAuth\n\n- Request minimum scopes needed\n- Use `access_type: 'offline'` for refresh tokens\n- Set `supportsRefreshToken: true` to auto-refresh\n- Explain scope requirements in setup instructions\n\n### Basic Auth\n\n- Both username and password are required\n- Password field is auto-hidden\n- Credentials are auto-encoded to Base64\n- Never log passwords\n\n### Custom Auth\n\n- Mark sensitive fields as `type: 'password'`\n- Validate all required fields in checks\n- Handle missing fields gracefully\n- Don’t expose credential values in logs/errors\n\n***\n\n## Complete OAuth Example\n\n```\nauth: {\n type: 'oauth2',\n config: {\n authorizeUrl: 'https://github.com/login/oauth/authorize',\n tokenUrl: 'https://github.com/login/oauth/access_token',\n scopes: ['repo', 'read:org', 'read:user'],\n pkce: false,\n clientAuthMethod: 'body',\n supportsRefreshToken: false, // GitHub tokens don't expire\n authorizationParams: {\n allow_signup: 'false', // Don't show sign-up on consent\n },\n setupInstructions: `## Create GitHub OAuth App\n\n1. Go to https://github.com/settings/developers\n2. Click \"New OAuth App\"\n3. Enter:\n - Application name: Your app name\n - Homepage URL: https://yourapp.com\n - Callback URL: [shown below]\n4. Click \"Register application\"\n5. Copy Client ID and generate Client Secret\n6. Paste both below`,\n createAppUrl: 'https://github.com/settings/apps/new',\n },\n},\n```\n\n***\n\n## Testing Your Auth\n\n### OAuth\n\n1. Configure platform credentials in `/admin/integrations`\n2. Go to `/integrations` and click Connect\n3. Should redirect to provider OAuth screen\n4. Authorize → Should redirect back successfully\n5. Check connection is active\n\n### API Key / Basic / Custom\n\n1. Go to `/integrations` and click Connect\n2. Form should show your credential fields\n3. Enter test credentials\n4. Connection should be created successfully\n5. Run a check to verify credentials work\n\n### Debug OAuth Issues\n\nCheck API logs for:\n\n- `OAuth completed for [provider]` - Success\n- `OAuth callback error` - Authorization failed\n- `Token exchange failed` - Bad client credentials\n- `Invalid state` - State mismatch (check callback URL)\n\n***\n\n## Summary\n\n**Choose your auth type:**\n\n- **Service has OAuth?** → Use OAuth 2.0\n- **Single API key?** → Use API Key\n- **Username/password?** → Use Basic Auth\n- **Multiple fields or complex?** → Use Custom Auth\n\n**OAuth is best when available** - better UX, security, and user control.\n","2026-05-19T19:46:41.619Z","2026-07-07T16:01:51.823Z","d6dce226-3c3a-46db-af35-74703d87ff82",[],[],[],"authentication-reference-comp-ai-documentation","https://trycomp.ai/docs/integrations/authentication","# Authentication Reference - Comp AI\n\n## Overview\n\nThe integration platform supports **4 authentication strategies**. Choose based on what the third-party service offers.\n\n## Quick Comparison\n\n| Type | When to Use | User Setup | Platform Setup | Token Refresh |\n| --- | --- | --- | --- | --- |\n| **OAuth 2.0** | Service has OAuth | 1-click connect | Admin configures OAuth app | Auto |\n| **API Key** | Service uses API keys | User enters key | None | N/A (keys don’t expire) |\n| **Basic Auth** | Service uses username/password | User enters creds | None | N/A |\n| **Custom** | Complex multi-field auth | User enters multiple fields | None | N/A |\n\n* * *\n\n## OAuth 2.0\n\n**Best for:** GitHub, Google, Linear, Vercel, most modern SaaS\n\n### Configuration\n\n```\nauth: {\n type: 'oauth2',\n config: {\n // Required\n authorizeUrl: 'https://provider.com/oauth/authorize',\n tokenUrl: 'https://provider.com/oauth/token',\n scopes: ['read:user', 'read:org'],\n\n // Optional\n pkce: false, // Use PKCE flow? (default: false)\n clientAuthMethod: 'body', // 'body' or 'header' (default: 'body')\n supportsRefreshToken: true, // Can tokens be refreshed? (default: true)\n\n // Additional params sent during authorization\n authorizationParams: {\n access_type: 'offline', // Request refresh token\n prompt: 'consent', // Force consent screen\n },\n\n // Additional params sent during token exchange\n tokenParams: {\n grant_type: 'authorization_code',\n },\n\n // Admin setup instructions (Markdown)\n setupInstructions: `...`,\n\n // URL to create OAuth app\n createAppUrl: 'https://provider.com/apps/new',\n\n // Custom settings (advanced)\n customSettings: [\n {\n id: 'app_name',\n label: 'App Name',\n type: 'text',\n required: true,\n token: '{APP_NAME}', // Replaces in authorizeUrl\n },\n ],\n },\n},\n```\n\n### Key Options Explained\n\n#### `pkce` (Proof Key for Code Exchange)\n\n**When to use:** Some providers require it (GitHub does NOT, Auth0 does)\n\n```\npkce: true; // Generates code_verifier and code_challenge\n```\n\n#### `clientAuthMethod`\n\n**How to send client credentials during token exchange:**\n\n* `'body'` (default): Send as form fields\n \n ```\n POST /token\n client_id=...&client_secret=...\n ```\n \n* `'header'`: Send as Basic Auth header\n \n ```\n POST /token\n Authorization: Basic base64(client_id:client_secret)\n ```\n \n\n**Use `header` for:** OAuth providers that require Basic Auth (some enterprise providers)\n\n#### `supportsRefreshToken`\n\n**Controls token refresh behavior:**\n\n* `true` (default): Platform auto-refreshes tokens before expiry\n* `false`: Tokens are long-lived (e.g., GitHub Personal Access Tokens)\n\n**Set to `false` if:** Provider doesn’t support refresh tokens or tokens never expire\n\n#### `customSettings`\n\n**For providers with non-standard OAuth requirements:** **Example:** Rippling needs app name in authorize URL:\n\n```\nauthorizeUrl: 'https://api.rippling.com/connect/authorize/{APP_NAME}',\ncustomSettings: [\n {\n id: 'app_name',\n label: 'Rippling App Name',\n type: 'text',\n required: true,\n token: '{APP_NAME}',\n },\n],\n```\n\nPlatform admin enters `app_name` → Platform replaces `{APP_NAME}` in URL.\n\n### Access Token in Checks\n\n```\nrun: async (ctx: CheckContext) => {\n // Access token is automatically available\n const token = ctx.accessToken;\n\n // ctx.fetch() automatically adds Bearer token\n const data = await ctx.fetch('/api/endpoint');\n\n // For custom headers\n const response = await fetch(url, {\n headers: {\n Authorization: `Bearer ${ctx.accessToken}`,\n },\n });\n};\n```\n\n* * *\n\n## API Key\n\n**Best for:** Simple REST APIs with static API keys (e.g., Stripe, SendGrid)\n\n### Configuration\n\n```\nauth: {\n type: 'api_key',\n config: {\n in: 'header', // or 'query'\n name: 'X-API-Key', // Header name or query param name\n prefix: 'Bearer ', // Optional prefix (e.g., \"Bearer \", \"Token \")\n },\n},\n```\n\n### Key Options\n\n#### `in` - Where to send the API key\n\n**Header (recommended):**\n\n```\nin: 'header',\nname: 'X-API-Key',\n\n// Results in:\n// X-API-Key: your-api-key-value\n```\n\n**Query parameter:**\n\n```\nin: 'query',\nname: 'api_key',\n\n// Results in:\n// GET /endpoint?api_key=your-api-key-value\n```\n\n**Use query for:** APIs that don’t accept custom headers (rare)\n\n#### `prefix` - Add a prefix to the key\n\n```\nprefix: 'Bearer ', // Common for tokens\nprefix: 'Token ', // Some APIs use this\nprefix: '', // No prefix (default)\n\n// Example with Bearer:\n// Authorization: Bearer sk_live_abc123...\n```\n\n### Credential Field\n\nUser will see a form field to enter the API key:\n\n```\n// Automatically generated credential field\n{\n id: 'api_key',\n label: 'API Key',\n type: 'password',\n required: true,\n placeholder: 'sk_live_...',\n helpText: 'Found in Settings → API Keys',\n}\n```\n\n### Access in Checks\n\n```\nrun: async (ctx: CheckContext) => {\n // API key is automatically added to requests\n const data = await ctx.fetch('/endpoint');\n\n // Or access it directly\n const apiKey = ctx.credentials.api_key;\n};\n```\n\n* * *\n\n## Basic Auth\n\n**Best for:** APIs using username/password authentication (e.g., some internal tools)\n\n### Configuration\n\n```\nauth: {\n type: 'basic',\n config: {\n usernameField: 'username', // Default, can customize\n passwordField: 'password', // Default, can customize\n },\n},\n```\n\n### Credential Fields\n\nUsers will see two fields:\n\n```\n// Automatically generated\n[\n {\n id: 'username',\n label: 'Username',\n type: 'text',\n required: true,\n },\n {\n id: 'password',\n label: 'Password',\n type: 'password',\n required: true,\n },\n];\n```\n\n### Custom Field Names\n\n```\nauth: {\n type: 'basic',\n config: {\n usernameField: 'email', // Use 'email' instead of 'username'\n passwordField: 'api_token', // Use 'api_token' instead of 'password'\n },\n},\n```\n\n### Access in Checks\n\n```\nrun: async (ctx: CheckContext) => {\n // Basic Auth header is automatically added\n // Authorization: Basic base64(username:password)\n const data = await ctx.fetch('/endpoint');\n\n // Or access credentials directly\n const username = ctx.credentials.username;\n const password = ctx.credentials.password;\n};\n```\n\n* * *\n\n## Custom Auth\n\n**Best for:** Complex authentication requiring multiple fields (AWS IAM Role, Azure Service Principal, GCP Service Account)\n\n### Configuration\n\n```\nauth: {\n type: 'custom',\n config: {\n description: 'AWS IAM Role for cross-account access',\n\n credentialFields: [\n {\n id: 'roleArn',\n label: 'IAM Role ARN',\n type: 'text',\n required: true,\n placeholder: 'arn:aws:iam::123456789012:role/MyRole',\n helpText: 'The ARN of the IAM role to assume',\n },\n {\n id: 'externalId',\n label: 'External ID',\n type: 'password',\n required: true,\n helpText: 'Unique identifier for security',\n },\n {\n id: 'region',\n label: 'AWS Region',\n type: 'combobox',\n required: true,\n placeholder: 'Select or type...',\n helpText: 'Primary region for API calls',\n options: [\n { value: 'us-east-1', label: 'US East (N. Virginia)' },\n { value: 'eu-west-1', label: 'Europe (Ireland)' },\n ],\n },\n ],\n\n setupInstructions: `## Setup Guide\n\n1. Create IAM role in AWS\n2. Copy the Role ARN\n3. Generate External ID\n4. Enter credentials below`,\n },\n},\n```\n\n### Field Types\n\n| Type | UI Component | When to Use | Example |\n| --- | --- | --- | --- |\n| `text` | Text input | Single-line text | Project ID, Account ID |\n| `password` | Password input (hidden) | Secrets, tokens | API keys, passwords |\n| `textarea` | Multi-line textarea | Long text, JSON | Service account JSON key |\n| `select` | Dropdown (fixed options) | Choose from list | Environment (prod/dev) |\n| `combobox` | Dropdown + custom input | Choose or type | AWS region, timezone |\n| `number` | Number input | Numeric values | Port, timeout |\n| `url` | URL input (with validation) | Web addresses | Webhook URL, API endpoint |\n\n### Field Options\n\n```\n{\n id: 'field_name', // Unique identifier (snake_case)\n label: 'Field Label', // Shown to user\n type: 'text', // See table above\n required: true, // Is this field mandatory?\n placeholder: 'example...', // Placeholder text\n helpText: 'Explain where to find this', // Help text below field\n\n // For select/combobox only:\n options: [\n { value: 'val1', label: 'Option 1' },\n { value: 'val2', label: 'Option 2' },\n ],\n}\n```\n\n### Access in Checks\n\n```\nrun: async (ctx: CheckContext) => {\n // All fields available as key-value pairs\n const roleArn = ctx.credentials.roleArn;\n const externalId = ctx.credentials.externalId;\n const region = ctx.credentials.region;\n\n // Custom authentication logic\n const client = await createCustomClient({\n roleArn,\n externalId,\n region,\n });\n};\n```\n\n* * *\n\n## Choosing an Auth Type\n\n### Decision Tree\n\n```\nDoes the service have OAuth?\n├─ YES → Use OAuth 2.0\n│ └─ Best UX, auto token refresh, secure\n│\n└─ NO\n │\n Does it use a single API key?\n ├─ YES → Use API Key\n │ └─ Simple, user just pastes key\n │\n └─ NO\n │\n Does it use username + password?\n ├─ YES → Use Basic Auth\n │ └─ Two fields, encoded automatically\n │\n └─ NO → Use Custom Auth\n └─ Multiple fields, full control\n```\n\n### Comparison: OAuth vs API Key\n\n| Aspect | OAuth 2.0 | API Key |\n| --- | --- | --- |\n| **User Experience** | Best (1-click) | OK (find & paste key) |\n| **Security** | Tokens expire & refresh | Long-lived secrets |\n| **Platform Setup** | Admin must configure | None needed |\n| **Revocation** | User revokes in provider | User must regenerate key |\n| **Scope Control** | Request specific permissions | Key has fixed permissions |\n\n**Recommendation:** Use OAuth if the service supports it.\n\n### Comparison: Basic Auth vs Custom\n\n| Aspect | Basic Auth | Custom Auth |\n| --- | --- | --- |\n| **Fields** | 2 (username/password) | Any number |\n| **Encoding** | Auto (Base64) | Manual in check code |\n| **Use Case** | Simple APIs | Complex auth (AWS, Azure) |\n| **Setup** | Minimal config | Define all fields |\n\n**Use Basic Auth for:** Simple username/password APIs \n**Use Custom Auth for:** Multi-field credentials, service accounts, IAM roles\n\n* * *\n\n## Examples by Service Type\n\n### Cloud Providers (AWS, Azure, GCP)\n\n**Use:** Custom Auth (service accounts, IAM roles) **Why:** These services use multi-field credentials that need custom authentication logic. OAuth is possible but service accounts are the recommended approach for programmatic access.\n\n### SaaS Tools (GitHub, Linear, Notion)\n\n**Use:** OAuth 2.0 **Why:** Best user experience, tokens auto-refresh, users can revoke access easily.\n\n### Internal Tools / Legacy APIs\n\n**Use:** Basic Auth or API Key **Why:** Simpler services often use these methods. Choose based on what the API supports.\n\n* * *\n\n## Advanced OAuth Options\n\n### PKCE (Proof Key for Code Exchange)\n\n**What it is:** Extra security for OAuth (prevents authorization code interception) **When to enable:**\n\n```\npkce: true; // Enable for: Auth0, Okta, some enterprise providers\npkce: false; // Default for: GitHub, Google, Linear\n```\n\n**How it works:** Platform generates a random `code_verifier`, hashes it to create `code_challenge`, sends challenge during authorization, sends verifier during token exchange.\n\n### Client Authentication Method\n\n**How platform authenticates itself to the provider:** **Body (default):**\n\n```\nPOST /token\nContent-Type: application/x-www-form-urlencoded\n\ngrant_type=authorization_code&code=...&client_id=...&client_secret=...\n```\n\n**Header (Basic Auth):**\n\n```\nPOST /token\nAuthorization: Basic base64(client_id:client_secret)\nContent-Type: application/x-www-form-urlencoded\n\ngrant_type=authorization_code&code=...\n```\n\n**Use `header` when:** Provider documentation explicitly requires Basic Auth for client authentication.\n\n**Add extra params to the authorization URL:**\n\n```\nauthorizationParams: {\n access_type: 'offline', // Google: Request refresh token\n prompt: 'consent', // Force consent screen (always request scopes)\n response_mode: 'query', // How to return auth code\n}\n```\n\n**Common use cases:**\n\n* `access_type: 'offline'` - Google APIs (get refresh token)\n* `prompt: 'consent'` - Always show consent screen (good for testing)\n* Custom provider-specific params\n\n* * *\n\n## Security Best Practices\n\n### API Keys\n\n* Use `type: 'password'` for sensitive fields (hidden input)\n* Store in credential vault (auto-encrypted)\n* Never log API keys\n* Add help text explaining where to find/generate the key\n\n### OAuth\n\n* Request minimum scopes needed\n* Use `access_type: 'offline'` for refresh tokens\n* Set `supportsRefreshToken: true` to auto-refresh\n* Explain scope requirements in setup instructions\n\n### Basic Auth\n\n* Both username and password are required\n* Password field is auto-hidden\n* Credentials are auto-encoded to Base64\n* Never log passwords\n\n### Custom Auth\n\n* Mark sensitive fields as `type: 'password'`\n* Validate all required fields in checks\n* Handle missing fields gracefully\n* Don’t expose credential values in logs/errors\n\n* * *\n\n## Complete OAuth Example\n\n```\nauth: {\n type: 'oauth2',\n config: {\n authorizeUrl: 'https://github.com/login/oauth/authorize',\n tokenUrl: 'https://github.com/login/oauth/access_token',\n scopes: ['repo', 'read:org', 'read:user'],\n pkce: false,\n clientAuthMethod: 'body',\n supportsRefreshToken: false, // GitHub tokens don't expire\n authorizationParams: {\n allow_signup: 'false', // Don't show sign-up on consent\n },\n setupInstructions: `## Create GitHub OAuth App\n\n1. Go to https://github.com/settings/developers\n2. Click \"New OAuth App\"\n3. Enter:\n - Application name: Your app name\n - Homepage URL: https://yourapp.com\n - Callback URL: [shown below]\n4. Click \"Register application\"\n5. Copy Client ID and generate Client Secret\n6. Paste both below`,\n createAppUrl: 'https://github.com/settings/apps/new',\n },\n},\n```\n\n* * *\n\n## Testing Your Auth\n\n### OAuth\n\n1. Configure platform credentials in `/admin/integrations`\n2. Go to `/integrations` and click Connect\n3. Should redirect to provider OAuth screen\n4. Authorize → Should redirect back successfully\n5. Check connection is active\n\n### API Key / Basic / Custom\n\n1. Go to `/integrations` and click Connect\n2. Form should show your credential fields\n3. Enter test credentials\n4. Connection should be created successfully\n5. Run a check to verify credentials work\n\n### Debug OAuth Issues\n\nCheck API logs for:\n\n* `OAuth completed for [provider]` - Success\n* `OAuth callback error` - Authorization failed\n* `Token exchange failed` - Bad client credentials\n* `Invalid state` - State mismatch (check callback URL)\n\n* * *\n\n## Summary\n\n**Choose your auth type:**\n\n* **Service has OAuth?** → Use OAuth 2.0\n* **Single API key?** → Use API Key\n* **Username/password?** → Use Basic Auth\n* **Multiple fields or complex?** → Use Custom Auth\n\n**OAuth is best when available** - better UX, security, and user control.","2025-12-16T19:35:43.365Z","84db0adb-a23f-4a1b-b740-c609d9a522ca",[],[],[],"Approve access request - Comp AI - Documentation","approve-access-request-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/trust-access/approve-access-request","# Approve access request - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\n#### Path Parameters\n\n#### Body\n\n#### Response\n\nRequest approved successfully","2025-11-25T14:41:39.954Z","2026-07-07T16:01:51.822Z","2803c957-2c75-47e4-8cb0-34d5b0b295fe",[],[],[],"Aikido Security - Comp AI - Documentation","aikido-security-comp-ai-documentation","https://www.trycomp.ai/docs/integrations/aikido","# Aikido Security - Comp AI\n\n> ## Documentation Index\n>\n> Fetch the complete documentation index at: \n>\n> Use this file to discover all available pages before exploring further.\n\n## Overview\n\nThe Aikido Security integration syncs vulnerability and repository scanning data into Comp AI, so compliance tasks can be automatically satisfied with continuous evidence.\n\n## What Comp AI Collects\n\n### Secure Code evidence\n\n- Open security issues (by severity)\n- Repository scanning activity\n- Stale scans (repos not scanned in over 7 days)\n\n### Monitoring and Alerting evidence\n\n- Issue count thresholds (configurable)\n- Severity breakdown summaries\n\n## Configuration Options\n\nAfter connecting, you can configure:\n\n- **Minimum severity to fail on** (low, medium, high, critical)\n- **Maximum allowed open issues** (threshold check)\n- **Repositories to monitor** (optional filter)\n- **Include snoozed issues** (optional)\n\n## Verify It Works\n\n1. Open the Aikido integration in Comp AI\n2. Click **Run** on any check\n3. You should see a recent run with passing or failing evidence ![Example check run](/api/knowledge-base/images/f0c5aeb9-dd71-4895-87f0-85cbe04b5759)\n\nIf a check fails with `HTTP 401: Unauthorized`, verify the Client ID and Client Secret and ensure the required permissions are enabled in Aikido.\n\n## References\n\n- Aikido API docs: \n","2026-05-19T19:46:40.616Z","2026-07-07T16:01:51.821Z","8a53d44f-0775-4c31-bff6-5f2bfb2124a6",[],[],[],"Add multiple members to organization - Comp AI - Documentation","add-multiple-members-to-organization-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/people/add-multiple-members-to-organization","# Add multiple members to organization - Comp AI\n\n```\n{\n \"created\": [\n {\n \"id\": \"mem_abc123def456\",\n \"organizationId\": \"org_abc123def456\",\n \"userId\": \"usr_abc123def456\",\n \"role\": \"member\",\n \"createdAt\": \"2024-01-01T00:00:00Z\",\n \"department\": \"it\",\n \"isActive\": true,\n \"fleetDmLabelId\": 123,\n \"user\": {\n \"id\": \"usr_abc123def456\",\n \"name\": \"John Doe\",\n \"email\": \"john.doe@company.com\",\n \"emailVerified\": true,\n \"image\": \"https://example.com/avatar.jpg\",\n \"createdAt\": \"2024-01-01T00:00:00Z\",\n \"updatedAt\": \"2024-01-15T00:00:00Z\",\n \"lastLogin\": \"2024-01-15T12:00:00Z\"\n }\n }\n ],\n \"errors\": [\n {\n \"index\": 2,\n \"userId\": \"usr_xyz789abc123\",\n \"error\": \"User user2@example.com is already a member of this organization\"\n }\n ],\n \"summary\": {\n \"total\": 2,\n \"successful\": 1,\n \"failed\": 1\n },\n \"authType\": \"api-key\",\n \"authenticatedUser\": {\n \"id\": \"usr_admin123\",\n \"email\": \"admin@company.com\"\n }\n}\n```","2025-11-25T14:46:37.901Z","2026-07-07T16:01:51.820Z","7ebbe9c5-d80a-41b5-be64-b3b7a7a1d81e",[],[],[],"Access - Comp AI - Documentation","access-comp-ai-documentation","https://trycomp.ai/docs/trust-access","## Overview\n\nTrust Access enables secure, controlled access to your compliance documentation for external users. This system manages the complete access lifecycle—from initial requests through NDA signing, access grants, and ongoing management—while maintaining full audit trails for compliance purposes.\n\n## 1\\. Key Concepts\n\nTrust Access consists of four core components:\n\n* **Access Request:** An external user’s initial request to access your compliance documentation.\n* **NDA Agreement:** A legally binding document that must be digitally signed before access is granted.\n* **Access Grant:** A time-limited authorization window (configurable, default 30 days) during which the user has access.\n* **Access Link:** A secure, time-limited email link that authenticates the user and grants portal access.\n\n### Time Limits and Expiration\n\nEach component has specific time constraints:\n\n| Item | Duration | Notes |\n| --- | --- | --- |\n| **NDA Signing Link** | **7 Days** | Expires if not signed within 7 days. Administrators can resend the link. |\n| **Access Grant** | **7–365 Days** | Configurable access window. Default duration is 30 days. |\n| **Access Link** | **24 Hours** | Email authentication links expire after 24 hours for security. |\n\n* * *\n\n## 2\\. Prerequisites\n\nBefore using Trust Access, ensure the following is configured:\n\n1. **Published Trust Portal:** The portal must be published and publicly accessible for users to submit access requests.\n\n* * *\n\n## 3\\. Workflow: Step-by-Step\n\n### Step 1: Access Request Submission\n\nWhen external visitors access your public Trust Portal, they see a **Request Access** button. Clicking this button opens a form where they provide:\n\n* Full name and email address\n* Company name and job title\n* Reason for requesting access\n\n![Trust Portal with Request Access button](https://mintcdn.com/bubbaaiinc/_DS3Mh90qeqK7soD/images/trust-access-portal-request-button.png?fit=max&auto=format&n=_DS3Mh90qeqK7soD&q=85&s=ceff3db8fd881b9c70d225cec5a612bd) ![Access Request Form](https://mintcdn.com/bubbaaiinc/_DS3Mh90qeqK7soD/images/trust-access-request-form.png?fit=max&auto=format&n=_DS3Mh90qeqK7soD&q=85&s=09baf02a3219b0bf92f342d7b2a2e010) New access requests appear in the **Trust Access Management** dashboard with `Pending` status. If the user already has an active access grant, they see: _“You already have active access.”_ If a pending request exists, duplicate submissions are blocked.\n\n### Step 2: Administrative Review and Decision\n\nAccess the **Trust Access Management** dashboard to view all pending access requests. Each request displays the requester’s information, purpose, submission timestamp, and current status. ![Access Request Detail View](https://mintcdn.com/bubbaaiinc/_DS3Mh90qeqK7soD/images/trust-access-admin-request-details.png?fit=max&auto=format&n=_DS3Mh90qeqK7soD&q=85&s=15cae9507eb3965b78bd5ff50336dcf3)\n\n#### Option A: Approve Access Request\n\n1. Click on the request to view complete details\n2. Configure the access grant period (7-365 days, default 30 days)\n3. Click **Approve & Send NDA** to proceed\n\n![Approve Access Request with Duration Configuration](https://mintcdn.com/bubbaaiinc/_DS3Mh90qeqK7soD/images/trust-access-admin-approve-duration.png?fit=max&auto=format&n=_DS3Mh90qeqK7soD&q=85&s=e174354ab624b48fc70878ad94636d01) Request status changes to `Approved`, a pending NDA agreement is generated, and an email is sent to the requester with an NDA signing link (valid for 7 days). The requester receives an email notification: _“NDA Signature Required”_ with a secure link to review and sign the NDA. ![NDA Signature Required Email](https://mintcdn.com/bubbaaiinc/_DS3Mh90qeqK7soD/images/trust-access-email-nda-required.png?fit=max&auto=format&n=_DS3Mh90qeqK7soD&q=85&s=461f73346e55165cddb3b3498ab82218)\n\n#### Option B: Deny Access Request\n\n1. Provide a reason for denial\n2. Click **Deny** to reject the request\n\n![Deny Access Request Dialog](https://mintcdn.com/bubbaaiinc/_DS3Mh90qeqK7soD/images/trust-access-admin-deny-dialog.png?fit=max&auto=format&n=_DS3Mh90qeqK7soD&q=85&s=1f5de638f60fa3b6482510e24e53f406) Request status changes to `Denied` and the denial reason is logged in the audit trail. No email notification is sent to the requester.\n\n### Step 3: NDA Signing Process\n\n1. The requester receives an email with subject _“NDA Signature Required”_ containing a secure signing link\n2. Clicking the link opens a secure page displaying the complete NDA document\n3. They provide their digital signature to accept the agreement\n4. After signing, they receive confirmation that the NDA has been completed\n\n![NDA Signing Page](https://mintcdn.com/bubbaaiinc/_DS3Mh90qeqK7soD/images/trust-access-nda-signing-page.png?fit=max&auto=format&n=_DS3Mh90qeqK7soD&q=85&s=017da9ce601b60145f2ecbb9ee574a3f) NDA status updates to `Signed` in the dashboard, the signed NDA PDF is available for download, and the access grant is automatically activated. The audit log captures the signing timestamp, signer’s IP address, User Agent information, and the final signed PDF document. ![Dashboard showing Signed NDA status](https://mintcdn.com/bubbaaiinc/_DS3Mh90qeqK7soD/images/trust-access-admin-nda-signed.png?fit=max&auto=format&n=_DS3Mh90qeqK7soD&q=85&s=8bc4c45cec972f2b47b6a26ac1e53de6) If the 7-day signing window expires, administrators see `NDA Link Expired` status and can use **Resend NDA** to generate a new link. If users attempt to access an already-signed NDA link, they are redirected to the portal.\n\n### Step 4: Portal Access Granted\n\nAfter successfully signing the NDA, users receive an email notification: _“Access Granted”_. This email contains their first **Access Link** (valid for 24 hours). Once authenticated via the access link, users are presented with a tabbed interface providing access to different features: ![Trust Portal with Access Granted - Navigation tabs](https://mintcdn.com/bubbaaiinc/1A9KM7Y-BLiOxWJQ/images/trust-nav-tabs.png?fit=max&auto=format&n=1A9KM7Y-BLiOxWJQ&q=85&s=71cf29bfdf4dd37d313ade0527b157ab)\n\n#### Documents Tab (Default)\n\nThe **Documents** tab is selected by default and provides access to compliance documentation:\n\n* **Compliance Resources Section:** Browse and read all published, non-archived compliance policies organized by category\n\n![Trust Portal with Access Granted - Compliance Resources Section](https://mintcdn.com/bubbaaiinc/1A9KM7Y-BLiOxWJQ/images/compliance-resources-section.png?fit=max&auto=format&n=1A9KM7Y-BLiOxWJQ&q=85&s=340fb63d92bb7fe58cdfd09eb854860f)\n\n* **PDF Bundle Generation:** Generate a single PDF bundle containing all accessible policies\n * The downloaded PDF bundle is watermarked with the user’s full name, email address, and a unique document identifier\n\n![Trust Portal with Access Granted - Document View](https://mintcdn.com/bubbaaiinc/_DS3Mh90qeqK7soD/images/trust-access-portal-view.png?fit=max&auto=format&n=_DS3Mh90qeqK7soD&q=85&s=b4d45651fe56181e07084cd82e6e6621)\n\n#### Security Questionnaire Tab\n\n![Trust Portal with Access Granted - Security Questionnaire](https://mintcdn.com/bubbaaiinc/1A9KM7Y-BLiOxWJQ/images/security-questionnaire-section.png?fit=max&auto=format&n=1A9KM7Y-BLiOxWJQ&q=85&s=5470f88bcc3da5645446a528346bab1c) The **Security Questionnaire** tab enables external users to automatically parse and answer security questionnaires using the organization’s compliance documentation. **Questionnaire Upload Interface:**\n\n1. **File Upload Field:** Upload your security questionnaire file\n * Supported formats: PDF, CSV, Excel (.xlsx, .xls)\n * File must be readable and not corrupted\n * Maximum file size: 10MB\n2. **Output Format Selection:** Choose the format for the processed questionnaire\n * **Excel (.xlsx)** - Default format, editable in Excel\n * **PDF** - Final submission format\n * **CSV** - Simple data exchange format\n3. **Upload & Process Button:** Submit the questionnaire for processing\n * The system automatically extracts questions from your file\n * Answers are generated based on the organization’s published policies\n * Processing typically takes 5-30 seconds depending on file type and size\n\nAfter processing, the completed questionnaire is automatically downloaded with all questions answered based on the organization’s compliance documentation. Users can review and edit answers before final submission.\n\nAccess grant status shows as `Active` in the dashboard, the grant expiration date is visible, and all activity (document downloads and questionnaire submissions) is logged for audit purposes.\n\n* * *\n\n## 4\\. Managing Active Access\n\n### Reclaiming Access (Expired Access Links)\n\nAccess links expire after 24 hours. If a user attempts to use an expired link, they can reclaim access without administrator intervention:\n\n1. Navigate to the Trust Portal\n2. Click **Reclaim Access**\n3. Enter their email address\n\n![Reclaim Access button and form](https://mintcdn.com/bubbaaiinc/_DS3Mh90qeqK7soD/images/trust-access-reclaim-access.png?fit=max&auto=format&n=_DS3Mh90qeqK7soD&q=85&s=e9b5e2e8d52316fefe1d03a24602701d) If their access grant is still within the valid period, the system automatically sends a new 24-hour access link via email. If their access grant has expired, they see: _“No active access found”_ and must submit a new access request. Reclaim attempts are logged in the audit trail.\n\n### Revoking Access\n\nAccess can be revoked at any time through the **Grants** section of the dashboard:\n\n1. Navigate to the **Grants** list in the dashboard\n2. Locate the active grant for the user\n3. Click **Revoke**\n4. Enter a reason for revocation\n\nGrant status immediately changes to `Revoked`, the signed NDA is marked as `Void`, all active access links are immediately invalidated, and the revocation action is logged in the audit trail. Any active access links stop working immediately, and users must submit a new access request if access is needed again.","2025-12-16T19:34:41.206Z","2026-07-07T16:01:51.819Z","a66a1e60-de5a-4ae6-8fc1-2263ec01921b",[],[],[],"App","app","Comp AI App","2026-07-07T15:56:48.731Z","f5ebaba3-40a2-4621-9a17-5f8c9526ada9",10,[1621,1622,1623,1624,1625,1626,1627,1628,1629,1630],[],{"_74":1711,"_162":1712,"_164":-5,"_166":1713,"_168":1617,"_169":-5,"_170":1714,"_172":1715,"_15":1716,"_17":18,"_176":1717,"_178":-5,"_179":1718,"_181":1719},{"_74":1701,"_162":1702,"_164":1703,"_166":1704,"_168":1617,"_169":-5,"_170":1705,"_172":1706,"_15":1707,"_17":18,"_176":1708,"_178":-5,"_179":1709,"_181":1710},{"_74":1692,"_162":1693,"_164":-5,"_166":1694,"_168":1617,"_169":-5,"_170":1695,"_172":1696,"_15":1697,"_17":18,"_176":1698,"_178":-5,"_179":1699,"_181":1700},{"_74":237,"_162":1685,"_164":-5,"_166":1686,"_168":1617,"_169":-5,"_170":1687,"_172":1687,"_15":1688,"_17":18,"_176":1689,"_178":-5,"_179":1690,"_181":1691},{"_74":1676,"_162":1677,"_164":-5,"_166":1678,"_168":1617,"_169":-5,"_170":1679,"_172":1680,"_15":1681,"_17":18,"_176":1682,"_178":-5,"_179":1683,"_181":1684},{"_74":1667,"_162":1668,"_164":-5,"_166":1669,"_168":1617,"_169":-5,"_170":1670,"_172":1671,"_15":1672,"_17":18,"_176":1673,"_178":-5,"_179":1674,"_181":1675},{"_74":1658,"_162":1659,"_164":-5,"_166":1660,"_168":1617,"_169":-5,"_170":1661,"_172":1662,"_15":1663,"_17":18,"_176":1664,"_178":-5,"_179":1665,"_181":1666},{"_74":1649,"_162":1650,"_164":-5,"_166":1651,"_168":1617,"_169":-5,"_170":1652,"_172":1653,"_15":1654,"_17":18,"_176":1655,"_178":-5,"_179":1656,"_181":1657},{"_74":1640,"_162":1641,"_164":-5,"_166":1642,"_168":1617,"_169":-5,"_170":1643,"_172":1644,"_15":1645,"_17":18,"_176":1646,"_178":-5,"_179":1647,"_181":1648},{"_74":1631,"_162":1632,"_164":-5,"_166":1633,"_168":1617,"_169":-5,"_170":1634,"_172":1635,"_15":1636,"_17":18,"_176":1637,"_178":-5,"_179":1638,"_181":1639},"Vendor Management ","vendor-management","**Product area:** Vendors (Third-Party Risk Management)\\\n**Summary:** The Vendors module is where a customer tracks their third parties (cloud providers, SaaS tools, processors), assesses each one's risk, and works it down with a treatment plan and linked tasks. Comp AI can auto-research a vendor's security posture with AI to draft the assessment, and vendors can be published as subprocessors on the public Trust Center.\n\n**Disambiguation (use to route questions correctly):**\n\n- **Vendors** = your third parties and their risk.\n- **Risk Management** = your own internal risks (vendors use the same scoring model but live in their own module under a \"vendor management\" risk category).\n- **Trust Center** = where vendors can appear publicly as **subprocessors**.\n- **People → offboarding** = where a departing employee's vendor access is revoked.\n- If a customer asks \"how do I assess a SaaS tool we use?\" → Vendors.\n\n---\n\n## **Core facts**\n\n- **Where:** the **Vendors** tab lists your vendors; each has its own detail page.\n- **Scored like risks:** vendors use the same likelihood × impact model, with **inherent** and **residual** scores, and a treatment strategy (Mitigate/Accept/Transfer/Avoid).\n- **AI assessment:** Comp AI can research a vendor (its website, security pages, certifications, and news) to draft the risk assessment and pre-fill its inherent risk.\n- **Global vendor catalog:** when adding a vendor, autocomplete pulls name/website/description from a global vendor database.\n- **Mitigation = tasks:** vendors are worked down by linking tasks, just like risks.\n- **Subprocessor publishing:** any vendor can be shown on the public Trust Center with a logo and compliance badges.\n\n---\n\n## **What a vendor contains**\n\n- **Name**, **description**, **website**.\n- **Category** (Cloud, Infrastructure, SaaS, Finance, Marketing, Sales, HR, Other).\n- **Status** (assessment progress).\n- **Owner (assignee)**.\n- **Inherent** and **residual** likelihood/impact, plus a **treatment strategy** and plan.\n- **Contacts** (name, email, phone).\n- **Trust Center settings:** show-on-portal toggle, display order, logo, and compliance badges.\n- **Linked work:** tasks (mitigation) and any findings.\n\n---\n\n## **Vendor list view**\n\n- **Columns:** Vendor Name, Status, Category, Assignee, and a delete action.\n- **Filters/search:** by name, status, category, and assignee.\n- In-progress vendors show a **\"Researching\"** indicator while an AI assessment runs.\n\n---\n\n## **Statuses (what each means)**\n\n| **Status** | **Label shown** | **Meaning** |\n| --- | --- | --- |\n| Not assessed | **Not Assessed** | No risk assessment yet. |\n| In progress | **In Progress / Researching** | Assessment underway (including AI research). |\n| Assessed | **Assessed** | Risk assessment complete. |\n\n> Vendor risk scoring uses the same 1–5 **likelihood** and **impact** scales as the Risk module, producing inherent and residual scores.\n\n---\n\n## **Creating & managing vendors**\n\n- **Create** via the create-vendor sheet: start typing the name and pick from **global vendor suggestions** (which pre-fill website and description), or create a custom entry. Set description, category, status, and optionally an assignee.\n- **Edit** vendor details (name, description, assignee, status, category, website, subprocessor flag) on the **Overview** tab.\n- **Assign an owner** from eligible members (employees/contractors can't be vendor owners).\n- **Delete** from the list with a confirmation.\n\n---\n\n## **Risk assessment & treatment**\n\n**Detail tabs:** Overview, Treatment Plan, Risk Matrix, Risk Assessment, Tasks, Comments, Activity, Settings.\n\n- **Risk Matrix** — set inherent and residual likelihood/impact on a 5×5 matrix; current risk interpolates toward the residual target as linked tasks complete (same model as the Risk module).\n- **Treatment Plan** — choose a strategy (Mitigate/Accept/Transfer/Avoid) and link tasks as the mitigation work; Comp AI can **suggest links** to relevant tasks for you to apply.\n- **Risk Assessment** — the AI-generated profile: security posture, certifications, a timeline, and any security news found during research.\n\n---\n\n## **AI vendor research**\n\n- Trigger it via **Regenerate Assessment** (Settings tab), or automatically during vendor import when a website is present.\n- Comp AI scrapes the vendor's site (trust/security pages, certifications) and searches for security incidents/news, then builds a structured assessment and pre-fills inherent risk.\n- It also creates a **\"Verify risk assessment\"** task so a human reviews the AI output.\n- Progress streams live while the research runs.\n\n---\n\n## **Tasks, evidence & findings**\n\n- **Create vendor tasks** (title, description, assignee, due date) or link existing tasks as mitigation.\n- Evidence (e.g., a vendor's SOC 2 report) is attached on the **linked tasks**; vendors can also have **findings**.\n- Linked task completion drives the vendor's current risk score toward its residual target.\n\n---\n\n## **Trust Center (subprocessors)**\n\nAny vendor can be published on the public Trust Center as a subprocessor:\n\n- Toggle **show on Trust Portal**, set its **display order**, show its **logo**, and attach **compliance badges** (SOC 2, ISO 27001, ISO 42001, GDPR, HIPAA, PCI DSS, NEN 7510, ISO 9001) — each marked verified or not.\n\n(See the **Trust Center** article for the public-page side.)\n\n---\n\n## **Vendor access revocation (offboarding)**\n\nWhen an employee is offboarded, the system tracks the vendors they had access to so the team can confirm each access has been revoked (with evidence), as part of the offboarding checklist in the People tab.\n\n---\n\n## **Roles & permissions (who can do what)**\n\n| **Capability** | **Owner** | **Admin** | **Auditor** |\n| --- | --- | --- | --- |\n| View vendors | ✓ | ✓ | ✓ (read-only) |\n| Create vendors | ✓ | ✓ | ✗ |\n| Edit, assess, link tasks, publish to Trust Center | ✓ | ✓ | ✗ |\n| Delete vendors | ✓ | ✓ | ✗ |\n\n(Uses the `vendor` permission.)\n\n---\n\n## **Sample Q&A (canned answers the agent can adapt)**\n\n**Q: How do I add a vendor?**\\\nA: Open the Vendors tab and use the create-vendor sheet. Start typing the vendor's name and pick a suggestion from the global catalog (which fills in the website and description), or create a custom one. Set the category, status, and an owner.\n\n**Q: Does Comp AI assess vendors automatically?**\\\nA: Yes. Comp AI can research a vendor's website, certifications, and security news to draft a risk assessment and pre-fill its inherent risk. You can trigger it with **Regenerate Assessment**, and it creates a \"Verify risk assessment\" task for someone to review the result.\n\n**Q: How is vendor risk scored?**\\\nA: Vendors use the same likelihood × impact model as the Risk module, with inherent (before controls) and residual (target) scores. Current risk moves toward the residual target as the linked mitigation tasks are completed.\n\n**Q: How do I reduce a vendor's risk?**\\\nA: On the Treatment Plan tab, choose a strategy (usually Mitigate) and link tasks that address the risk — Comp AI can suggest relevant ones. Completing those tasks moves the vendor's current risk toward your residual target.\n\n**Q: Where do I store a vendor's SOC 2 report?**\\\nA: Attach it to one of the vendor's linked tasks — evidence lives on the tasks rather than directly on the vendor record.\n\n**Q: How do I list a vendor as a subprocessor on our Trust Center?**\\\nA: In Trust → portal settings (Vendors), toggle the vendor to show on the portal, set its order, and add its compliance badges. It'll then appear publicly with its logo.\n\n**Q: What happens to a vendor's access when an employee leaves?**\\\nA: During offboarding (in the People tab), the system lists the vendors that employee had access to so your team can confirm each one has been revoked, with evidence.","2026-06-25T23:35:54.476Z","2026-07-07T16:19:47.243Z","1957a071-7c0d-4718-8dc2-844d90beb5cc",[],[],[],"Trust Center","trust-center","**Product area:** Trust Center (Trust Portal)\\\n**Summary:** The Trust Center is a customer's public security/compliance page for sharing their posture with prospects, customers, and vendors — frameworks and certifications, policies, documents, subprocessors, FAQs, and links. It can be fully public or gated behind an access request + NDA, hosted on a Comp AI URL or the customer's own custom domain, and branded to match the company.\n\n**Disambiguation (use to route questions correctly):**\n\n- **Trust Center** = the *outward-facing* page that shows compliance posture to the public.\n- **Frameworks / Policies / Vendors** tabs = where the underlying content is *managed*; the Trust Center decides what's *shown publicly*.\n- **Employee Portal** = inward-facing (employees doing tasks) — not related to the Trust Center.\n- If a customer asks \"how do I share our SOC 2 / policies with a prospect?\" → Trust Center.\n\n---\n\n## **Core facts**\n\n- **Turn it on:** the Trust Center is toggled on/off; when on, the page is **Published**, when off it's **Draft** (not publicly visible).\n- **Two URLs:** a Comp AI URL (a friendly slug, defaulting to the org ID) or a verified **custom domain** (e.g. `trust.yourcompany.com`).\n- **Public or gated:** content can be open to everyone, or **gated** so visitors must request access and (optionally) sign an NDA before downloading.\n- **Branded:** favicon, brand color, overview title/description, and your company name are customizable.\n- **Permissions:** configured by Owners/Admins (the `trust` permission).\n\n---\n\n## **Finding your Trust Center URLs**\n\n- **Trust Center settings page:** `app.trycomp.ai/\\[org_id\\]/trust` — replace `\\[org_id\\]` with your organization's ID.\n- **Live public Trust Center page:** `trust.inc/\\[org-slug\\]` — replace `\\[org-slug\\]` with your organization's slug (e.g. `trust.inc/your-company-name`).\n\nBoth URLs are also visible from within the Trust → Overview area of the admin panel.\n\n---\n\n## **Admin panel — sections**\n\nThe admin side has three top-level areas plus the portal-content tabs:\n\n| **Area** | **Purpose** |\n| --- | --- |\n| **Overview** | Portal status, public URL, and summary; enable/disable the portal. |\n| **Access Requests** | Review visitor access requests and manage NDAs and grants. |\n| **Settings** | Contact info, custom domain, and allowed emails/domains (NDA bypass). |\n\n**Portal-content tabs** (what appears on the public page):\n\n| **Tab** | **What it controls** |\n| --- | --- |\n| **Frameworks** | Which built-in and custom frameworks show, their status, and certificate uploads. |\n| **Mission** | The overview/hero title and description. |\n| **Branding** | Favicon and brand color. |\n| **Vendors** | Which subprocessors/vendors are shown and in what order. |\n| **Links** | Custom external links shown on the page. |\n| **FAQ** | Public question-and-answer entries. |\n| **Documents** | Additional compliance documents/resources for visitors. |\n\n---\n\n## **Branding & appearance**\n\n- **Brand color** — a hex color used across buttons, links, and accents.\n- **Favicon** — uploaded image (recommend 32×32 PNG/ICO).\n- **Overview title** (up to \\~200 chars) and **overview content/description** (up to \\~10,000 chars, supports formatting).\n- **Company name** is pulled from your organization settings.\n\n---\n\n## **Custom domain setup**\n\n1. Enter your domain (e.g. `trust.acme.com`) in the custom-domain settings.\n2. Add the DNS records Comp AI shows you at your domain provider:\n - A **CNAME** pointing your subdomain to the provided target.\n - A **TXT** record for Comp AI verification (and, in some cases, a `_vercel` TXT record for ownership).\n3. Click **Check DNS record** to verify.\n4. Once verified, your Trust Center serves from the custom domain (with SSL) instead of the Comp AI URL.\n\n**Domain statuses:** **Verified** (records match), **Not Verified** (missing/incorrect), **Misconfigured** (DNS reported as misconfigured).\n\n---\n\n## **Frameworks on the public page**\n\n- **Built-in frameworks** (e.g. SOC 2 Type 1 & 2, SOC 3, ISO 27001, ISO 42001, ISO 9001, HIPAA, GDPR, PCI DSS, NEN 7510, PIPEDA, CCPA) each have a toggle, a status, and an optional certificate (PDF) upload.\n- **Custom frameworks** can also be enabled, given a status, and shown with an uploaded badge (or an initials avatar).\n- **Framework status (shown publicly):** **Started**, **In Progress**, or **Compliant**.\n\n---\n\n## **Documents, vendors, FAQs & links**\n\n- **Documents** — upload additional compliance resources (with a name and description) for visitors; downloads are served via secure, time-limited links.\n- **Vendors / subprocessors** — toggle which vendors appear, set their display order, and show compliance badges.\n- **FAQ** — add question/answer pairs shown in a collapsible section.\n- **Links** — add titled external links (reorderable) shown as buttons/cards.\n\n---\n\n## **Access control & access requests (key flow)**\n\nThe Trust Center can require visitors to request access before downloading sensitive materials.\n\n**Visitor flow:**\n\n1. **Request access** — visitor submits a form (name, email, optional company, job title, purpose).\n2. **Admin reviews** in the Access Requests tab — **Approve** (with a duration) or **Deny** (with a reason).\n3. **NDA** — if required, the visitor gets an email link to review and **sign the NDA** (a watermarked PDF is stored). Admins can **Preview NDA** or **Resend NDA**.\n4. **Access granted** — the visitor receives a time-limited access token (default \\~30 days) to download policies, certificates, and documents.\n\n**NDA bypass:** admins can pre-approve **allowed emails** or **allowed domains** (e.g. anyone `@partner.com`) so matching visitors skip the NDA and get access directly.\n\n**Managing grants:** admins can **Revoke** an active grant or **Resend Access Email** from the grants view.\n\n---\n\n## **Statuses (what each means)**\n\n**Portal status**\n\n| **Status** | **Meaning** |\n| --- | --- |\n| **Published** | Portal is live and publicly accessible. |\n| **Draft** | Portal is off / not publicly visible. |\n\n**Framework status (public)**\n\n| **Status** | **Meaning** |\n| --- | --- |\n| **Started** | Compliance work has begun. |\n| **In Progress** | Actively being pursued. |\n| **Compliant** | Certified/met. |\n\n**Access request status**\n\n| **Status** | **Meaning** |\n| --- | --- |\n| **Under review** | Awaiting admin decision. |\n| **Approved** | Approved (signing NDA or has access). |\n| **Denied** | Rejected, with a reason. |\n| **Canceled** | Withdrawn/cancelled. |\n\n**Access grant status**\n\n| **Status** | **Meaning** |\n| --- | --- |\n| **Active** | Token valid; visitor can download. |\n| **Expired** | Access window has passed. |\n| **Revoked** | Manually revoked by an admin. |\n\n**NDA status:** **Pending** (sent, awaiting signature) → **Signed** → **Void** (cancelled/invalidated).\n\n---\n\n## **Roles & permissions (who can do what)**\n\n| **Capability** | **Owner** | **Admin** | **Auditor** |\n| --- | --- | --- | --- |\n| View Trust settings, requests, grants | ✓ | ✓ | ✓ (read-only) |\n| Enable/disable portal, edit branding/content | ✓ | ✓ | ✗ |\n| Set up custom domain | ✓ | ✓ | ✗ |\n| Approve/deny requests, manage NDAs/grants | ✓ | ✓ | ✗ |\n\n---\n\n## **Sample Q&A (canned answers the agent can adapt)**\n\n**Q: Where do I find my Trust Center settings?**\\\nA: Go to `app.trycomp.ai/\\[org_id\\]/trust` (replace `\\[org_id\\]` with your organization's ID). You can also navigate there from within the app via the Trust section.\n\n**Q: Where is my live public Trust Center page?**\\\nA: Your public Trust Center is at `trust.inc/\\[org-slug\\]` (e.g. `trust.inc/your-company-name`). You can also find this URL in the Trust → Overview area of your settings.\n\n**Q: How do I turn on our Trust Center?**\\\nA: In the Trust → Overview area, enable the portal. Once on, it's **Published** and reachable at your Comp AI Trust URL (or your custom domain once verified). Turning it off sets it back to **Draft** and hides it.\n\n**Q: Can I host the Trust Center on our own domain?**\\\nA: Yes. Enter your domain (e.g. trust.yourcompany.com) in custom-domain settings, add the CNAME and TXT records it gives you at your DNS provider, then click **Check DNS record**. Once verified, your page serves from that domain with SSL.\n\n**Q: How do I show our SOC 2 / ISO 27001 on the page?**\\\nA: In the **Frameworks** tab, toggle the framework on, set its status (Started, In Progress, or Compliant), and optionally upload the certificate PDF. Custom frameworks work the same way with an uploaded badge.\n\n**Q: Do visitors have to request access, or is the page public?**\\\nA: Either. You can keep it open, or gate downloads behind an access request. Visitors submit a request, you approve it (and optionally require an NDA), and they get a time-limited link to download materials.\n\n**Q: Can I let everyone at a partner company in automatically?**\\\nA: Yes. Add their email or their whole domain to **allowed emails/domains** in Settings — matching visitors skip the NDA and get access directly.\n\n**Q: How do I cut off someone's access?**\\\nA: In the Access Requests → grants view, **Revoke** their grant. It takes effect immediately. Grants also expire automatically at the end of their approved window.\n\n**Q: What can I customize on the page's look?**\\\nA: Your favicon, brand color, and the overview title/description. Your company name comes from your organization settings.\n\n**Q: Can I list our subprocessors?**\\\nA: Yes — in the **Vendors** tab, toggle which vendors appear, set their order, and add compliance badges. They'll show on the public page.","2026-06-25T23:04:13.851Z","2026-07-07T16:19:47.244Z","d97d5cf7-5786-4b18-a554-e98a9c669399",[],[],[],"Risk Management","risk-management","**Product area:** Risk Management (Risks)\\\n**Summary:** The Risk module is a risk register where a customer identifies risks, scores them by likelihood and impact, assigns an owner, and works them down with a treatment plan and linked mitigation tasks. It tracks both **inherent** risk (before controls) and **residual** risk (the target after treatment), and shows current risk moving toward the target as mitigation work is completed. Comp AI can also generate an initial set of risks and mitigation plans with AI.\n\n**Disambiguation (use to route questions correctly):**\n\n- **Risks** = threats you assess, score, and treat.\n- **Tasks/Evidence** = the mitigation work linked to a risk to bring it down.\n- **Vendors** = third-party risk lives alongside this (vendor risk is its own assessment but connects via linked work).\n- If a customer asks \"how do I track and reduce a security risk?\" → Risk Management.\n\n---\n\n## **Core facts**\n\n- **Where:** the **Risks** tab, which lists your risk register; each risk has its own detail page.\n- **Scoring is likelihood × impact**, on 1–5 scales, normalized to a 1–10 score and a level (very-low → very-high).\n- **Two scores per risk:** **inherent** (before treatment) and **residual** (target after treatment); **current** risk interpolates between them as linked mitigation tasks get done.\n- **Four treatment strategies:** Mitigate, Accept, Transfer, Avoid.\n- **AI assist:** Comp AI can generate risks and draft mitigation plans, and suggest related tasks/controls to link.\n- **Mitigation = tasks:** risks are worked down by linking tasks (which carry their own controls and evidence).\n\n---\n\n## **What a risk contains**\n\n- **Title** and **description** (required).\n- **Category** (e.g., technology, operations, people, regulatory, vendor management, fraud, governance, and more).\n- **Department** and **owner (assignee)**.\n- **Status**.\n- **Likelihood** and **impact** (inherent), plus **residual likelihood/impact** (target).\n- **Treatment strategy** and a **treatment plan** (per-strategy descriptions are kept).\n- **Linked work** — mitigation tasks (and, through them, controls and vendors).\n\n---\n\n## **Risk list view (the register)**\n\n- **Columns:** Risk (title), Severity (current level), Inherent risk (1–10), Current risk (1–10), Status, Owner, Updated.\n- **Filters:** severity, status, and owner; plus title **search** and a **Clear filters** option.\n- **Detail tabs:** Overview, Treatment Plan, Risk Matrix, Tasks, Comments, Activity.\n\n---\n\n## **Risk scoring & the matrix**\n\n- **Likelihood (1–5):** Very Unlikely, Unlikely, Possible, Likely, Very Likely.\n- **Impact (1–5):** Insignificant, Minor, Moderate, Major, Severe.\n- **Score:** likelihood × impact (1–25), normalized to a **1–10** score that maps to a **level**: 1–2 very-low, 3–4 low, 5–6 medium, 7–8 high, 9–10 very-high.\n- **Inherent vs. residual:** inherent uses the raw likelihood/impact; residual uses the target likelihood/impact after treatment.\n- **5×5 risk matrix:** plots impact against likelihood with a colored heatmap, a \"now\" marker for current risk, and a \"target\" marker for residual risk. Current risk moves toward the target as linked mitigation tasks are completed.\n\n---\n\n## **Statuses (what each means)**\n\n| **Status** | **Label shown** | **Meaning** |\n| --- | --- | --- |\n| Open | **Open** | Active, not yet resolved. |\n| Pending | **Pending** | In progress / awaiting action. |\n| Closed | **Resolved** | Treated and closed out. |\n| Archived | **Archived** | Removed from the active register. |\n\n> Note: the **Closed** status displays as **\"Resolved\"** in the UI.\n\n---\n\n## **Treatment & mitigation**\n\nEach risk has a **treatment strategy**:\n\n| **Strategy** | **What it means** |\n| --- | --- |\n| **Mitigate** | Reduce likelihood/impact via linked tasks and controls (default). |\n| **Accept** | Acknowledge and live with the risk, with rationale. |\n| **Transfer** | Shift the risk to a third party (e.g., insurance, contracts). |\n| **Avoid** | Stop the activity that creates the risk. |\n\n- The **treatment plan** holds your approach; separate descriptions are kept per strategy so switching strategies doesn't lose your notes.\n- For **Mitigate**, you link **tasks** as the work that brings the risk down — each shows its status and any linked controls, and can be unlinked.\n- **Residual risk** reflects the target state; as linked tasks complete, current risk progresses from inherent toward residual.\n\n---\n\n## **AI assistance**\n\n- **Risk generation:** during onboarding (or on demand) Comp AI can research and create an initial risk register and draft mitigation plans, with live progress shown.\n- **Suggested links:** for a risk, Comp AI can draft a mitigation plan and **suggest related tasks and controls** to link, which you review and apply (or you can write a plan from scratch).\n\n---\n\n## **Comments, activity & evidence**\n\n- **Comments:** a discussion thread on each risk (with audit logging).\n- **Activity:** a merged audit trail of changes to the risk and its linked tasks.\n- **Evidence/attachments:** captured on the **linked tasks** rather than directly on the risk.\n\n---\n\n## **Reporting**\n\n- Risk stats are available **by assignee** and **by department**, and the module includes status/department/assignee charts for the register.\n\n---\n\n## **Roles & permissions (who can do what)**\n\n| **Capability** | **Owner** | **Admin** | **Auditor** |\n| --- | --- | --- | --- |\n| View risks | ✓ | ✓ | ✓ (read-only) |\n| Create risks | ✓ | ✓ | ✗ |\n| Edit, assign, set treatment, link tasks | ✓ | ✓ | ✗ |\n| Delete risks | ✓ | ✓ | ✗ |\n\n(Uses the `risk` permission. Risk owners are chosen from members with access; employees/contractors can't own risks.)\n\n---\n\n## **Sample Q&A (canned answers the agent can adapt)**\n\n**Q: How does Comp AI score a risk?**\\\nA: Each risk is scored as likelihood × impact on 1–5 scales, normalized to a 1–10 score and a level from very-low to very-high. You set an inherent score (before controls) and a residual target (after treatment).\n\n**Q: What's the difference between inherent, residual, and current risk?**\\\nA: Inherent is the risk before any treatment, residual is your target after treatment, and current is where you are right now — it moves from inherent toward residual as the mitigation tasks you've linked get completed.\n\n**Q: How do I actually reduce a risk?**\\\nA: Set the treatment strategy to **Mitigate** and link tasks that address it. As those tasks are completed, the risk's current score moves toward your residual target. You can also let Comp AI suggest relevant tasks and controls to link.\n\n**Q: What treatment options are there besides mitigating?**\\\nA: Accept (live with it, with rationale), Transfer (e.g., insurance or contracts), or Avoid (stop the activity). Each keeps its own plan description.\n\n**Q: Can Comp AI create our risks for us?**\\\nA: Yes. It can research your organization and generate an initial risk register with draft mitigation plans, then you review and refine them.\n\n**Q: Why does a closed risk say \"Resolved\"?**\\\nA: That's just the display label — a risk with the Closed status shows as \"Resolved\" in the register.\n\n**Q: Where do I attach evidence for a risk?**\\\nA: Evidence lives on the mitigation tasks linked to the risk, rather than directly on the risk itself. Open a linked task to upload its evidence.\n\n**Q: Can I see risks by owner or department?**\\\nA: Yes — the module breaks risks down by assignee and by department, with charts for status, department, and owner.","2026-06-25T23:28:21.052Z","2026-07-07T16:19:47.246Z","6301f2c8-bdfa-4730-ba1a-417a7648e330",[],[],[],"Policies tab","policies-tab","**Product area:** Policies\\\n**Summary:** The Policies tab is where a customer's admins create, edit, version, approve, and publish their company's written policies (e.g., Information Security Policy, Access Control Policy). Once published, policies are sent to employees to read and accept in the employee Portal, and acceptance is tracked for audit evidence.\n\n**Disambiguation (use to route questions correctly):**\n\n- **Policies** = the company's written, signable policy documents.\n- **Documents** = operational *evidence* records (meeting minutes, pen tests, etc.) — a separate tab.\n- **Trust Center** = published policies can also be surfaced to vendors/third parties for review.\n- If a customer asks where employees *sign* policies, the answer is the **employee Portal**, not the Policies tab.\n\n---\n\n## **Recommended starting workflow**\n\nWhen beginning the compliance process in Comp AI, **start with evidence and documents before modifying policies.**\n\nEven though the AI assistant can help modify policies right away, the recommended order is:\n\n1. **Evidence and documents first** — These are the items auditors will want to see action on, either by providing evidence or marking items as **Not Relevant** with a justification.\n2. **Policies second** — Once evidence and documents are complete, you will have a better understanding of your infrastructure and inner workings from a compliance standpoint. You can then return to policies and make changes (if needed) using the AI agent.\n\n> **Tip:** The [Comp AI MCP server](https://www.trycomp.ai/docs/mcp-server) is a tool many customers have had success with for managing policies, evidence, and other compliance items.\n\n---\n\n## **Core facts**\n\n- **Two ways to hold policy content:** a built-in rich-text **editor** (TipTap) or an **uploaded PDF**. Each policy is set to one display format.\n- **Pre-built + custom:** Customers start from a tailored library of pre-built policies and can also create their own.\n- **Versioned:** Every published change creates a numbered version (v1, v2, v3…) with an optional changelog and a record of who published it.\n- **Signable:** Employees accept policies in the Portal; acceptances are recorded per employee.\n- **Mapped to compliance:** Policies link to controls and frameworks (e.g., SOC 2, ISO 27001, GDPR), so they contribute to the customer's compliance posture.\n\n---\n\n## **Policy statuses (what each badge means)**\n\n| **Status** | **Meaning** |\n| --- | --- |\n| **Draft** | Being written/edited; not yet visible to employees. |\n| **Needs Review** | Either (1) a version has been submitted and is awaiting approver sign-off, **or** (2) the policy's review frequency period has elapsed and the policy is due for its periodic review. |\n| **Published** | Live; visible to employees in the Portal and available for acceptance. |\n| **Archived** | Removed from the active list (either manually archived or auto-archived during a framework sync). Hidden unless the \"Archived\" filter is on. |\n\n---\n\n## **The overall flow (end to end)**\n\n1. **Create** — An admin creates a policy (title + description) or starts from a pre-built, AI-tailored template.\n2. **Edit** — Content is written in the rich-text editor or supplied as an uploaded PDF. Edits are held as draft content until published.\n3. **Create a version** — The admin snapshots the content as a new version.\n4. **Submit for approval** (optional) — The version is sent to a designated **approver**; the policy moves to **Needs Review**.\n5. **Approve / publish** — The approver **Accepts Changes** (policy becomes **Published**) or **Denies Changes** (stays draft). Policies can also be published directly when no approval step is required.\n6. **Notify** — On publish, employees are automatically emailed to review and accept.\n7. **Accept** — Employees read and accept in the Portal; acceptance is recorded.\n8. **Review on cadence** — Each policy has a review frequency (monthly/quarterly/yearly) and a next review date to keep it current. When the period elapses, the policy automatically moves to **Needs Review**.\n\n---\n\n## **Review frequency and the \"Needs Review\" cadence trigger**\n\nEvery policy has a **review frequency** setting that controls how often it is automatically flagged for periodic review. Available options are:\n\n- **Monthly** — policy is flagged every month\n- **Quarterly** — policy is flagged every quarter\n- **Yearly** — policy is flagged once per year\n\nWhen the frequency period elapses, a published policy automatically switches to **Needs Review** status. This is expected behavior — it is the system prompting admins to confirm the policy is still current.\n\n**Common cause of unexpected \"Needs Review\" on a long-published policy:** The policy's frequency was set to `monthly` or `quarterly`, causing it to be flagged more often than intended. Changing the frequency to `yearly` (annual) will prevent it from being flagged as frequently.\n\n> **Note:** The review frequency can be adjusted in the policy's settings. If you need help changing the frequency on a specific policy, contact support.\n\n---\n\n## **How employees sign / accept policies (the key flow)**\n\n- **Where:** The employee **Portal**, under the **\"Security Policies\"** section.\n- **What they see:** The list of published policies that require their signature, plus the full policy content (editor view or PDF viewer).\n- **How they accept:**\n - **Accept Policy** on an individual policy → becomes **Policy Accepted** (with a checkmark) once done.\n - **Accept All** to acknowledge every outstanding policy at once.\n - After completing, employees can **View Signed Policies**.\n- **Confirmation:** Accepted policies show a green \"You have accepted this policy\" banner and are visually marked complete.\n\n**Re-acceptance after changes (important):**\n\n- When a new version of a policy is **published**, prior acceptances are cleared and employees are asked to **re-accept** the updated policy. This ensures sign-offs always reflect the current version.\n\n**Reminders & notifications:**\n\n- On publish, active non-admin employees receive a \"Please review and accept this policy\" email with a **Review & Accept Policy** button.\n- Outstanding policies are also batched into a digest email (e.g., \"You have 3 policies to review at \\[Company\\]\").\n\n**Who must sign:**\n\n- Published policies marked as requiring signature go to employees based on visibility — either **all** employees or a **specific department**.\n\n---\n\n## **Creating & editing (admin side)**\n\n- **Create policy:** Provide a title and optional description. Requires create permission.\n- **Edit content:** Use the rich-text editor (headings, lists, tables, bold/italic, code blocks, blockquotes) or upload/replace a PDF.\n- **Set policy details:** Name, description, department, **assignee** (owner), review frequency, and review date.\n- **AI assistance (where enabled):**\n - **Policy AI Assistant** — a chat sidebar that can rewrite, adapt, or refine sections, using the policy's content and the customer's applicable frameworks as context.\n - **Regenerate** — regenerates the full policy based on the customer's frameworks and organizational context.\n\n---\n\n## **Versioning & approval**\n\n- Versions are numbered and store a content snapshot, the publisher, and an optional changelog.\n- A version can be **Submitted for Approval** to a chosen approver, **Activated** (set as current), edited, or deleted.\n- **Accept Changes** publishes the pending version; **Deny Changes** returns it to draft.\n\n---\n\n## **Roles & permissions (who can do what)**\n\n| **Capability** | **Owner** | **Admin** | **Auditor** | **Employee** |\n| --- | --- | --- | --- | --- |\n| Create policies | ✓ | ✓ | ✗ | ✗ |\n| View policies (admin app) | ✓ | ✓ | ✓ | ✗ |\n| Edit / version / approve / publish | ✓ | ✓ | ✗ | ✗ |\n| Delete policies | ✓ | ✓ | ✗ | ✗ |\n| View & accept published policies (Portal) | — | — | — | ✓ |\n\n- Employees don't edit or view policies in the admin app — they read and accept in the **Portal**.\n- Auditors have read-only access to support reviews.\n\n---\n\n## **Relationship to other features**\n\n- **Controls & frameworks:** Policies map to controls (n-to-many), and those controls map to frameworks — so policies directly support framework requirements. Visible under the policy's **Mappings** tab.\n- **Evidence tasks:** The Mappings area also surfaces evidence tasks tied to the policy's controls.\n- **Trust Center:** Published policies can be shown to vendors/third parties for review.\n- **Activity & Comments:** Each policy has an audit trail (Activity) and a discussion thread (Comments).\n\n---\n\n## **Bulk & export actions**\n\n- **Publish all** — publish all draft policies at once.\n- **Download all** — generates a branded PDF bundle of published policies.\n- **Per-policy / per-version PDF download** — download an individual policy or a specific version as a PDF.\n- **Archive / unarchive** — hide policies from the active list without deleting them.\n\n---\n\n## **Sample Q&A (canned answers the agent can adapt)**\n\n**Q: Should I start with policies or with evidence and documents?**\\\nA: Start with evidence and documents first. These are the items auditors will want to see action on — either by providing evidence or marking items as **Not Relevant** with a justification. Once that's complete, you'll have a better understanding of your infrastructure from a compliance standpoint and can return to policies to make changes using the AI agent.\n\n**Q: Can I use the AI assistant to modify policies right away?**\\\nA: The AI assistant can help with policies at any time, but the recommended approach is to complete evidence and documents first. This gives you a clearer picture of your compliance posture before refining policy content.\n\n**Q: How do my employees sign policies?**\\\nA: Employees sign in the employee Portal under \"Security Policies.\" They can open each published policy and click **Accept Policy**, or use **Accept All** to acknowledge everything at once. Each acceptance is recorded against the employee.\n\n**Q: I updated a policy — do employees need to sign again?**\\\nA: Yes. When you publish a new version, previous acceptances are reset and employees are automatically emailed to review and re-accept the updated policy.\n\n**Q: Can I write my own policy instead of using the templates?**\\\nA: Yes. You can create a custom policy from scratch and write it in the built-in editor, or upload your own PDF. You also start with a tailored library of pre-built policies you can edit.\n\n**Q: What's the difference between Draft, Needs Review, and Published?**\\\nA: Draft means it's still being edited and isn't visible to employees. Needs Review means either a version is awaiting approver sign-off, or the policy's review frequency period has elapsed and it's due for a periodic review. Published means it's live in the employee Portal and available for acceptance.\n\n**Q: Why does my published policy suddenly show \"Needs Review\" with no changes made?**\\\nA: This is most likely caused by the policy's review frequency setting. Each policy has a frequency (monthly, quarterly, or yearly) that controls how often it is automatically flagged for review. If the frequency is set to monthly or quarterly, the policy will be flagged more often than expected. Changing the frequency to yearly will prevent it from being flagged as frequently. Contact support if you need help adjusting the frequency on a specific policy.\n\n**Q: Who approves a policy before it goes live?**\\\nA: When you submit a version for approval, you choose an approver. They can Accept Changes (which publishes it) or Deny Changes (which returns it to draft). If your process doesn't require approval, an admin can publish directly.\n\n**Q: Can I see who has and hasn't accepted a policy?**\\\nA: Yes — acceptance is tracked per employee, and the Portal visually marks completed policies. (If you want, I can confirm exactly where admins view the completion report.)\n\n**Q: How do I get a copy of all our policies?**\\\nA: Use **Download all** to generate a branded PDF bundle of your published policies, or download an individual policy (or a specific version) as a PDF.\n\n**Q: Does Comp AI help write policies?**\\\nA: Where enabled, yes — the Policy AI Assistant can rewrite and adapt sections based on your frameworks, and you can regenerate an entire policy from your organizational context.","2026-06-25T22:26:28.569Z","2026-07-07T16:32:00.670Z","4a199f81-f8ec-4562-86d7-2007ba655e9e",[],[],[],"People tab","people-tab","**Product area:** People\\\n**Summary:** The People tab is where admins manage everyone in the organization — inviting members, assigning roles, and tracking each person's compliance completion (policy acceptance, training, device compliance, background checks). It's also where offboarding, the org chart, devices, and HR/MDM integrations live. Employees themselves complete their tasks in the employee **Portal**; the People tab is the admin's command center for monitoring it.\n\n**Disambiguation (use to route questions correctly):**\n\n- **People** = managing members and tracking their onboarding/compliance completion.\n- **Policies** = the policy documents themselves (employees *accept* them in the Portal; admins *track* acceptance in People).\n- **Portal** = the employee-facing app where people actually accept policies, watch training, and register devices.\n- If a customer asks \"where do employees do their tasks?\" → the Portal. \"Where do I see if they did them?\" → People.\n\n---\n\n## Overview\n\nThe **People** section is your hub for managing the individuals within your organization and ensuring they meet mandatory compliance requirements. To satisfy audit standards, you must maintain an accurate roster and provide proof of completed training.\n\nThe People tab gives admins a single command center to:\n\n- Invite and manage members\n- Assign roles that trigger the correct compliance workflows\n- Track each person's progress across policies, training, devices, and background checks\n- Manage offboarding and maintain an up-to-date org chart\n\nEmployees complete their own tasks at **portal.trycomp.ai** (the employee **Portal**); admins monitor and manage everything from the People tab.\n\n---\n\n## Tabs Within People\n\n| **Tab** | **What It's For** |\n| --- | --- |\n| **People** | The member roster with per-person compliance progress (default view). |\n| **Tasks** | Org-wide completion report across all employees. |\n| **Devices** | Device compliance and HR/MDM sync providers. |\n| **Chart** | Org chart / reporting hierarchy. |\n| **Settings** | Background-check requirement and offboarding checklist config (admins/owners only). |\n\n---\n\n## Adding People to Your Organization\n\nAll staff should be added via the People tab and assigned either the **Employee** or **Contractor** role to trigger the appropriate compliance workflows. There are three ways to add people:\n\n### 1. Individually (Add User)\n\nClick **Add User** and enter the person's email address and role(s). Use **Add Another** to invite several people in a single session.\n\n### 2. Bulk Upload (CSV)\n\nSelect the **CSV** mode in the **Add User** dialog. Download the provided template and fill in `email` and `role` for each person. Use a pipe character to assign multiple roles (e.g., `john@company.com,employee|admin`). Maximum file size is **5 MB**.\n\n### 3. Direct Integration (HR/MDM Sync)\n\nConnect **Google Workspace**, **JumpCloud**, or **Rippling** to automatically import employees and managed devices. New people are auto-created as members (defaulting to the **Employee** role); existing people are matched by email and updated. A manual **Sync now** option is also available.\n\n### Portal Invite Email\n\nThe **Send portal invite email** checkbox is enabled by default. This sends the new member a direct link to **portal.trycomp.ai** so they can set up their profile and begin their compliance tasks immediately. If someone misses the email, use **Resend Portal Invite** from their row's actions menu.\n\n> **Note:** Invited members are set to **Active** immediately — there is no separate activation step.\n\n---\n\n## Roles\n\nA person can hold **multiple roles** at once. At least one role is always required.\n\n| **Role** | **What It Means** |\n| --- | --- |\n| **Owner** | Top authority; full control. The Owner role cannot be removed. |\n| **Admin** | Can invite/manage members, edit roles, and change org settings. |\n| **Auditor** | Read-only access for reviews. Automatically exempt from background checks. |\n| **Employee** | Standard member; completes onboarding (policies, training, device, background check). |\n| **Contractor** | Non-employee; follows the same onboarding tasks but is tracked separately for compliance. |\n| **Custom roles** | Organizations can define their own roles with specific permissions. |\n\nTo change someone's roles, select **Edit Roles** from their actions menu (requires member-management permission).\n\n### Employee Role\n\nAssigning the **Employee** role grants the person access to **portal.trycomp.ai**, where they can:\n\n- **Accept Policies** — provide a digital sign-off on all published, required policies.\n- **Complete Security Training** — mandatory for SOC 2 and ISO compliance; includes training videos with completion dates and downloadable certificates.\n- **Access Device Manager** — download endpoint security software and register their device.\n\nEmployee progress is monitored via the **Tasks** tab in the main dashboard and the per-person progress bar in the People roster.\n\n### Contractor Role\n\nContractors are added the same way as employees but assigned the **Contractor** role. This ensures:\n\n- **Distinct categorization** — contractors are tracked separately from employees for compliance reporting.\n- **Policy & training assignment** — contractors receive emails to sign published policies and complete security training at **portal.trycomp.ai**.\n- **Completion monitoring** — tracked in the People tab, the same as employees.\n\n---\n\n## The People Roster\n\nThe main People list shows every member with the following columns:\n\n- **NAME** — includes email address.\n- **STATUS** — **Active** or **Inactive**.\n- **ROLE** — role badges (Owner, Admin, Auditor, Employee, Contractor, plus any custom roles).\n- **ONBOARDED / OFFBOARDED** — the dates the person joined or was offboarded (or \"—\" if not set).\n- **TASKS** — a progress bar breaking down each person's compliance items:\n - **Policies {signed}/{total}**\n - **Training {completed}/{total}** (when training is enabled)\n - **HIPAA {completed}/{total}** (when the HIPAA framework is active)\n - **Device {compliant}/1** (when the person has a device)\n - **Background check {completed}/1** (when background checks are enabled)\n\nThis progress bar is the fastest way for an admin to see who is fully onboarded and who is behind.\n\n---\n\n## Onboarding: What Each Person Completes\n\nEmployees and contractors complete these steps in the **Portal**; admins monitor progress in the People tab.\n\n1. **Accept policies** — sign all published, required policies (digital sign-off).\n2. **Security awareness training** — a set of training videos (mandatory for SOC 2/ISO); tracked with completion dates and certificate downloads.\n3. **HIPAA training** — a separate acknowledgment, shown only when the HIPAA framework is active.\n4. **Register a device** — install the device agent (Mac/Windows) so device compliance can be checked.\n5. **Background check** — required when enabled; individuals can be exempted, and auditors are auto-exempt.\n\n### Individual Profile\n\nClicking a person's name opens their profile with the following sub-tabs:\n\n- **Details**\n- **Policies**\n- **Training Videos**\n- **HIPAA Training**\n- **Device**\n- **Background Check**\n- **Offboarding** (when applicable)\n\nEach policy and training item shows ✓ **Completed** or ⚠ **Pending**, with dates.\n\nDetails Sub-Tab — Setting the Onboard Date\n\nSet the **onboard date** in the **Details** sub-tab for every new hire. Backfill this date for recent hires as well. This ties the person to the onboarding process for records and is reviewed by auditors to verify when access was granted.\n\nBackground Check Sub-Tab\n\nEveryone who has onboarded needs some form of background check. From the **Background Check** sub-tab you can:\n\n- Run a background check **directly through Comp AI**, or\n- **Upload an external report** if the check was completed through another provider.\n\n> **FAQ — Do we really need a background check for everyone?**\\\n> Yes. Anyone with access to production or customer data is expected to have a background check on file per SOC 2 controls. The only exception is a **documented exemption with a written reason**, which will be tested by the auditor. Auditors are automatically exempt. All other individuals can be manually exempted from their profile, but the reason must be recorded.\n\n---\n\n## Tracking Completion\n\nThere are several views for monitoring compliance progress:\n\n1. **People list** — per-person progress bar (policies, training, device, background check).\n2. **Tasks tab** — org-wide report showing each employee's **\"{X}/{Y} policies signed • {X}/{Y} training • HIPAA\"**, a stacked **Completed / Not Completed** bar, an overall percentage, and a **View Profile** link.\n3. **Individual profile → Policies tab** — exactly which policies that person has signed vs. pending.\n4. **Policy detail page** — the acknowledgment count (how many employees signed that policy) and an activity log of sign-offs.\n\n---\n\n## Offboarding\n\n### Starting Offboarding\n\nUse **Remove Member** from the person's actions menu. A **Skip offboarding** checkbox lets you deactivate them immediately without a checklist if needed.\n\n### Setting the Offboard Date\n\nSet the **offboard date** in the person's **Details** sub-tab. Add this for recent leavers and maintain it going forward. This date is recorded for audit purposes and ties the person to the offboarding process.\n\n### What Happens\n\n- The person is set to **Inactive**.\n- Their offboard date is recorded.\n- An **offboarding checklist** is created (unless skipped).\n\n### Offboarding Checklist\n\nThe checklist is configured org-wide under **People → Settings** and applies to every departure. At minimum, it should cover **removal of software and system access** — this is a baseline auditor expectation. Each checklist item can require evidence, and progress is tracked with a completion percentage and days-since counter.\n\nComplete the offboarding checklist from the **Offboarding** sub-tab on the individual's profile.\n\n### Evidence & Exports\n\n- **Export evidence** — downloads a member's offboarding evidence as a ZIP file.\n- **Export offboarding** — available on the People tab; exports offboarding data across all members, useful for audits.\n\n### Reinstating a Member\n\nUse **Reinstate Member** to restore a deactivated person to **Active** status.\n\n---\n\n## Org Chart\n\nNavigate to the **Chart** tab and upload a current organization chart.\n\nAuditors use the org chart to verify:\n\n- **Reporting lines** — who reports to whom.\n- **Separation of duties** — that no single person has unchecked control over critical processes.\n- **Administrative accountability** — that roles and responsibilities are clearly defined.\n\nKeep the org chart up-to-date. An outdated chart can raise questions during an audit.\n\n---\n\n## Devices Tab\n\nThe **Devices** tab provides a compliance overview of all registered devices in your organization.\n\n- **Compliance overview** — a compliant vs. non-compliant breakdown across all devices.\n- **Per-device status:**\n - **Compliant** — all checks passed.\n - **Non-compliant** — one or more checks failed (e.g., disk encryption, antivirus, password policy, screen lock).\n - **Not installed** — the device agent has not been set up.\n - **Stale** — the agent hasn't checked in for \\~7+ days; treated as non-compliant.\n- **Device details** — hostname, platform (macOS/Windows/Linux), OS version, serial/model, and last check-in time.\n- **How devices link to people** — either the employee installs the **device agent** themselves, or devices sync in from an HR/MDM provider.\n\n---\n\n## HR / MDM Integrations\n\nConnect your HR or MDM provider to automatically sync employees and managed devices.\n\n**Supported providers:** **Google Workspace**, **Rippling**, **JumpCloud** (plus other integration providers).\n\n**What sync does:**\n\n- Pulls employees (and managed devices) from the provider on a schedule or on demand.\n- New people are auto-created as members (defaulting to the **Employee** role).\n- Existing people are matched by email and updated.\n\nA provider selector shows the active provider, last sync time, and a manual **Sync now** option.\n\n---\n\n## Settings Tab (Admins & Owners Only)\n\n- **Require background checks** — toggle whether members must pass a background check to count as fully onboarded. Individuals can still be exempted from their profile.\n- **Offboarding checklist** — add, edit, and reorder checklist items; mark which require evidence; enable or disable individual items.\n\n---\n\n## Roles & Permissions\n\n| **Capability** | **Owner** | **Admin** | **Auditor** | **Employee** |\n| --- | --- | --- | --- | --- |\n| View People | ✓ | ✓ | ✓ | ✗ |\n| Add / invite members | ✓ | ✓ | ✗ | ✗ |\n| Edit roles | ✓ | ✓ | ✗ | ✗ |\n| Remove / reinstate members | ✓ | ✓ | ✗ | ✗ |\n| Change People settings | ✓ | ✓ | ✗ | ✗ |\n| Complete onboarding tasks (Portal) | — | — | — | ✓ |\n\n---\n\n## Sample Q&A\n\n**Q: How do I add someone to my organization?**\\\nA: Click **Add User** in the People tab. You can add people one at a time (email + role) or upload a CSV with `email,role` columns. Leave **Send portal invite email** checked so they get a link to set up their profile and start their tasks.\n\n**Q: How do I invite a lot of people at once?**\\\nA: Use the **CSV** mode in the Add User dialog. Download the template, fill in `email` and `role` for each person (use a pipe for multiple roles, e.g. `email,employee|admin`), and upload it. You can also connect Google Workspace, JumpCloud, or Rippling to sync your team automatically.\n\n**Q: Where do I see who's finished onboarding?**\\\nA: The People list shows a per-person progress bar (policies, training, device, background check). The **Tasks** tab gives an org-wide report with completion percentages, and each person's profile shows item-by-item status.\n\n**Q: An employee didn't get their invite — can I resend it?**\\\nA: Yes. From their row's actions menu, choose **Resend Portal Invite**.\n\n**Q: Can one person have more than one role?**\\\nA: Yes. Members can hold multiple roles, and at least one role is always required. Use **Edit Roles** to change them. Note the Owner role cannot be removed.\n\n**Q: How do I offboard someone?**\\\nA: Use **Remove Member** from their actions menu. By default this starts an offboarding checklist and records a termination date. You can also check **Skip offboarding** to deactivate immediately. Set the offboard date in their **Details** sub-tab, and complete the checklist from the **Offboarding** sub-tab. Use **Reinstate Member** later if needed.\n\n**Q: Do background checks have to be required for everyone?**\\\nA: Yes — anyone with access to production or customer data is expected to have one per SOC 2 controls. In People → **Settings**, you can manage the global requirement, and individuals can be exempted from their profile with a documented reason. Auditors are exempt automatically. Exemptions will be reviewed by the auditor.\n\n**Q: Why is a device showing as non-compliant or stale?**\\\nA: Non-compliant means the device failed one or more checks (e.g., encryption, antivirus). \"Stale\" means the agent hasn't checked in recently (\\~7+ days) and is treated as non-compliant. The Devices tab shows the specific failing checks.\n\n**Q: Can I pull employees from our HR system?**\\\nA: Yes — connect Google Workspace, Rippling, or JumpCloud. Sync imports employees (creating members automatically) and can bring in managed devices, on a schedule or on demand.\n\n**Q: Why do I need to upload an org chart?**\\\nA: Auditors use the org chart to verify reporting lines, separation of duties, and administrative accountability. Keep it current — an outdated chart can raise questions during an audit.","2026-06-25T22:33:35.183Z","2026-07-07T16:27:33.138Z","129b8e45-368d-422e-9167-d6f7b62b821e",[],[],[],"Penetration Testing","penetration-testing","Navigate to **Security → Penetration Tests** in the left rail.\n\n---\n\n## Overview\n\nThe **Pentest** feature lets you run automated penetration tests against your applications. Scans are handled by AI-powered agents that analyze your target, surface vulnerabilities, and provide actionable remediation guidance — all from within the app.\n\n---\n\n## How to Use It\n\n### 1. Start a Scan\n\nClick **+ New scan** and fill in the following fields:\n\n| Field | Required | Description |\n| --- | --- | --- |\n| **Target URL** | ✅ Required | The staging or production app to scan |\n| **Repository URL** | Optional | A public GitHub repo — gives agents context for better remediation advice |\n\n> ⏱ **Expect 1–3 hours** per scan depending on the size and complexity of the target.\n\n---\n\n### 2. Watch It Run\n\nThe scan detail view gives you real-time visibility into progress. Here's what you'll see:\n\n- **Status indicator** — tracks the scan lifecycle: `Queued → Preparing → Running → Completed`\n- **Progress grid** — a visual overview of scan coverage\n- **Elapsed timer** — shows how long the scan has been running\n- **Live activity log** — a real-time feed of tool calls and agent observations\n- **Findings table** — populates as issues are discovered, with new findings highlighted automatically\n\n---\n\n### 3. Triage Findings\n\nClick any finding to open its **detail pane**, which includes the following tabs:\n\n| Tab | What It Contains |\n| --- | --- |\n| **Summary** | High-level description of the vulnerability |\n| **PoC** | Proof-of-concept demonstrating the issue |\n| **Impact** | Potential consequences if exploited |\n| **Remediation** | Recommended steps to fix the issue |\n| **Validation** | How to confirm the fix was successful |\n| **Attack Path** | The chain of steps an attacker could take |\n| **Evidence** | Raw data and artifacts from the scan |\n\nEach finding also includes:\n\n- **Severity** — Critical, High, Medium, Low, or Informational\n- **CWE / CVE** identifiers\n- **CVSS score**\n- **Affected endpoint**\n\n**Status options** — you can mark each finding as:\\\n`Open` · `Acknowledged` · `Resolved` · `False Positive` · `Won't Fix`\n\nUse the **severity filter** (Critical → Info) to focus your triage efforts.\n\n---\n\n### 4. Export Results\n\nOnce a scan reaches **Completed** status, you can export the full findings report directly from the scan detail view.\n\n---\n\n### 5. Posture Overview\n\nThe **Pentest list page** gives you a high-level snapshot of your security posture, including:\n\n- **Recent scans** and their statuses\n- **Stale targets** — cadence tracking to flag apps that haven't been scanned recently\n- **Stats** — unique targets scanned and average scan duration\n\n---\n\n## What Needs to Be Remediated Before an Audit?\n\nYou do **not** need to remediate every finding before your audit. The requirements are straightforward:\n\n| Severity | Must Remediate Before Audit? |\n| --- | --- |\n| 🔴 **Critical** | ✅ Yes |\n| 🟠 **High** | ✅ Yes |\n| 🟡 **Medium** | ❌ No |\n| 🔵 **Low** | ❌ No |\n| ⚪ **Informational** | ❌ No |\n\nOnly **High and Critical** severity findings must be addressed prior to your audit.\n\n---\n\n## Pricing & Access\n\n- Each organization receives **1 free trial scan** to get started.\n- **Additional scans** can be scheduled and purchased directly in the app.\n- **Need a rescan?** If you've addressed High or Critical findings from your initial scan and need to re-verify, reach out in **Slack** and someone from the **Customer Success team** will be happy to help!","2026-04-29T19:22:48.638Z","2026-07-07T16:22:23.589Z","dffa840c-b8f3-4e49-95b6-539e31db7bac",[],[],[],"getting-started-how-to-kick-off-your-onboarding-2","## Overview\n\nThis article walks you through how to kick off your onboarding with Comp AI and where to go if you need support along the way.\n\n---\n\n## Step 1: Launch Your Onboarding\n\n1. **Find the green button** pinned at the top of your shared Slack channel with the Comp AI team.\n2. **Click the button** to spin up your org and launch the onboarding form.\n3. **Complete the onboarding form** — this is the first step in your compliance journey.\n\n---\n\n## Step 2: Get Familiar with the CS Agent\n\nOnce your org is set up, a **CS agent** will be available directly in your Slack channel. Here's what to know:\n\n- The agent is trained on the Comp AI knowledge base.\n- It can handle most questions on the spot.\n- It's available any time you need a quick answer.\n\n---\n\n## Getting Support\n\nIf the CS agent's response doesn't fully address your question, you have two options:\n\n- **Create a ticket** — You'll see this option directly in the thread after the agent responds.\n- **Tag a team member** — Mention someone in the channel and a member of the Comp AI team will jump in to help.","2026-07-07T17:23:23.306Z","c5781525-7cf2-4b5f-b9bd-0c22dc361f8e",[],[],[],"Documents Tab","documents-tab","# Knowledge Base: Documents Tab\n\n**Product area:** Documents\\\n**Summary:** The Documents tab is where a customer's team collects, stores, and manages the operational evidence auditors expect to see (e.g., meeting minutes, access requests, penetration test reports). It is the internal evidence library.\n\n**Disambiguation (use to route questions correctly):**\n\n- **Documents** = internal compliance *evidence* records.\n- **Policies** = written policy documents (separate tab).\n- **Trust Center** = public-facing trust page (separate tab).\n- If a user asks about uploading a policy, route them to Policies, not Documents.\n\n---\n\n## **Core facts**\n\n- **What it's for:** Storing the records that prove a compliance program is operating day to day.\n- **Supported file types for uploads:** PDF, PNG, JPG, Markdown (.md), CSV.\n- **Built-in document types include:** Meeting minutes (board, IT leadership, risk committee), Access requests, Penetration test reports, Network diagrams, Infrastructure inventory, RBAC matrix, Tabletop exercises, Employee performance evaluations, Whistleblower reports, and Statement of Applicability.\n\n---\n\n## **Markdown (.md) files: policies vs. evidence**\n\nMarkdown files are accepted by the platform as an upload format, but their suitability depends on what you are submitting:\n\n- **Policies:** `.md` files work for policies. If your AI agent or tooling generates policy documents as markdown, you can upload or publish them in the Policies tab.\n- **Evidence (Documents tab):** `.md` files are generally **not sufficient** for evidence in most cases. Auditors expect proof that controls are actually operating — not just written descriptions of processes. For most evidence items, you will need to provide one of the following instead:\n - An **integration connection** (e.g., GitHub, Google Workspace) that automatically satisfies the control.\n - A **custom automation** that gathers and evaluates evidence on a schedule.\n - **Screenshots** or **screen recordings** that demonstrate the activity took place.\n\n**Example — Backup and Restoration testing:** A `.md` file describing your backup process is not sufficient. The auditor requires a screen recording or a detailed process document with screenshots showing a backup and restore actually being conducted.\n\n> **Tip for AI-generated compliance materials:** If your AI agent prepared a zip of `.md` files, those files may be usable for policies, but each evidence item in the Documents tab should be reviewed individually. Items that cannot be satisfied by an integration or automation will need screenshots or recordings as supporting proof.\n\n---\n\n## **What a user can do**\n\n- **Create a submission** using a guided, step-by-step form.\n- **Upload evidence** directly as a file (PDF, PNG, JPG, MD, CSV).\n- **Search and browse** all past submissions for a document type.\n- **Export to CSV** for record-keeping or to hand to an auditor.\n- **Open a submission** to view full details (who submitted it, when, and the content).\n- **Review submissions** (approve/reject) where a review workflow applies.\n- **Mark a document type as \"Not relevant\"** in Settings if it doesn't apply.\n\n---\n\n## **Statuses (what each badge means)**\n\n| **Status** | **Meaning** |\n| --- | --- |\n| **Todo** | Required document not yet submitted, or last submission is older than 6 months. |\n| **Complete** | Requirement met with a current submission. |\n| **Optional** | Not mandatory. |\n| **Not relevant** | Marked as out of scope by the customer. |\n| **Pending** | Submission is awaiting review (e.g., access requests). |\n| **Approved** | Submission was accepted by a reviewer. |\n| **Rejected** | Submission was declined; a reason is recorded. |\n\n---\n\n## **Key behaviors to explain to customers**\n\n**Review workflow**\n\n- Certain submissions (e.g., access requests) can be routed for approval.\n- A reviewer can **Approve** or **Reject**; rejections require a reason.\n- Status is tracked automatically as Pending → Approved/Rejected.\n\n**AI assistance (meeting minutes & tabletop exercises)**\n\n- When these are submitted, Comp AI automatically reviews the content against framework expectations.\n- For meetings, it checks whether topics like risk, security, and business continuity were covered.\n- For tabletop exercises, it checks for scenario detail, attendee coverage, decisions/notes, and follow-up action items with owners and due dates.\n- Output is a pass/fail breakdown so customers can fix gaps before an audit.\n\n**6-month freshness rule**\n\n- Evidence older than 6 months automatically reverts to **Todo**.\n- This keeps recurring records (e.g., quarterly meetings) from going stale unnoticed.\n\n**Marking \"Not relevant\"**\n\n- Available in the **Settings** tab.\n- Customers should be warned: auditors may treat missing required documents as exceptions.\n\n**Linked issues**\n\n- Open findings/issues tied to a document appear directly on its card in the Overview.\n\n**ISO 27001 customers**\n\n- An **ISMS** view and an automatically generated **Statement of Applicability** appear, built from the customer's policies and documentation. The SOA does not need to be assembled manually.\n\n---\n\n## **Sample Q&A (canned answers the agent can adapt)**\n\n**Q: What's the difference between Documents and Policies?**\\\nA: Policies are your written policy documents. The Documents tab stores operational *evidence* — records like meeting minutes, access requests, and pen test reports that show your program is running. They live in separate tabs.\n\n**Q: What file types can I upload?**\\\nA: PDF, PNG, JPG, Markdown (.md), and CSV.\n\n**Q: My AI agent generated everything as .md files — can I use those for evidence?**\\\nA: Markdown files work for policies, but are generally not sufficient for evidence in most cases. Auditors need proof that controls are actually operating. For evidence items, you'll typically need an integration connection, a custom automation, or screenshots/screen recordings. Review each item in the Documents tab individually — some may be satisfied by connecting an integration (e.g., GitHub, Google Workspace), while others will need supporting screenshots or recordings.\n\n**Q: Why did a document I already completed go back to \"Todo\"?**\\\nA: Evidence older than 6 months automatically reverts to Todo so recurring records stay current. Submit a new, up-to-date version to mark it Complete again.\n\n**Q: How do I remove a document I don't need?**\\\nA: In the Documents **Settings** tab, mark that document type as \"Not relevant.\" Note that auditors may treat missing required documents as exceptions.\n\n**Q: Does Comp AI check my meeting minutes?**\\\nA: Yes. For meeting minutes and tabletop exercises, Comp AI automatically reviews the content against framework requirements and gives you a pass/fail breakdown highlighting any gaps.\n\n**Q: Can I export my evidence?**\\\nA: Yes — use **Export CSV** to download all submissions for a document type.\n\n### **Meeting minutes**\n\n- **What it is:** A record of governance meetings — board, IT leadership, or risk committee.\n- **Why it matters:** Auditors look for evidence that leadership reviews risk, security, and compliance on a recurring basis.\n- **What to submit:** Minutes documenting attendees, topics discussed, and decisions made. You select the meeting type (Board, IT Leadership, Risk Committee) when uploading.\n- **Note:** Comp AI's AI review checks whether minutes cover topics like risk management, cybersecurity, business continuity, and fraud/misconduct.\n\n### **Access request**\n\n- **What it is:** A retained record of a user requesting access to a system or resource.\n- **Why it matters:** Demonstrates that access is granted through a controlled, reviewable process rather than ad hoc.\n- **What to submit:** The request details — who requested access, to what, and the approval decision. Employees can submit these through the portal. ([portal.trycomp.ai](http://portal.trycomp.ai))\n- **Note:** Access requests use the approval workflow (Pending → Approved/Rejected with a reason).\n\n### **Whistleblower report**\n\n- **What it is:** A confidential channel record for reporting misconduct or concerns.\n- **Why it matters:** Many frameworks expect a confidential reporting mechanism to exist and be documented.\n- **What to submit:** The report details captured through the confidential submission form.\n\n### **Penetration test**\n\n- **What it is:** A third-party penetration (security) test report.\n- **Why it matters:** Provides independent evidence that your systems were tested for vulnerabilities.\n- **What to submit:** Upload the pen test report file (typically a PDF) from your testing vendor.\n\n### **RBAC matrix (role-based access control)**\n\n- **What it is:** A mapping of which roles have access to which systems, and who approves that access.\n- **Why it matters:** Shows access is assigned by role and follows least-privilege principles.\n- **What to submit:** A matrix documenting system, role, level of access, and approver.\n\n### **Infrastructure inventory**\n\n- **What it is:** A list of your infrastructure assets.\n- **Why it matters:** You can't protect what you don't track; auditors expect an asset inventory.\n- **What to submit:** Assets with their ownership and review dates.\n\n### **Employee performance evaluation**\n\n- **What it is:** A record of structured employee reviews.\n- **Why it matters:** Supports HR and personnel-security controls.\n- **What to submit:** Review outcomes and sign-off for the evaluated employee.\n\n### **Network diagram**\n\n- **What it is:** A visual map of your current network architecture.\n- **Why it matters:** Auditors use it to understand how systems and data connect.\n- **What to submit:** Upload a diagram file or provide a link to a current network diagram.\n\n### **Tabletop exercise**\n\n- **What it is:** A documented incident-response drill where the team walks through a simulated scenario.\n- **Why it matters:** Proves your incident-response plan has been tested, not just written.\n- **What to submit:** The scenario, attendees, session notes/decisions, after-action findings, and action items with owners and due dates.\n- **Note:** Comp AI's AI review checks for scenario realism, attendee coverage, documented decisions, and follow-up action items.\n\n### **Statement of Applicability (SoA) — ISO 27001**\n\n- **What it is:** A document stating which ISO 27001 controls apply to your organization and why.\n- **Why it matters:** It's a required artifact for ISO 27001 certification.\n- **What to submit:** Nothing manual — Comp AI auto-generates it from your policies and documentation. ISO 27001 customers also get an ISMS view alongside it.","2026-06-25T22:12:06.336Z","2026-07-07T17:13:16.292Z","2cba2a54-2cef-42fc-b898-0557f1b6a734",[],[],[],"Comp AI Device Agent","comp-ai-device-agent-2","https://trycomp.ai/docs/device-agent","### **About Comp AI Device Agent**\n\nComp AI Device Agent is a lightweight desktop application that runs in your system tray and automatically monitors your device's security compliance. It checks your device configuration every hour and reports the results to your organization's Comp AI portal.The agent checks four security areas:\n\n| **Security Check** | **What It Verifies** |\n| --- | --- |\n| **Disk Encryption** | FileVault (macOS), BitLocker (Windows), or LUKS (Linux) is enabled |\n| **Antivirus** | Active antivirus protection (XProtect, Windows Defender, ClamAV, etc.) |\n| **Password Policy** | Minimum 8-character password enforced at the OS level |\n| **Screen Lock** | Automatic screen lock activates within 5 minutes of inactivity |\n\nYour device is **compliant** when all four checks pass.\n\nThe agent runs silently in your system tray and uses minimal system resources. It does not collect personal data, browsing history, or file contents.\n\n### **System Requirements**\n\n| **Requirement** | **Details** |\n| --- | --- |\n| **Operating Systems** | macOS 14+, Windows 10+, Linux (Ubuntu 20.04+) |\n| **Memory** | 512MB RAM minimum |\n| **Storage** | 200MB available disk space |\n\n### **Installation**\n\n**Step 1: Download the Agent**\n\nLog in to your organization's [**Employee Portal**](https://portal.trycomp.ai/) and navigate to the **Device Agent** task. Click **Download Agent** to get the installer for your operating system.\n\n- **macOS**: Downloads a `.dmg` file. If you have an Apple Silicon Mac (M1/M2/M3/M4), the portal selects the correct version automatically. You can also switch between Apple Silicon and Intel using the dropdown.\n- **Windows**: Downloads a `.exe` installer.\n- **Linux**: Downloads a `.deb` package.\n\n**Step 2: Install the Agent**\n\n**macOS**: Double-click the downloaded `.dmg` file and drag the Comp AI Device Agent to your Applications folder. **Windows**: Double-click the downloaded `.exe` file and follow the installation wizard. **Linux**: Install the downloaded `.deb` package using your package manager or by double-clicking it:\n\n```plaintext\nsudo dpkg -i CompAI-Device-Agent-amd64.deb\n```\n\n**Step 3: Sign In**\n\nAfter installation, the agent opens a sign-in window. Log in with your work email using the same method you use for the Employee Portal (email OTP, Google, or Microsoft).\n\nOnce signed in, the agent automatically:\n\n1. Registers your device with your organization(s)\n2. Runs the first compliance check immediately\n3. Starts checking every hour in the background\n\n### **Using the Device Agent**\n\nAfter signing in, the agent lives in your system tray (menu bar on macOS, system tray on Windows/Linux). Click the tray icon to open the status window.\n\nThe status window shows:\n\n- **Compliance status** — whether your device is compliant or needs attention\n- **Individual checks** — each of the four security checks with Pass/Fail status\n- **Remediation options** — for any failing check, the agent offers a way to fix it\n\n**Tray Icon Status**\n\n| **Icon Color** | **Meaning** |\n| --- | --- |\n| **Green** | Device is compliant — all checks passing |\n| **Red** | Device is non-compliant — one or more checks failing |\n| **Gray** | Agent is not signed in or checks are loading |\n\n**Fixing Failing Checks**\n\nWhen a check fails, the agent provides remediation options depending on what can be done automatically:\n\n| **Option** | **Description** |\n| --- | --- |\n| **Fix** | The agent fixes the issue automatically |\n| **Fix (Admin)** | The agent fixes it but may prompt for your system password |\n| **Open Settings** | Opens the relevant OS settings pane so you can fix it manually |\n| **View Guide** | Shows step-by-step instructions to resolve the issue |\n\nAfter fixing a failing check, click **Run Checks Now** to verify the fix immediately instead of waiting for the next hourly check.\n\n**Tray Menu Options**\n\nRight-click (or click on macOS) the tray icon to access:\n\n- **Run Checks Now** — trigger an immediate compliance check\n- **View Details** — open the status window\n- **Start at Login** — toggle whether the agent launches automatically when you log in (enabled by default)\n- **Sign Out** — sign out of the agent\n- **Quit** — close the agent completely\n\nIf you quit or sign out of the agent, your device will stop reporting compliance status to your organization. Your security administrator may follow up if your device stops checking in.\n\n### **Verifying on the Portal**\n\nAfter the agent runs its first check, you can verify your device compliance status on the Employee Portal. The **Device Agent** task shows your device name, platform, and whether all security checks are passing. The portal updates automatically — it polls your device status every 30 seconds while the page is open.\n\n### **Troubleshooting**\n\n**Agent won't sign in**\n\n- Make sure you're using the same email address you use for the Employee Portal\n- Check your internet connection\n- Try quitting the agent completely and reopening it\n- If using Google or Microsoft sign-in, make sure popups are not blocked\n\n**Checks are failing unexpectedly**\n\n- Click **Run Checks Now** to refresh the results\n- Review the failing check details — the agent shows what it detected\n- Use the remediation option provided (Fix, Open Settings, or View Guide)\n- Some changes (like enabling FileVault) require a restart to take effect\n\n**Agent is not visible in the system tray**\n\n- **macOS**: Look in the menu bar at the top of your screen. The icon may be hidden — check the overflow area (click the `>>` or similar)\n- **Windows**: Click the up arrow in the system tray to see hidden icons\n- **Linux**: Check your desktop environment's system tray or notification area\n- The agent may need to be reopened from your Applications folder\n\n**Portal shows device as non-compliant even though agent shows all checks passing**\n\n- Wait up to 30 seconds for the portal to refresh\n- Click **Run Checks Now** in the agent to trigger a fresh report\n- Check that the agent is signed in (tray icon should be green, not gray)\n\n**Device still shows as not passing after updating software**\n\nIf a device still shows as not completed or not passing in the portal even after the user has updated their laptop software, the Device Agent itself may need to be updated or reinstalled. Try the following steps in order:\n\n*Path 1: Auto-update via tray icon (most common)*\n\nThe agent checks for updates every hour automatically. If an update has already been downloaded, the tray icon menu will show \"Update ready — restart to install.\"\n\n1. Click the CompAI tray icon in the top menu bar (on macOS, move your cursor to the top-right of your screen near the clock until the icon appears).\n2. Click **\"Update ready — restart to install\"**.\n3. The agent restarts and is now updated.\n\n*Path 2: Manual reinstall (if the agent is broken or stuck)*\n\n1. Go to [portal.trycomp.ai](http://portal.trycomp.ai).\n2. Find the **Device Agent** task and click **\"Download Agent\"** — it auto-detects the Mac chip (M-series vs Intel).\n3. Open the downloaded `.dmg` file.\n4. Drag **CompAI Device Agent** to the Applications folder, replacing the existing installation.\n5. Launch the agent from Applications.\n6. Sign in with portal credentials if prompted.\n\nIf the device still does not show as passing after both steps above, contact support so an admin can investigate further.\n\n### **Migrating from FleetDM**\n\nIf your device previously had the FleetDM agent (fleetd) installed, you should uninstall it after setting up the new Comp AI Device Agent. The new agent fully replaces FleetDM, and having both running is unnecessary. Follow the official uninstall guide for your platform: [**How to uninstall fleetd**](https://fleetdm.com/guides/how-to-uninstall-fleetd)\n\n### **Manual Evidence Collection**\n\nFor users who cannot install the agent on their device, manual evidence of device settings is required. Below are the required pieces of evidence and where to obtain them.\n\n**Windows Manual Evidence**\n\n**Windows 10 & 11**\n\n**Enable BitLocker**\n\n1. Press **Start** → type **Manage BitLocker** → open it. Take a screenshot of the BitLocker Drive Encryption window showing \"On\" for the C: drive.\n2. Select the drive (usually C:) → click **Turn on BitLocker**.\n3. Save the recovery key to Microsoft Account / USB / secure location.\n4. Restart if prompted.\n\n**Screen Lock after 5 Minutes**\n\n1. Press **Start** → **Settings** → **Personalization** → **Lock screen**.\n2. Scroll down → click **Screen timeout settings**. Take a screenshot showing the screen timeout set to 5 minutes.\n3. Set **Screen turns off** = 5 minutes.\n4. In **Settings** → **Accounts** → **Sign-in options** → ensure **Require sign-in** is set to *\"When PC wakes up from sleep\"*. Take a screenshot of the Sign-in Options page showing this setting.\n\n**Minimum Password Length (Local Policy)**\n\n1. Press Win + R, type `secpol.msc`, press Enter.\n2. Go to **Account Policies** → **Password Policy**.\n3. Set **Minimum password length** = 8+. Take a screenshot of the Password Policy window with \"Minimum password length\" = 8 or more.\n\n*(If using Microsoft/AD/Azure, enforce via policy centrally and screenshot the policy compliance in the admin portal.)*\n\n**Automatic Security Updates**\n\n1. **Settings** → **Update & Security** → **Windows Update**.\n2. Select **Advanced options** → make sure Automatic updates are enabled. Take a screenshot of the Windows Update settings page showing automatic updates turned on.\n\n**Antivirus (Windows Defender)**\n\n1. **Settings** → **Update & Security** → **Windows Security**.\n2. Open **Virus & threat protection** → ensure **Real-time protection** is on. Take a screenshot of the Windows Security window showing Real-time protection is ON.\n\nEvidence gathered manually will be uploaded as a comment and attachment to the \"Secure Devices\" and \"Device List\" tasks with the user's email of the device the evidence is for.\n\n**macOS Manual Evidence**\n\n**macOS (Monterey, Ventura, Sonoma, Sequoia)**\n\n**Enable FileVault**\n\n1. Open **System Settings** (or **System Preferences** in older versions).\n2. Go to **Privacy & Security** → **FileVault**.\n3. Click **Turn On FileVault** → enter password.\n4. Record recovery key. Take a screenshot of the FileVault settings page showing \"FileVault is enabled for the disk.\"\n\n**Screen Auto-lock (5 min)**\n\n1. **System Settings** → **Lock Screen**.\n2. Set **Start screen saver when inactive** = 5 minutes. Take a screenshot showing the setting at 5 minutes.\n3. Set **Require password after sleep or screen saver begins** = *Immediately*. Take a screenshot showing \"Require password immediately\" is selected.\n\n**Minimum Password Length**\n\n1. Native macOS UI doesn't enforce this; requires **Terminal** or **MDM**.\n2. `pwpolicy -setglobalpolicy \"minChars=8\"`\n3. If set via Terminal, take a screenshot of the command output confirming the policy.\n4. If enforced by MDM (Jamf, Intune, etc.), screenshot the compliance screen from the MDM portal.\n\n**Automatic Security Updates**\n\n1. **System Settings** → **General** → **Software Update**.\n2. Click **Automatic Updates** → enable all options (Install Security Responses & System files, etc.). Take a screenshot of the Automatic Updates options screen with all toggles enabled.\n\n**Antivirus (XProtect built-in)**\n\n1. macOS automatically runs **XProtect** in the background.\n2. Simply ensure macOS is **fully updated**. Take a screenshot of the Software Update page showing the Mac is up to date.\n\nEvidence gathered manually will be uploaded as a comment and attachment to the \"Secure Devices\" and \"Device List\" tasks with the user's email of the device the evidence is for.\n\n**Linux Manual Evidence**\n\n**Ubuntu 20.04+ / Debian-based**\n\n**Enable LUKS Disk Encryption**\n\n1. LUKS encryption is typically configured during OS installation.\n2. To verify, run: `lsblk -o NAME,TYPE,FSTYPE | grep crypt` Take a screenshot showing the encrypted volume.\n\n**Screen Lock (5 min)**\n\n1. Open **Settings** → **Privacy** → **Screen Lock**.\n2. Set **Automatic Screen Lock Delay** = 5 minutes. Take a screenshot showing the screen lock delay setting.\n\n**Password Policy**\n\n1. Check minimum password length: `grep PASS_MIN_LEN /etc/login.defs`\n2. Ensure it's set to 8 or higher. Take a screenshot of the output.\n\n**Antivirus**\n\n1. Verify ClamAV or another antivirus is installed and running:\n\n ```plaintext\n systemctl status clamav-daemon\n \n ```\n2. \n\n ```plaintext\n sudo aa-status # AppArmor\n getenforce # SELinux\n \n ```\n\n```plaintext\nsystemctl status clamav-daemon\n```\n\n2. Alternatively, show AppArmor or SELinux is enforcing:\n\n```plaintext\nsudo aa-status # AppArmor\ngetenforce # SELinux\n```\n\nTake a screenshot of the output showing active protection.\n\nEvidence gathered manually will be uploaded as a comment and attachment to the \"Secure Devices\" and \"Device List\" tasks with the user's email of the device the evidence is for.\n\n### **About Data Collection**\n\nThe device agent is open source.\n\n1. It has no functionality to collect any data other than some checks e.g. is disk encryption enabled, is firewall enabled\n\n2. It returns a simple yes or no to our servers\n\n3. It's encouraged to install the device agent; if you'd prefer not to use it, screenshots can be collected for a sample % of users on an ongoing basis.\n\n4. For contractors, screenshots can be taken if they BYOD.\n\n5. It runs checks periodically and is very lightweight.\n\n6. It appears in the platform as non-compliant if checks fail; auditors would flag this to be fixed.\n\n7. We only send limited data, e.g. 'Yes or No' if a check is failing/passing.","2026-02-20T20:22:46.310Z","2026-07-07T16:18:44.305Z","a5ab0cf7-ad2e-45d4-be03-a75637583a07",[],[],[],"Background Checks — What to Expect\n","background-checks-what-to-expect","Comp AI runs background checks directly within the platform. The process is candidate-driven: you send an invite, the person being checked completes a secure form on their own, and results flow back into Comp AI automatically. No paperwork on your end.\n\n## **How it works (3 steps)**\n\n**1. You send the invite**\\\nFrom the employee's profile, choose **Order a check** and enter their name and personal email. They get an email invitation within minutes.\n\n**2. The candidate completes their part**\\\nThey click the link in the email and fill out a secure form — consent, identity verification, and the details needed for the checks below. This is the only step that requires the candidate's time (usually 10–15 minutes).\n\n**3. Results come back automatically**\\\nComp AI updates the status live as each part of the check completes. You'll see it move through the stages below, and the final report is attached to the employee record when it's done.\n\n## **How long it takes**\n\n- **Invite email:** sent within minutes\n- **Candidate form:** \\~10–15 minutes for them to complete\n- **Full turnaround:** **3–5 business days** once the candidate submits their information\n\nMost of the elapsed time is the candidate completing their part and verifications being processed — so the sooner they fill out the form, the sooner it finishes.\n\n## **What the candidate should have ready**\n\nTo avoid delays, the candidate should have these on hand **before** starting the form:\n\n| **Item** | **Why it's needed** |\n| --- | --- |\n| **Government-issued photo ID** (driver's license or passport) | Identity verification — matched against a selfie |\n| **A device with a camera** | To take the selfie used for ID matching |\n| **Employment history (last 7 years)** | Dates and job titles for each role |\n| **2–3 personal references** | Names and contact details — references are contacted directly |\n| **Work-authorization details** | To confirm right to work |\n\n## **Status stages you'll see**\n\n| **Status** | **Meaning** |\n| --- | --- |\n| **Invited** | Email sent; waiting on the candidate to start |\n| **In progress** | Candidate is filling out / has submitted the form |\n| **In review** | Verifications are being processed |\n| **Completed** | Passed — clean report |\n| **Completed with flags** | Finished, but with items worth reviewing |\n| **Failed** | Could not be completed/verified |\n\n## **Other options besides ordering a check**\n\nYou're not limited to ordering a new check:\n\n- **Attach an existing report** — already ran a check through another tool? Upload the PDF (up to 25 MB) and record the vendor and report date.\n- **Mark as exempt** — if a check isn't required for someone, mark them exempt with a reason and justification, and it won't count against your compliance requirements.","2026-06-18T13:40:01.361Z","2026-07-07T16:17:57.246Z","b17ece4f-c180-4a76-b326-81840c3bf7b4",[],[],[],{"_74":985,"_162":986,"_164":-5,"_166":987,"_168":792,"_169":-5,"_170":988,"_172":989,"_15":990,"_17":18,"_175":3027,"_176":3028,"_178":-5,"_179":3029,"_181":3030},{"_74":1603,"_162":1604,"_164":1605,"_166":1606,"_168":1066,"_169":-5,"_170":1607,"_172":1608,"_15":1609,"_17":18,"_175":3023,"_176":3024,"_178":-5,"_179":3025,"_181":3026},{"_74":628,"_162":629,"_164":630,"_166":428,"_168":-5,"_169":-5,"_170":631,"_172":632,"_15":633,"_17":18,"_175":-5,"_176":3020,"_178":-5,"_179":3021,"_181":3022},{"_74":1593,"_162":1594,"_164":1595,"_166":1596,"_168":1066,"_169":-5,"_170":1597,"_172":1598,"_15":1599,"_17":18,"_175":3016,"_176":3017,"_178":-5,"_179":3018,"_181":3019},{"_74":1583,"_162":1584,"_164":1585,"_166":1586,"_168":1066,"_169":-5,"_170":1587,"_172":1588,"_15":1589,"_17":18,"_175":3012,"_176":3013,"_178":-5,"_179":3014,"_181":3015},{"_74":620,"_162":621,"_164":-5,"_166":622,"_168":-5,"_169":83,"_170":623,"_172":623,"_15":624,"_17":18,"_175":-5,"_176":3009,"_178":-5,"_179":3010,"_181":3011},{"_74":620,"_162":773,"_164":-5,"_166":622,"_168":647,"_169":-5,"_170":774,"_172":774,"_15":775,"_17":18,"_175":3005,"_176":3006,"_178":-5,"_179":3007,"_181":3008},{"_74":976,"_162":977,"_164":-5,"_166":978,"_168":792,"_169":-5,"_170":979,"_172":980,"_15":981,"_17":18,"_175":3001,"_176":3002,"_178":-5,"_179":3003,"_181":3004},{"_74":1053,"_162":1054,"_164":-5,"_166":1055,"_168":998,"_169":-5,"_170":1056,"_172":1057,"_15":1058,"_17":18,"_175":2997,"_176":2998,"_178":-5,"_179":2999,"_181":3000},{"_74":1573,"_162":1574,"_164":1575,"_166":1576,"_168":1066,"_169":-5,"_170":1577,"_172":1578,"_15":1579,"_17":18,"_175":2993,"_176":2994,"_178":-5,"_179":2995,"_181":2996},{"_74":611,"_162":612,"_164":613,"_166":614,"_168":-5,"_169":-5,"_170":615,"_172":615,"_15":616,"_17":18,"_175":-5,"_176":2990,"_178":-5,"_179":2991,"_181":2992},{"_74":1555,"_162":1565,"_164":1566,"_166":1567,"_168":1066,"_169":-5,"_170":1568,"_172":1560,"_15":1569,"_17":18,"_175":2986,"_176":2987,"_178":-5,"_179":2988,"_181":2989},{"_74":1555,"_162":1556,"_164":1557,"_166":1558,"_168":1066,"_169":-5,"_170":1559,"_172":1560,"_15":1561,"_17":18,"_175":2982,"_176":2983,"_178":-5,"_179":2984,"_181":2985},{"_74":1536,"_162":1546,"_164":1547,"_166":1548,"_168":1066,"_169":-5,"_170":1549,"_172":1550,"_15":1551,"_17":18,"_175":2978,"_176":2979,"_178":-5,"_179":2980,"_181":2981},{"_74":1536,"_162":1537,"_164":1538,"_166":1539,"_168":1066,"_169":-5,"_170":1540,"_172":1541,"_15":1542,"_17":18,"_175":2974,"_176":2975,"_178":-5,"_179":2976,"_181":2977},{"_74":603,"_162":604,"_164":-5,"_166":605,"_168":-5,"_169":-5,"_170":606,"_172":606,"_15":607,"_17":18,"_175":-5,"_176":2971,"_178":-5,"_179":2972,"_181":2973},{"_74":595,"_162":596,"_164":-5,"_166":597,"_168":-5,"_169":-5,"_170":598,"_172":598,"_15":599,"_17":18,"_175":-5,"_176":2968,"_178":-5,"_179":2969,"_181":2970},{"_74":1510,"_162":1529,"_164":1530,"_166":1522,"_168":1066,"_169":-5,"_170":1531,"_172":1524,"_15":1532,"_17":18,"_175":2964,"_176":2965,"_178":-5,"_179":2966,"_181":2967},{"_74":1510,"_162":1520,"_164":1521,"_166":1522,"_168":1066,"_169":-5,"_170":1523,"_172":1524,"_15":1525,"_17":18,"_175":2960,"_176":2961,"_178":-5,"_179":2962,"_181":2963},{"_74":1510,"_162":1511,"_164":1512,"_166":1513,"_168":1066,"_169":-5,"_170":1514,"_172":1515,"_15":1516,"_17":18,"_175":2956,"_176":2957,"_178":-5,"_179":2958,"_181":2959},{"_74":1483,"_162":1501,"_164":1502,"_166":1503,"_168":1066,"_169":-5,"_170":1504,"_172":1505,"_15":1506,"_17":18,"_175":2952,"_176":2953,"_178":-5,"_179":2954,"_181":2955},{"_74":1483,"_162":1493,"_164":1494,"_166":1486,"_168":1066,"_169":-5,"_170":1495,"_172":1496,"_15":1497,"_17":18,"_175":2948,"_176":2949,"_178":-5,"_179":2950,"_181":2951},{"_74":1483,"_162":1484,"_164":1485,"_166":1486,"_168":1066,"_169":-5,"_170":1487,"_172":1488,"_15":1489,"_17":18,"_175":2944,"_176":2945,"_178":-5,"_179":2946,"_181":2947},{"_74":1711,"_162":1712,"_164":-5,"_166":1713,"_168":1617,"_169":-5,"_170":1714,"_172":1715,"_15":1716,"_17":18,"_175":2940,"_176":2941,"_178":-5,"_179":2942,"_181":2943},{"_74":586,"_162":587,"_164":542,"_166":588,"_168":-5,"_169":-5,"_170":589,"_172":590,"_15":591,"_17":18,"_175":-5,"_176":2937,"_178":-5,"_179":2938,"_181":2939},{"_74":578,"_162":579,"_164":-5,"_166":580,"_168":-5,"_169":-5,"_170":581,"_172":581,"_15":582,"_17":18,"_175":-5,"_176":2934,"_178":-5,"_179":2935,"_181":2936},{"_74":559,"_162":569,"_164":570,"_166":571,"_168":-5,"_169":-5,"_170":572,"_172":573,"_15":574,"_17":18,"_175":-5,"_176":2931,"_178":-5,"_179":2932,"_181":2933},{"_74":559,"_162":560,"_164":561,"_166":562,"_168":-5,"_169":-5,"_170":563,"_172":564,"_15":565,"_17":18,"_175":-5,"_176":2928,"_178":-5,"_179":2929,"_181":2930},{"_74":1457,"_162":1475,"_164":1476,"_166":1477,"_168":1066,"_169":-5,"_170":1478,"_172":1470,"_15":1479,"_17":18,"_175":2924,"_176":2925,"_178":-5,"_179":2926,"_181":2927},{"_74":1457,"_162":1467,"_164":1468,"_166":1460,"_168":1066,"_169":-5,"_170":1469,"_172":1470,"_15":1471,"_17":18,"_175":2920,"_176":2921,"_178":-5,"_179":2922,"_181":2923},{"_74":1457,"_162":1458,"_164":1459,"_166":1460,"_168":1066,"_169":-5,"_170":1461,"_172":1462,"_15":1463,"_17":18,"_175":2916,"_176":2917,"_178":-5,"_179":2918,"_181":2919},{"_74":967,"_162":968,"_164":-5,"_166":969,"_168":792,"_169":-5,"_170":970,"_172":971,"_15":972,"_17":18,"_175":2912,"_176":2913,"_178":-5,"_179":2914,"_181":2915},{"_74":1701,"_162":1702,"_164":1703,"_166":1704,"_168":1617,"_169":-5,"_170":1705,"_172":1706,"_15":1707,"_17":18,"_175":2908,"_176":2909,"_178":-5,"_179":2910,"_181":2911},{"_74":549,"_162":550,"_164":551,"_166":552,"_168":-5,"_169":-5,"_170":553,"_172":554,"_15":555,"_17":18,"_175":-5,"_176":2905,"_178":-5,"_179":2906,"_181":2907},{"_74":1448,"_162":1449,"_164":1362,"_166":1450,"_168":1066,"_169":-5,"_170":1451,"_172":1452,"_15":1453,"_17":18,"_175":2901,"_176":2902,"_178":-5,"_179":2903,"_181":2904},{"_74":540,"_162":541,"_164":542,"_166":543,"_168":-5,"_169":-5,"_170":544,"_172":544,"_15":545,"_17":18,"_175":-5,"_176":2898,"_178":-5,"_179":2899,"_181":2900},{"_74":530,"_162":531,"_164":532,"_166":533,"_168":-5,"_169":-5,"_170":534,"_172":535,"_15":536,"_17":18,"_175":-5,"_176":2895,"_178":-5,"_179":2896,"_181":2897},{"_74":520,"_162":521,"_164":522,"_166":523,"_168":-5,"_169":-5,"_170":524,"_172":525,"_15":526,"_17":18,"_175":-5,"_176":2892,"_178":-5,"_179":2893,"_181":2894},{"_74":502,"_162":512,"_164":513,"_166":505,"_168":-5,"_169":-5,"_170":514,"_172":515,"_15":516,"_17":18,"_175":-5,"_176":2889,"_178":-5,"_179":2890,"_181":2891},{"_74":502,"_162":503,"_164":504,"_166":505,"_168":-5,"_169":-5,"_170":506,"_172":507,"_15":508,"_17":18,"_175":-5,"_176":2886,"_178":-5,"_179":2887,"_181":2888},{"_74":958,"_162":959,"_164":-5,"_166":960,"_168":792,"_169":-5,"_170":961,"_172":962,"_15":963,"_17":18,"_175":2882,"_176":2883,"_178":-5,"_179":2884,"_181":2885},{"_74":1429,"_162":1439,"_164":1440,"_166":1441,"_168":1066,"_169":-5,"_170":1442,"_172":1443,"_15":1444,"_17":18,"_175":2878,"_176":2879,"_178":-5,"_179":2880,"_181":2881},{"_74":1429,"_162":1430,"_164":1431,"_166":1432,"_168":1066,"_169":-5,"_170":1433,"_172":1434,"_15":1435,"_17":18,"_175":2874,"_176":2875,"_178":-5,"_179":2876,"_181":2877},{"_74":494,"_162":495,"_164":-5,"_166":496,"_168":-5,"_169":-5,"_170":497,"_172":497,"_15":498,"_17":18,"_175":-5,"_176":2871,"_178":-5,"_179":2872,"_181":2873},{"_74":484,"_162":485,"_164":486,"_166":487,"_168":-5,"_169":-5,"_170":488,"_172":489,"_15":490,"_17":18,"_175":-5,"_176":2868,"_178":-5,"_179":2869,"_181":2870},{"_74":1419,"_162":1420,"_164":1421,"_166":1422,"_168":1066,"_169":-5,"_170":1423,"_172":1424,"_15":1425,"_17":18,"_175":2864,"_176":2865,"_178":-5,"_179":2866,"_181":2867},{"_74":1409,"_162":1410,"_164":1411,"_166":1412,"_168":1066,"_169":-5,"_170":1413,"_172":1414,"_15":1415,"_17":18,"_175":2860,"_176":2861,"_178":-5,"_179":2862,"_181":2863},{"_74":1400,"_162":1401,"_164":1402,"_166":1403,"_168":1066,"_169":-5,"_170":1404,"_172":1395,"_15":1405,"_17":18,"_175":2856,"_176":2857,"_178":-5,"_179":2858,"_181":2859},{"_74":1390,"_162":1391,"_164":1392,"_166":1393,"_168":1066,"_169":-5,"_170":1394,"_172":1395,"_15":1396,"_17":18,"_175":2852,"_176":2853,"_178":-5,"_179":2854,"_181":2855},{"_74":1380,"_162":1381,"_164":1382,"_166":1383,"_168":1066,"_169":-5,"_170":1384,"_172":1385,"_15":1386,"_17":18,"_175":2848,"_176":2849,"_178":-5,"_179":2850,"_181":2851},{"_74":1370,"_162":1371,"_164":1372,"_166":1373,"_168":1066,"_169":-5,"_170":1374,"_172":1375,"_15":1376,"_17":18,"_175":2844,"_176":2845,"_178":-5,"_179":2846,"_181":2847},{"_74":1360,"_162":1361,"_164":1362,"_166":1363,"_168":1066,"_169":-5,"_170":1364,"_172":1365,"_15":1366,"_17":18,"_175":2840,"_176":2841,"_178":-5,"_179":2842,"_181":2843},{"_74":475,"_162":476,"_164":-5,"_166":477,"_168":-5,"_169":-5,"_170":478,"_172":479,"_15":480,"_17":18,"_175":-5,"_176":2837,"_178":-5,"_179":2838,"_181":2839},{"_74":465,"_162":466,"_164":467,"_166":468,"_168":-5,"_169":-5,"_170":469,"_172":470,"_15":471,"_17":18,"_175":-5,"_176":2834,"_178":-5,"_179":2835,"_181":2836},{"_74":455,"_162":456,"_164":457,"_166":458,"_168":-5,"_169":-5,"_170":459,"_172":460,"_15":461,"_17":18,"_175":-5,"_176":2831,"_178":-5,"_179":2832,"_181":2833},{"_74":949,"_162":950,"_164":-5,"_166":951,"_168":792,"_169":-5,"_170":952,"_172":953,"_15":954,"_17":18,"_175":2827,"_176":2828,"_178":-5,"_179":2829,"_181":2830},{"_74":445,"_162":446,"_164":447,"_166":448,"_168":-5,"_169":-5,"_170":449,"_172":450,"_15":451,"_17":18,"_175":-5,"_176":2824,"_178":-5,"_179":2825,"_181":2826},{"_74":435,"_162":436,"_164":437,"_166":438,"_168":-5,"_169":-5,"_170":439,"_172":440,"_15":441,"_17":18,"_175":-5,"_176":2821,"_178":-5,"_179":2822,"_181":2823},{"_74":1350,"_162":1351,"_164":1352,"_166":1353,"_168":1066,"_169":-5,"_170":1354,"_172":1355,"_15":1356,"_17":18,"_175":2817,"_176":2818,"_178":-5,"_179":2819,"_181":2820},{"_74":1340,"_162":1341,"_164":1342,"_166":1343,"_168":1066,"_169":-5,"_170":1344,"_172":1345,"_15":1346,"_17":18,"_175":2813,"_176":2814,"_178":-5,"_179":2815,"_181":2816},{"_74":1330,"_162":1331,"_164":1332,"_166":1333,"_168":1066,"_169":-5,"_170":1334,"_172":1335,"_15":1336,"_17":18,"_175":2809,"_176":2810,"_178":-5,"_179":2811,"_181":2812},{"_74":1320,"_162":1321,"_164":1322,"_166":1323,"_168":1066,"_169":-5,"_170":1324,"_172":1325,"_15":1326,"_17":18,"_175":2805,"_176":2806,"_178":-5,"_179":2807,"_181":2808},{"_74":1310,"_162":1311,"_164":1312,"_166":1313,"_168":1066,"_169":-5,"_170":1314,"_172":1315,"_15":1316,"_17":18,"_175":2801,"_176":2802,"_178":-5,"_179":2803,"_181":2804},{"_74":1300,"_162":1301,"_164":1302,"_166":1303,"_168":1066,"_169":-5,"_170":1304,"_172":1305,"_15":1306,"_17":18,"_175":2797,"_176":2798,"_178":-5,"_179":2799,"_181":2800},{"_74":1290,"_162":1291,"_164":1292,"_166":1293,"_168":1066,"_169":-5,"_170":1294,"_172":1295,"_15":1296,"_17":18,"_175":2793,"_176":2794,"_178":-5,"_179":2795,"_181":2796},{"_74":1280,"_162":1281,"_164":1282,"_166":1283,"_168":1066,"_169":-5,"_170":1284,"_172":1285,"_15":1286,"_17":18,"_175":2789,"_176":2790,"_178":-5,"_179":2791,"_181":2792},{"_74":1270,"_162":1271,"_164":1272,"_166":1273,"_168":1066,"_169":-5,"_170":1274,"_172":1275,"_15":1276,"_17":18,"_175":2785,"_176":2786,"_178":-5,"_179":2787,"_181":2788},{"_74":1260,"_162":1261,"_164":1262,"_166":1263,"_168":1066,"_169":-5,"_170":1264,"_172":1265,"_15":1266,"_17":18,"_175":2781,"_176":2782,"_178":-5,"_179":2783,"_181":2784},{"_74":1250,"_162":1251,"_164":1252,"_166":1253,"_168":1066,"_169":-5,"_170":1254,"_172":1255,"_15":1256,"_17":18,"_175":2777,"_176":2778,"_178":-5,"_179":2779,"_181":2780},{"_74":940,"_162":941,"_164":-5,"_166":942,"_168":792,"_169":-5,"_170":943,"_172":944,"_15":945,"_17":18,"_175":2773,"_176":2774,"_178":-5,"_179":2775,"_181":2776},{"_74":425,"_162":426,"_164":427,"_166":428,"_168":-5,"_169":-5,"_170":429,"_172":430,"_15":431,"_17":18,"_175":-5,"_176":2770,"_178":-5,"_179":2771,"_181":2772},{"_74":931,"_162":932,"_164":-5,"_166":933,"_168":792,"_169":-5,"_170":934,"_172":935,"_15":936,"_17":18,"_175":2766,"_176":2767,"_178":-5,"_179":2768,"_181":2769},{"_74":399,"_162":417,"_164":418,"_166":319,"_168":-5,"_169":-5,"_170":419,"_172":420,"_15":421,"_17":18,"_175":-5,"_176":2763,"_178":-5,"_179":2764,"_181":2765},{"_74":399,"_162":408,"_164":409,"_166":410,"_168":-5,"_169":-5,"_170":411,"_172":412,"_15":413,"_17":18,"_175":-5,"_176":2760,"_178":-5,"_179":2761,"_181":2762},{"_74":399,"_162":400,"_164":401,"_166":402,"_168":-5,"_169":-5,"_170":403,"_172":403,"_15":404,"_17":18,"_175":-5,"_176":2757,"_178":-5,"_179":2758,"_181":2759},{"_74":1692,"_162":1693,"_164":-5,"_166":1694,"_168":1617,"_169":-5,"_170":1695,"_172":1696,"_15":1697,"_17":18,"_175":2753,"_176":2754,"_178":-5,"_179":2755,"_181":2756},{"_74":1240,"_162":1241,"_164":1242,"_166":1243,"_168":1066,"_169":-5,"_170":1244,"_172":1245,"_15":1246,"_17":18,"_175":2749,"_176":2750,"_178":-5,"_179":2751,"_181":2752},{"_74":391,"_162":392,"_164":-5,"_166":393,"_168":-5,"_169":-5,"_170":394,"_172":394,"_15":395,"_17":18,"_175":-5,"_176":2746,"_178":-5,"_179":2747,"_181":2748},{"_74":381,"_162":382,"_164":383,"_166":384,"_168":-5,"_169":-5,"_170":385,"_172":386,"_15":387,"_17":18,"_175":-5,"_176":2743,"_178":-5,"_179":2744,"_181":2745},{"_74":371,"_162":372,"_164":373,"_166":374,"_168":-5,"_169":-5,"_170":375,"_172":376,"_15":377,"_17":18,"_175":-5,"_176":2740,"_178":-5,"_179":2741,"_181":2742},{"_74":922,"_162":923,"_164":-5,"_166":924,"_168":792,"_169":-5,"_170":925,"_172":926,"_15":927,"_17":18,"_175":2736,"_176":2737,"_178":-5,"_179":2738,"_181":2739},{"_74":361,"_162":362,"_164":363,"_166":364,"_168":-5,"_169":-5,"_170":365,"_172":366,"_15":367,"_17":18,"_175":-5,"_176":2733,"_178":-5,"_179":2734,"_181":2735},{"_74":353,"_162":354,"_164":-5,"_166":355,"_168":-5,"_169":-5,"_170":356,"_172":356,"_15":357,"_17":18,"_175":-5,"_176":2730,"_178":-5,"_179":2731,"_181":2732},{"_74":913,"_162":914,"_164":-5,"_166":915,"_168":792,"_169":-5,"_170":916,"_172":917,"_15":918,"_17":18,"_175":2726,"_176":2727,"_178":-5,"_179":2728,"_181":2729},{"_74":345,"_162":346,"_164":-5,"_166":347,"_168":-5,"_169":-5,"_170":348,"_172":348,"_15":349,"_17":18,"_175":-5,"_176":2723,"_178":-5,"_179":2724,"_181":2725},{"_74":326,"_162":336,"_164":337,"_166":338,"_168":-5,"_169":-5,"_170":339,"_172":340,"_15":341,"_17":18,"_175":-5,"_176":2720,"_178":-5,"_179":2721,"_181":2722},{"_74":326,"_162":327,"_164":328,"_166":329,"_168":-5,"_169":-5,"_170":330,"_172":331,"_15":332,"_17":18,"_175":-5,"_176":2717,"_178":-5,"_179":2718,"_181":2719},{"_74":299,"_162":317,"_164":318,"_166":319,"_168":-5,"_169":-5,"_170":320,"_172":321,"_15":322,"_17":18,"_175":-5,"_176":2714,"_178":-5,"_179":2715,"_181":2716},{"_74":299,"_162":308,"_164":309,"_166":310,"_168":-5,"_169":-5,"_170":311,"_172":312,"_15":313,"_17":18,"_175":-5,"_176":2711,"_178":-5,"_179":2712,"_181":2713},{"_74":299,"_162":300,"_164":-5,"_166":301,"_168":-5,"_169":-5,"_170":302,"_172":303,"_15":304,"_17":18,"_175":-5,"_176":2708,"_178":-5,"_179":2709,"_181":2710},{"_74":290,"_162":291,"_164":-5,"_166":292,"_168":-5,"_169":-5,"_170":293,"_172":294,"_15":295,"_17":18,"_175":-5,"_176":2705,"_178":-5,"_179":2706,"_181":2707},{"_74":905,"_162":906,"_164":-5,"_166":907,"_168":792,"_169":-5,"_170":908,"_172":908,"_15":909,"_17":18,"_175":2701,"_176":2702,"_178":-5,"_179":2703,"_181":2704},{"_74":272,"_162":282,"_164":283,"_166":275,"_168":-5,"_169":-5,"_170":284,"_172":285,"_15":286,"_17":18,"_175":-5,"_176":2698,"_178":-5,"_179":2699,"_181":2700},{"_74":272,"_162":273,"_164":274,"_166":275,"_168":-5,"_169":-5,"_170":276,"_172":277,"_15":278,"_17":18,"_175":-5,"_176":2695,"_178":-5,"_179":2696,"_181":2697},{"_74":264,"_162":265,"_164":-5,"_166":266,"_168":-5,"_169":-5,"_170":267,"_172":267,"_15":268,"_17":18,"_175":-5,"_176":2692,"_178":-5,"_179":2693,"_181":2694},{"_74":255,"_162":256,"_164":-5,"_166":257,"_168":-5,"_169":-5,"_170":258,"_172":259,"_15":260,"_17":18,"_175":-5,"_176":2689,"_178":-5,"_179":2690,"_181":2691},{"_74":245,"_162":246,"_164":247,"_166":248,"_168":-5,"_169":-5,"_170":249,"_172":250,"_15":251,"_17":18,"_175":-5,"_176":2686,"_178":-5,"_179":2687,"_181":2688},{"_74":1221,"_162":1231,"_164":1232,"_166":1233,"_168":1066,"_169":-5,"_170":1234,"_172":1235,"_15":1236,"_17":18,"_175":2682,"_176":2683,"_178":-5,"_179":2684,"_181":2685},{"_74":1221,"_162":1222,"_164":1223,"_166":1224,"_168":1066,"_169":-5,"_170":1225,"_172":1226,"_15":1227,"_17":18,"_175":2678,"_176":2679,"_178":-5,"_179":2680,"_181":2681},{"_74":994,"_162":1044,"_164":1045,"_166":1046,"_168":998,"_169":-5,"_170":1047,"_172":1048,"_15":1049,"_17":18,"_175":2674,"_176":2675,"_178":-5,"_179":2676,"_181":2677},{"_74":1035,"_162":1036,"_164":-5,"_166":1037,"_168":998,"_169":-5,"_170":1038,"_172":1039,"_15":1040,"_17":18,"_175":2670,"_176":2671,"_178":-5,"_179":2672,"_181":2673},{"_74":1025,"_162":1026,"_164":1027,"_166":1028,"_168":998,"_169":-5,"_170":1029,"_172":1030,"_15":1031,"_17":18,"_175":2666,"_176":2667,"_178":-5,"_179":2668,"_181":2669},{"_74":1211,"_162":1212,"_164":1213,"_166":1214,"_168":1066,"_169":-5,"_170":1215,"_172":1216,"_15":1217,"_17":18,"_175":2662,"_176":2663,"_178":-5,"_179":2664,"_181":2665},{"_74":1201,"_162":1202,"_164":1203,"_166":1204,"_168":1066,"_169":-5,"_170":1205,"_172":1206,"_15":1207,"_17":18,"_175":2658,"_176":2659,"_178":-5,"_179":2660,"_181":2661},{"_74":1191,"_162":1192,"_164":1193,"_166":1194,"_168":1066,"_169":-5,"_170":1195,"_172":1196,"_15":1197,"_17":18,"_175":2654,"_176":2655,"_178":-5,"_179":2656,"_181":2657},{"_74":1181,"_162":1182,"_164":1183,"_166":1184,"_168":1066,"_169":-5,"_170":1185,"_172":1186,"_15":1187,"_17":18,"_175":2650,"_176":2651,"_178":-5,"_179":2652,"_181":2653},{"_74":1171,"_162":1172,"_164":1173,"_166":1174,"_168":1066,"_169":-5,"_170":1175,"_172":1176,"_15":1177,"_17":18,"_175":2646,"_176":2647,"_178":-5,"_179":2648,"_181":2649},{"_74":1161,"_162":1162,"_164":1163,"_166":1164,"_168":1066,"_169":-5,"_170":1165,"_172":1166,"_15":1167,"_17":18,"_175":2642,"_176":2643,"_178":-5,"_179":2644,"_181":2645},{"_74":1151,"_162":1152,"_164":1153,"_166":1154,"_168":1066,"_169":-5,"_170":1155,"_172":1156,"_15":1157,"_17":18,"_175":2638,"_176":2639,"_178":-5,"_179":2640,"_181":2641},{"_74":1141,"_162":1142,"_164":1143,"_166":1144,"_168":1066,"_169":-5,"_170":1145,"_172":1146,"_15":1147,"_17":18,"_175":2634,"_176":2635,"_178":-5,"_179":2636,"_181":2637},{"_74":1131,"_162":1132,"_164":1133,"_166":1134,"_168":1066,"_169":-5,"_170":1135,"_172":1136,"_15":1137,"_17":18,"_175":2630,"_176":2631,"_178":-5,"_179":2632,"_181":2633},{"_74":1121,"_162":1122,"_164":1123,"_166":1124,"_168":1066,"_169":-5,"_170":1125,"_172":1126,"_15":1127,"_17":18,"_175":2626,"_176":2627,"_178":-5,"_179":2628,"_181":2629},{"_74":2615,"_162":2616,"_164":2617,"_166":2618,"_168":1066,"_169":-5,"_170":2619,"_172":2620,"_15":2621,"_17":18,"_175":2622,"_176":2623,"_178":-5,"_179":2624,"_181":2625},{"_74":2594,"_162":2605,"_164":2606,"_166":2607,"_168":1066,"_169":-5,"_170":2608,"_172":2609,"_15":2610,"_17":18,"_175":2611,"_176":2612,"_178":-5,"_179":2613,"_181":2614},{"_74":2594,"_162":2595,"_164":2596,"_166":2597,"_168":1066,"_169":-5,"_170":2598,"_172":2599,"_15":2600,"_17":18,"_175":2601,"_176":2602,"_178":-5,"_179":2603,"_181":2604},{"_74":2583,"_162":2584,"_164":2585,"_166":2586,"_168":1066,"_169":-5,"_170":2587,"_172":2588,"_15":2589,"_17":18,"_175":2590,"_176":2591,"_178":-5,"_179":2592,"_181":2593},{"_74":2572,"_162":2573,"_164":2574,"_166":2575,"_168":1066,"_169":-5,"_170":2576,"_172":2577,"_15":2578,"_17":18,"_175":2579,"_176":2580,"_178":-5,"_179":2581,"_181":2582},{"_74":2561,"_162":2562,"_164":2563,"_166":2564,"_168":1066,"_169":-5,"_170":2565,"_172":2566,"_15":2567,"_17":18,"_175":2568,"_176":2569,"_178":-5,"_179":2570,"_181":2571},{"_74":2550,"_162":2551,"_164":2552,"_166":2553,"_168":1066,"_169":-5,"_170":2554,"_172":2555,"_15":2556,"_17":18,"_175":2557,"_176":2558,"_178":-5,"_179":2559,"_181":2560},{"_74":2539,"_162":2540,"_164":2541,"_166":2542,"_168":1066,"_169":-5,"_170":2543,"_172":2544,"_15":2545,"_17":18,"_175":2546,"_176":2547,"_178":-5,"_179":2548,"_181":2549},{"_74":2528,"_162":2529,"_164":2530,"_166":2531,"_168":1066,"_169":-5,"_170":2532,"_172":2533,"_15":2534,"_17":18,"_175":2535,"_176":2536,"_178":-5,"_179":2537,"_181":2538},{"_74":2517,"_162":2518,"_164":2519,"_166":2520,"_168":1066,"_169":-5,"_170":2521,"_172":2522,"_15":2523,"_17":18,"_175":2524,"_176":2525,"_178":-5,"_179":2526,"_181":2527},{"_74":2506,"_162":2507,"_164":2508,"_166":2509,"_168":1066,"_169":-5,"_170":2510,"_172":2511,"_15":2512,"_17":18,"_175":2513,"_176":2514,"_178":-5,"_179":2515,"_181":2516},{"_74":2495,"_162":2496,"_164":2497,"_166":2498,"_168":1066,"_169":-5,"_170":2499,"_172":2500,"_15":2501,"_17":18,"_175":2502,"_176":2503,"_178":-5,"_179":2504,"_181":2505},{"_74":2484,"_162":2485,"_164":2486,"_166":2487,"_168":1066,"_169":-5,"_170":2488,"_172":2489,"_15":2490,"_17":18,"_175":2491,"_176":2492,"_178":-5,"_179":2493,"_181":2494},{"_74":2473,"_162":2474,"_164":2475,"_166":2476,"_168":1066,"_169":-5,"_170":2477,"_172":2478,"_15":2479,"_17":18,"_175":2480,"_176":2481,"_178":-5,"_179":2482,"_181":2483},{"_74":2462,"_162":2463,"_164":2464,"_166":2465,"_168":1066,"_169":-5,"_170":2466,"_172":2467,"_15":2468,"_17":18,"_175":2469,"_176":2470,"_178":-5,"_179":2471,"_181":2472},{"_74":2451,"_162":2452,"_164":2453,"_166":2454,"_168":1066,"_169":-5,"_170":2455,"_172":2456,"_15":2457,"_17":18,"_175":2458,"_176":2459,"_178":-5,"_179":2460,"_181":2461},{"_74":237,"_162":238,"_164":-5,"_166":239,"_168":-5,"_169":83,"_170":240,"_172":240,"_15":241,"_17":18,"_175":-5,"_176":2448,"_178":-5,"_179":2449,"_181":2450},{"_74":237,"_162":1685,"_164":-5,"_166":1686,"_168":1617,"_169":-5,"_170":1687,"_172":1687,"_15":1688,"_17":18,"_175":2444,"_176":2445,"_178":-5,"_179":2446,"_181":2447},{"_74":2433,"_162":2434,"_164":2435,"_166":2436,"_168":1066,"_169":-5,"_170":2437,"_172":2438,"_15":2439,"_17":18,"_175":2440,"_176":2441,"_178":-5,"_179":2442,"_181":2443},{"_74":228,"_162":229,"_164":-5,"_166":230,"_168":-5,"_169":-5,"_170":231,"_172":232,"_15":233,"_17":18,"_175":-5,"_176":2430,"_178":-5,"_179":2431,"_181":2432},{"_74":219,"_162":220,"_164":-5,"_166":221,"_168":-5,"_169":83,"_170":222,"_172":223,"_15":224,"_17":18,"_175":-5,"_176":2427,"_178":-5,"_179":2428,"_181":2429},{"_74":211,"_162":212,"_164":-5,"_166":213,"_168":-5,"_169":-5,"_170":214,"_172":214,"_15":215,"_17":18,"_175":-5,"_176":2424,"_178":-5,"_179":2425,"_181":2426},{"_74":201,"_162":202,"_164":203,"_166":204,"_168":-5,"_169":-5,"_170":205,"_172":206,"_15":207,"_17":18,"_175":-5,"_176":2421,"_178":-5,"_179":2422,"_181":2423},{"_74":191,"_162":192,"_164":193,"_166":194,"_168":-5,"_169":-5,"_170":195,"_172":196,"_15":197,"_17":18,"_175":-5,"_176":2418,"_178":-5,"_179":2419,"_181":2420},{"_74":183,"_162":184,"_164":-5,"_166":185,"_168":-5,"_169":83,"_170":186,"_172":186,"_15":187,"_17":18,"_175":-5,"_176":2415,"_178":-5,"_179":2416,"_181":2417},{"_74":183,"_162":765,"_164":-5,"_166":766,"_168":647,"_169":-5,"_170":767,"_172":768,"_15":769,"_17":18,"_175":2411,"_176":2412,"_178":-5,"_179":2413,"_181":2414},{"_74":2400,"_162":2401,"_164":2402,"_166":2403,"_168":1066,"_169":-5,"_170":2404,"_172":2405,"_15":2406,"_17":18,"_175":2407,"_176":2408,"_178":-5,"_179":2409,"_181":2410},{"_74":161,"_162":163,"_164":165,"_166":167,"_168":-5,"_169":-5,"_170":171,"_172":173,"_15":174,"_17":18,"_175":-5,"_176":2397,"_178":-5,"_179":2398,"_181":2399},{"_74":756,"_162":757,"_164":-5,"_166":758,"_168":647,"_169":-5,"_170":759,"_172":760,"_15":761,"_17":18,"_175":2393,"_176":2394,"_178":-5,"_179":2395,"_181":2396},{"_74":747,"_162":748,"_164":-5,"_166":749,"_168":647,"_169":-5,"_170":750,"_172":751,"_15":752,"_17":18,"_175":2389,"_176":2390,"_178":-5,"_179":2391,"_181":2392},{"_74":738,"_162":739,"_164":-5,"_166":740,"_168":647,"_169":-5,"_170":741,"_172":742,"_15":743,"_17":18,"_175":2385,"_176":2386,"_178":-5,"_179":2387,"_181":2388},{"_74":896,"_162":897,"_164":-5,"_166":898,"_168":792,"_169":-5,"_170":899,"_172":900,"_15":901,"_17":18,"_175":2381,"_176":2382,"_178":-5,"_179":2383,"_181":2384},{"_74":2363,"_162":2373,"_164":2374,"_166":2366,"_168":-5,"_169":-5,"_170":2375,"_172":2376,"_15":2377,"_17":18,"_175":-5,"_176":2378,"_178":-5,"_179":2379,"_181":2380},{"_74":2363,"_162":2364,"_164":2365,"_166":2366,"_168":-5,"_169":-5,"_170":2367,"_172":2368,"_15":2369,"_17":18,"_175":-5,"_176":2370,"_178":-5,"_179":2371,"_181":2372},{"_74":2353,"_162":2354,"_164":2355,"_166":2356,"_168":-5,"_169":-5,"_170":2357,"_172":2358,"_15":2359,"_17":18,"_175":-5,"_176":2360,"_178":-5,"_179":2361,"_181":2362},{"_74":2336,"_162":2345,"_164":2346,"_166":319,"_168":-5,"_169":-5,"_170":2347,"_172":2348,"_15":2349,"_17":18,"_175":-5,"_176":2350,"_178":-5,"_179":2351,"_181":2352},{"_74":2336,"_162":2337,"_164":2329,"_166":2338,"_168":-5,"_169":-5,"_170":2339,"_172":2340,"_15":2341,"_17":18,"_175":-5,"_176":2342,"_178":-5,"_179":2343,"_181":2344},{"_74":2327,"_162":2328,"_164":2329,"_166":2330,"_168":-5,"_169":-5,"_170":2331,"_172":2331,"_15":2332,"_17":18,"_175":-5,"_176":2333,"_178":-5,"_179":2334,"_181":2335},{"_74":2306,"_162":2317,"_164":2318,"_166":2319,"_168":1066,"_169":-5,"_170":2320,"_172":2321,"_15":2322,"_17":18,"_175":2323,"_176":2324,"_178":-5,"_179":2325,"_181":2326},{"_74":2306,"_162":2307,"_164":2308,"_166":2309,"_168":1066,"_169":-5,"_170":2310,"_172":2311,"_15":2312,"_17":18,"_175":2313,"_176":2314,"_178":-5,"_179":2315,"_181":2316},{"_74":2296,"_162":2297,"_164":2298,"_166":2299,"_168":-5,"_169":-5,"_170":2300,"_172":2301,"_15":2302,"_17":18,"_175":-5,"_176":2303,"_178":-5,"_179":2304,"_181":2305},{"_74":2285,"_162":2286,"_164":2287,"_166":2288,"_168":1066,"_169":-5,"_170":2289,"_172":2290,"_15":2291,"_17":18,"_175":2292,"_176":2293,"_178":-5,"_179":2294,"_181":2295},{"_74":2274,"_162":2275,"_164":2276,"_166":2277,"_168":1066,"_169":-5,"_170":2278,"_172":2279,"_15":2280,"_17":18,"_175":2281,"_176":2282,"_178":-5,"_179":2283,"_181":2284},{"_74":2263,"_162":2264,"_164":2265,"_166":2266,"_168":1066,"_169":-5,"_170":2267,"_172":2268,"_15":2269,"_17":18,"_175":2270,"_176":2271,"_178":-5,"_179":2272,"_181":2273},{"_74":2254,"_162":2255,"_164":-5,"_166":2256,"_168":-5,"_169":-5,"_170":2257,"_172":2258,"_15":2259,"_17":18,"_175":-5,"_176":2260,"_178":-5,"_179":2261,"_181":2262},{"_74":1016,"_162":1017,"_164":-5,"_166":1018,"_168":998,"_169":-5,"_170":1019,"_172":1020,"_15":1021,"_17":18,"_175":2250,"_176":2251,"_178":-5,"_179":2252,"_181":2253},{"_74":2242,"_162":2243,"_164":-5,"_166":2244,"_168":-5,"_169":83,"_170":2245,"_172":2245,"_15":2246,"_17":18,"_175":-5,"_176":2247,"_178":-5,"_179":2248,"_181":2249},{"_74":2231,"_162":2232,"_164":2233,"_166":2234,"_168":1066,"_169":-5,"_170":2235,"_172":2236,"_15":2237,"_17":18,"_175":2238,"_176":2239,"_178":-5,"_179":2240,"_181":2241},{"_74":2221,"_162":2222,"_164":2223,"_166":2224,"_168":-5,"_169":-5,"_170":2225,"_172":2226,"_15":2227,"_17":18,"_175":-5,"_176":2228,"_178":-5,"_179":2229,"_181":2230},{"_74":887,"_162":888,"_164":-5,"_166":889,"_168":792,"_169":-5,"_170":890,"_172":891,"_15":892,"_17":18,"_175":2217,"_176":2218,"_178":-5,"_179":2219,"_181":2220},{"_74":729,"_162":730,"_164":-5,"_166":731,"_168":647,"_169":-5,"_170":732,"_172":733,"_15":734,"_17":18,"_175":2213,"_176":2214,"_178":-5,"_179":2215,"_181":2216},{"_74":2194,"_162":2204,"_164":2205,"_166":2206,"_168":-5,"_169":-5,"_170":2207,"_172":2208,"_15":2209,"_17":18,"_175":-5,"_176":2210,"_178":-5,"_179":2211,"_181":2212},{"_74":2194,"_162":2195,"_164":2196,"_166":2197,"_168":-5,"_169":-5,"_170":2198,"_172":2199,"_15":2200,"_17":18,"_175":-5,"_176":2201,"_178":-5,"_179":2202,"_181":2203},{"_74":2184,"_162":2185,"_164":2186,"_166":2187,"_168":-5,"_169":-5,"_170":2188,"_172":2189,"_15":2190,"_17":18,"_175":-5,"_176":2191,"_178":-5,"_179":2192,"_181":2193},{"_74":2176,"_162":2177,"_164":-5,"_166":2178,"_168":-5,"_169":-5,"_170":2179,"_172":2179,"_15":2180,"_17":18,"_175":-5,"_176":2181,"_178":-5,"_179":2182,"_181":2183},{"_74":1998,"_162":2168,"_164":2169,"_166":319,"_168":-5,"_169":-5,"_170":2170,"_172":2171,"_15":2172,"_17":18,"_175":-5,"_176":2173,"_178":-5,"_179":2174,"_181":2175},{"_74":1998,"_162":2160,"_164":2161,"_166":319,"_168":-5,"_169":-5,"_170":2162,"_172":2163,"_15":2164,"_17":18,"_175":-5,"_176":2165,"_178":-5,"_179":2166,"_181":2167},{"_74":1998,"_162":2152,"_164":2153,"_166":319,"_168":-5,"_169":-5,"_170":2154,"_172":2155,"_15":2156,"_17":18,"_175":-5,"_176":2157,"_178":-5,"_179":2158,"_181":2159},{"_74":1998,"_162":2144,"_164":2145,"_166":319,"_168":-5,"_169":-5,"_170":2146,"_172":2147,"_15":2148,"_17":18,"_175":-5,"_176":2149,"_178":-5,"_179":2150,"_181":2151},{"_74":1998,"_162":2136,"_164":2137,"_166":319,"_168":-5,"_169":-5,"_170":2138,"_172":2139,"_15":2140,"_17":18,"_175":-5,"_176":2141,"_178":-5,"_179":2142,"_181":2143},{"_74":1998,"_162":2128,"_164":2129,"_166":319,"_168":-5,"_169":-5,"_170":2130,"_172":2131,"_15":2132,"_17":18,"_175":-5,"_176":2133,"_178":-5,"_179":2134,"_181":2135},{"_74":1998,"_162":2120,"_164":2121,"_166":319,"_168":-5,"_169":-5,"_170":2122,"_172":2123,"_15":2124,"_17":18,"_175":-5,"_176":2125,"_178":-5,"_179":2126,"_181":2127},{"_74":1998,"_162":2112,"_164":2113,"_166":319,"_168":-5,"_169":-5,"_170":2114,"_172":2115,"_15":2116,"_17":18,"_175":-5,"_176":2117,"_178":-5,"_179":2118,"_181":2119},{"_74":1998,"_162":2104,"_164":2105,"_166":319,"_168":-5,"_169":-5,"_170":2106,"_172":2107,"_15":2108,"_17":18,"_175":-5,"_176":2109,"_178":-5,"_179":2110,"_181":2111},{"_74":1998,"_162":2096,"_164":2097,"_166":319,"_168":-5,"_169":-5,"_170":2098,"_172":2099,"_15":2100,"_17":18,"_175":-5,"_176":2101,"_178":-5,"_179":2102,"_181":2103},{"_74":1998,"_162":2088,"_164":2089,"_166":319,"_168":-5,"_169":-5,"_170":2090,"_172":2091,"_15":2092,"_17":18,"_175":-5,"_176":2093,"_178":-5,"_179":2094,"_181":2095},{"_74":1998,"_162":2080,"_164":2081,"_166":319,"_168":-5,"_169":-5,"_170":2082,"_172":2083,"_15":2084,"_17":18,"_175":-5,"_176":2085,"_178":-5,"_179":2086,"_181":2087},{"_74":1998,"_162":2072,"_164":2073,"_166":319,"_168":-5,"_169":-5,"_170":2074,"_172":2075,"_15":2076,"_17":18,"_175":-5,"_176":2077,"_178":-5,"_179":2078,"_181":2079},{"_74":1998,"_162":2064,"_164":2065,"_166":319,"_168":-5,"_169":-5,"_170":2066,"_172":2067,"_15":2068,"_17":18,"_175":-5,"_176":2069,"_178":-5,"_179":2070,"_181":2071},{"_74":1998,"_162":2056,"_164":2057,"_166":319,"_168":-5,"_169":-5,"_170":2058,"_172":2059,"_15":2060,"_17":18,"_175":-5,"_176":2061,"_178":-5,"_179":2062,"_181":2063},{"_74":1998,"_162":2048,"_164":2049,"_166":319,"_168":-5,"_169":-5,"_170":2050,"_172":2051,"_15":2052,"_17":18,"_175":-5,"_176":2053,"_178":-5,"_179":2054,"_181":2055},{"_74":1998,"_162":2039,"_164":2040,"_166":2041,"_168":-5,"_169":-5,"_170":2042,"_172":2043,"_15":2044,"_17":18,"_175":-5,"_176":2045,"_178":-5,"_179":2046,"_181":2047},{"_74":1998,"_162":2031,"_164":2032,"_166":319,"_168":-5,"_169":-5,"_170":2033,"_172":2034,"_15":2035,"_17":18,"_175":-5,"_176":2036,"_178":-5,"_179":2037,"_181":2038},{"_74":1998,"_162":2023,"_164":2024,"_166":319,"_168":-5,"_169":-5,"_170":2025,"_172":2026,"_15":2027,"_17":18,"_175":-5,"_176":2028,"_178":-5,"_179":2029,"_181":2030},{"_74":1998,"_162":2015,"_164":2016,"_166":319,"_168":-5,"_169":-5,"_170":2017,"_172":2018,"_15":2019,"_17":18,"_175":-5,"_176":2020,"_178":-5,"_179":2021,"_181":2022},{"_74":1998,"_162":2007,"_164":2008,"_166":319,"_168":-5,"_169":-5,"_170":2009,"_172":2010,"_15":2011,"_17":18,"_175":-5,"_176":2012,"_178":-5,"_179":2013,"_181":2014},{"_74":1998,"_162":1999,"_164":2000,"_166":319,"_168":-5,"_169":-5,"_170":2001,"_172":2002,"_15":2003,"_17":18,"_175":-5,"_176":2004,"_178":-5,"_179":2005,"_181":2006},{"_74":1977,"_162":1988,"_164":1989,"_166":1990,"_168":1066,"_169":-5,"_170":1991,"_172":1992,"_15":1993,"_17":18,"_175":1994,"_176":1995,"_178":-5,"_179":1996,"_181":1997},{"_74":1977,"_162":1978,"_164":1979,"_166":1980,"_168":1066,"_169":-5,"_170":1981,"_172":1982,"_15":1983,"_17":18,"_175":1984,"_176":1985,"_178":-5,"_179":1986,"_181":1987},{"_74":1969,"_162":1970,"_164":-5,"_166":1971,"_168":-5,"_169":-5,"_170":1972,"_172":1972,"_15":1973,"_17":18,"_175":-5,"_176":1974,"_178":-5,"_179":1975,"_181":1976},{"_74":1961,"_162":1962,"_164":-5,"_166":1963,"_168":-5,"_169":-5,"_170":1964,"_172":1964,"_15":1965,"_17":18,"_175":-5,"_176":1966,"_178":-5,"_179":1967,"_181":1968},{"_74":879,"_162":880,"_164":-5,"_166":881,"_168":792,"_169":-5,"_170":882,"_172":882,"_15":883,"_17":18,"_175":1957,"_176":1958,"_178":-5,"_179":1959,"_181":1960},{"_74":1676,"_162":1677,"_164":-5,"_166":1678,"_168":1617,"_169":-5,"_170":1679,"_172":1680,"_15":1681,"_17":18,"_175":1953,"_176":1954,"_178":-5,"_179":1955,"_181":1956},{"_74":1667,"_162":1668,"_164":-5,"_166":1669,"_168":1617,"_169":-5,"_170":1670,"_172":1671,"_15":1672,"_17":18,"_175":1949,"_176":1950,"_178":-5,"_179":1951,"_181":1952},{"_74":1939,"_162":1940,"_164":1941,"_166":1942,"_168":-5,"_169":-5,"_170":1943,"_172":1944,"_15":1945,"_17":18,"_175":-5,"_176":1946,"_178":-5,"_179":1947,"_181":1948},{"_74":870,"_162":871,"_164":-5,"_166":872,"_168":792,"_169":-5,"_170":873,"_172":874,"_15":875,"_17":18,"_175":1935,"_176":1936,"_178":-5,"_179":1937,"_181":1938},{"_74":1658,"_162":1659,"_164":-5,"_166":1660,"_168":1617,"_169":-5,"_170":1661,"_172":1662,"_15":1663,"_17":18,"_175":1931,"_176":1932,"_178":-5,"_179":1933,"_181":1934},{"_74":1920,"_162":1921,"_164":1922,"_166":1923,"_168":1066,"_169":-5,"_170":1924,"_172":1925,"_15":1926,"_17":18,"_175":1927,"_176":1928,"_178":-5,"_179":1929,"_181":1930},"Preview NDA by token - Comp AI - Documentation","preview-nda-by-token-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/trust-access/preview-nda-by-token","# Preview NDA by token - Comp AI\n\n* [Join us on Discord](https://discord.gg/compai)\n\n##### Organization\n\n* [GET\n \n Get organization information\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/get-organization-information)\n* [DEL\n \n Delete organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/delete-organization)\n* [PATCH\n \n Update organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/update-organization)\n\n##### People\n\n* [GET\n \n Get all people\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/get-all-people)\n* [POST\n \n Create a new member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/create-a-new-member)\n* [POST\n \n Add multiple members to organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/add-multiple-members-to-organization)\n* [GET\n \n Get person by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/get-person-by-id)\n* [DEL\n \n Delete member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/delete-member)\n* [PATCH\n \n Update member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/update-member)\n\n##### Risks\n\n* [GET\n \n Get all risks\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/get-all-risks)\n* [POST\n \n Create a new risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/create-a-new-risk)\n* [GET\n \n Get risk by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/get-risk-by-id)\n* [DEL\n \n Delete risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/delete-risk)\n* [PATCH\n \n Update risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/update-risk)\n\n##### Vendors\n\n* [GET\n \n Get all vendors\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/get-all-vendors)\n* [POST\n \n Create a new vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/create-a-new-vendor)\n* [GET\n \n Get vendor by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/get-vendor-by-id)\n* [DEL\n \n Delete vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/delete-vendor)\n* [PATCH\n \n Update vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/update-vendor)\n\n##### Context\n\n* [GET\n \n Get all context entries\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/get-all-context-entries)\n* [POST\n \n Create a new context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/create-a-new-context-entry)\n* [GET\n \n Get context entry by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/get-context-entry-by-id)\n* [DEL\n \n Delete context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/delete-context-entry)\n* [PATCH\n \n Update context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/update-context-entry)\n\n##### Devices\n\n* [GET\n \n Get all devices\n \n \n \n ](https://trycomp.ai/docs/api-reference/devices/get-all-devices)\n* [GET\n \n Get devices by member ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/devices/get-devices-by-member-id)\n\n##### Policies\n\n* [GET\n \n Get all policies\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/get-all-policies)\n* [POST\n \n Create a new policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/create-a-new-policy)\n* [GET\n \n Get policy by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/get-policy-by-id)\n* [DEL\n \n Delete policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/delete-policy)\n* [PATCH\n \n Update policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/update-policy)\n\n##### Device Agent\n\n* [GET\n \n Download macOS Device Agent\n \n \n \n ](https://trycomp.ai/docs/api-reference/device-agent/download-macos-device-agent)\n* [GET\n \n Download Windows Device Agent ZIP\n \n \n \n ](https://trycomp.ai/docs/api-reference/device-agent/download-windows-device-agent-zip)\n\n##### Attachments\n\n* [GET\n \n Get attachment download URL\n \n \n \n ](https://trycomp.ai/docs/api-reference/attachments/get-attachment-download-url)\n\n##### Tasks\n\n* [GET\n \n Get all tasks\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-all-tasks)\n* [GET\n \n Get task by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-task-by-id)\n* [GET\n \n Get task attachments\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-task-attachments)\n* [POST\n \n Upload attachment to task\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/upload-attachment-to-task)\n* [GET\n \n Get attachment download URL\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-attachment-download-url)\n* [DEL\n \n Delete task attachment\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/delete-task-attachment)\n\n##### Task Automations\n\n* [GET\n \n Get all automations for a task\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-automations-for-a-task)\n* [POST\n \n Create a new evidence automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/create-a-new-evidence-automation)\n* [GET\n \n Get automation details\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-automation-details)\n* [DEL\n \n Delete an automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/delete-an-automation)\n* [PATCH\n \n Update an existing automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/update-an-existing-automation)\n* [GET\n \n Get all versions for an automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-versions-for-an-automation)\n* [GET\n \n Get all automation runs for a task\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-automation-runs-for-a-task)\n\n##### Comments\n\n* [GET\n \n Get comments for an entity\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/get-comments-for-an-entity)\n* [POST\n \n Create a new comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/create-a-new-comment)\n* [PUT\n \n Update a comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/update-a-comment)\n* [DEL\n \n Delete a comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/delete-a-comment)\n\n##### Health\n\n* [GET\n \n Health check\n \n \n \n ](https://trycomp.ai/docs/api-reference/health/health-check)\n\n##### Trust Portal\n\n* [GET\n \n Get domain verification status\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-portal/get-domain-verification-status)\n\n##### Trust Access\n\n* [POST\n \n Submit data access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/submit-data-access-request)\n* [GET\n \n List access requests\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-access-requests)\n* [GET\n \n Get access request details\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-access-request-details)\n* [POST\n \n Approve access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/approve-access-request)\n* [POST\n \n Deny access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/deny-access-request)\n* [GET\n \n List access grants\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-access-grants)\n* [POST\n \n Revoke access grant\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/revoke-access-grant)\n* [GET\n \n Get NDA details by token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-nda-details-by-token)\n* [POST\n \n Preview NDA by token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/preview-nda-by-token)\n* [POST\n \n Sign NDA\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/sign-nda)\n* [POST\n \n Resend NDA email\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/resend-nda-email)\n* [POST\n \n Preview NDA PDF\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/preview-nda-pdf)\n* [POST\n \n Reclaim access\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/reclaim-access)\n* [GET\n \n Get grant data by access token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-grant-data-by-access-token)\n* [GET\n \n List policies by access token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-policies-by-access-token)\n* [GET\n \n Download all policies as watermarked PDF\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/download-all-policies-as-watermarked-pdf)\n\n##### Framework Editor Task Templates\n\n* [GET\n \n Get all framework editor task templates\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/get-all-framework-editor-task-templates)\n* [GET\n \n Get framework editor task template by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/get-framework-editor-task-template-by-id)\n* [DEL\n \n Delete framework editor task template\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/delete-framework-editor-task-template)\n* [PATCH\n \n Update framework editor task template\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/update-framework-editor-task-template)\n\nPreview NDA by token\n\n```\ncurl --request POST \\\n --url https://api.trycomp.ai/v1/trust-access/nda/{token}/preview-nda\n```\n\nTrust Access\n\nGenerate preview NDA PDF for external user before signing\n\nPOST\n\n/\n\nv1\n\n/\n\ntrust-access\n\n/\n\nnda\n\n/\n\n{token}\n\n/\n\npreview-nda\n\nPreview NDA by token\n\n```\ncurl --request POST \\\n --url https://api.trycomp.ai/v1/trust-access/nda/{token}/preview-nda\n```\n\n#### Path Parameters\n\n[](https://trycomp.ai/docs/api-reference/trust-access/preview-nda-by-token#parameter-token)\n\ntoken\n\nstring\n\nrequired\n\n#### Response\n\n200\n\nPreview NDA generated\n\nWas this page helpful?\n\n[Get NDA details by token](https://trycomp.ai/docs/api-reference/trust-access/get-nda-details-by-token)[Sign NDA](https://trycomp.ai/docs/api-reference/trust-access/sign-nda)\n\n⌘I","2025-11-25T14:46:22.951Z","2026-07-07T16:13:16.881Z","59b656e4-0c78-432d-8f5c-d1e11d122720",{"_15":1066,"_53":1062},[],[],[],{"_15":1617,"_53":1613},[],[],[],{"_15":792,"_53":787},[],[],[],"Physical Security","physical-security","https://kb.trycomp.ai/Physical-Security-313a1b1858b8809f8f54f1b3ca0fe669","[← Get Audit Ready](https://kb.trycomp.ai/p/313a1b1858b880baa983e8df56697e7b?pvs=25) • [↑ Evidence](https://kb.trycomp.ai/p/2f0a1b1858b880bd8544ecb562b8a0d8?pvs=25)\n\nIf you are a fully remote team the following tasks can be marked as ‘Not relevant’\n\n#### Office Access & Door Monitoring\n\n#### Building / Workplace Rules\n\n#### Secure Storage\n\n#### Visitor Control\n","2026-06-10T13:39:31.206Z","2026-06-23T17:25:34.084Z","d0ac6f4c-56dc-4238-9f6d-5839798a3fb3",[],[],[],{"_15":1617,"_53":1613},[],[],[],{"_15":1617,"_53":1613},[],[],[],{"_15":792,"_53":787},[],[],[],"Onboarding Video Not Loading in Notion","onboarding-video-not-loading-in-notion","**Title:** Onboarding Video Not Loading in Notion\n\n**Content:**\n\n- **Issue:** The onboarding video embedded in Notion doesn't load or play, even after refreshing.\n- **Resolution steps:** Refresh the page, try a different browser, clear cache, or use the direct video link: ","2026-05-21T18:55:20.863Z","3b168efd-4691-454c-a9f6-cbec77ca2690",[],[],[],"Onboarding Questionnaire","onboarding-questionnaire"," 1. **Frameworks** — Which compliance frameworks do you need?\n 2. **Organization name** — What is your company name?\n 3. **Website** — What's your company website?\n 4. **Describe** — Describe your company in a few sentences\n 5. **Industry** — What industry is your company in? *(SaaS, FinTech, Healthcare, E-commerce, Education, Other)*\n 6. **Team size** — How many employees do you have?\n 7. **C-Suite** — Who are your C-Suite executives? *(name + title, repeatable)*\n 8. **Report signatory** — Who will sign off on the final report? *(full name, job title, email)*\n 9. **Devices** — What devices do your team members use? *(Company/personal laptops, phones, tablets, Other)*\n10. **Authentication** — How do your team members sign in to work tools? *(Google Workspace, Microsoft 365, Okta, Auth0, Email/Password, Other)*\n11. **Infrastructure** — Where do you host your applications and data? *(AWS, Google Cloud, Azure, Heroku, Vercel, Other)*\n12. **Software** — What software do you use? *(skippable)*\n13. **Work location** — How does your team work? *(Fully remote, Hybrid, Office-based)*\n14. **Data types** — What types of data do you handle? *(Customer PII, Payment info, Employee data, Health records, IP, Other)*\n15. **Geo** — Where is your data located? *(North America, EU, UK, APAC, South America, Africa, Middle East, AU/NZ)*\n16. **Shipping** — Where would you like to receive your certificate? *(full name, address, optional phone)*","2026-05-06T16:26:13.063Z","127bdf03-c7ba-4bc5-a620-db1fa3747b5d",[],[],[],"OAuth Configuration for Self-Hosters - Comp AI - Documentation","oauth-configuration-for-self-hosters-comp-ai-documentation-2","https://www.trycomp.ai/docs/integrations/oauth-setup","# OAuth Configuration for Self-Hosters - Comp AI\n\n> ## Documentation Index\n>\n> Fetch the complete documentation index at: \n>\n> Use this file to discover all available pages before exploring further.\n\n## Overview\n\nOAuth integrations require **platform-level credentials** that you (the admin) configure once in your deployment. After that, all users can connect their accounts with a single click. **Without OAuth configured:** Integration shows “Coming Soon” (disabled)\\\n**With OAuth configured:** Users click “Connect” → OAuth flow → Done!\n\n## Quick Start\n\nFor each OAuth integration you want to enable:\n\n1. Create OAuth app with the provider\n2. Copy Client ID and Client Secret\n3. Go to `/admin/integrations` in your deployment\n4. Find the integration → Click “Configure”\n5. Paste credentials → Save\n\nThat’s it! Users can now connect.\n\n***\n\n## Provider Setup Guides\n\n### GitHub\n\n1\n\n2\n\n3\n\n**Important:** The callback URL must exactly match what you enter in your deployment.\n\n***\n\n### Google (Workspace & Cloud Platform)\n\n1\n\n2\n\n3\n\n4\n\n5\n\n6\n\n**User Requirements:**\n\n- **Google Workspace**: User must be a Workspace admin\n- **GCP**: User must have Viewer + Security Center Findings Viewer roles at org level\n\n***\n\n### Linear\n\n1\n\n2\n\n***\n\n### Vercel\n\n1\n\n2\n\n**Note:** Vercel requires an integration slug as a custom setting.\n\n***\n\n### Rippling\n\n1\n\n2\n\n3\n\n***\n\n## Non-OAuth Integrations\n\nThese integrations don’t require platform-level OAuth setup:\n\n### AWS, Azure, GCP (Service Accounts)\n\n**No platform configuration needed!** Users provide their own:\n\n- **AWS**: IAM Role ARN, External ID\n- **Azure**: Service Principal credentials\n- **GCP**: OAuth (but users connect with their own Google account)\n\n***\n\n## Troubleshooting\n\n### Integration Shows “Coming Soon”\n\n**Cause:** OAuth credentials not configured\\\n**Fix:** Go to `/admin/integrations` → Configure Client ID/Secret\n\n### OAuth Callback Error\n\n**Cause:** Callback URL mismatch\\\n**Fix:** Ensure the URL in the OAuth app exactly matches your deployment:\n\n- OAuth app: `https://yourapp.com/v1/integrations/oauth/callback`\n- Your deployment URL: `https://yourapp.com`\n\nThey must match!\n\n### ”Invalid Client” Error\n\n**Cause:** Wrong Client ID or Secret\\\n**Fix:** Double-check you copied both correctly, no extra spaces\n\n**Cause:** APIs not enabled in your GCP project\\\n**Fix:** Enable Admin SDK API (Workspace) or Cloud APIs (GCP)\n\n### “Access Denied” After Connecting\n\n**Cause:** User lacks required permissions in their account\\\n**Fix:** User needs to grant IAM roles in the provider (check integration docs for required roles)\n\n***\n\n## Security Notes\n\n### Where Credentials are Stored\n\nOAuth Client IDs and Secrets are stored in the **database**, encrypted at rest using AES-256-GCM. **Not in environment variables** - This allows:\n\n- Multiple deployments with different credentials\n- Easy credential rotation via UI\n- Secure encryption\n- Multi-tenancy support\n\n### Callback URL Security\n\nAlways use **HTTPS** in production:\n\n- `https://yourapp.com/v1/integrations/oauth/callback`\n- `http://yourapp.com/...` (insecure, OAuth will reject)\n\nFor local development:\n\n- `http://localhost:3000/v1/integrations/oauth/callback`\n- `http://127.0.0.1:3000/v1/integrations/oauth/callback`\n\n### OAuth Scopes\n\nWe request the **minimum scopes** needed for each integration:\n\n- GitHub: `repo`, `read:org`, `read:user`\n- Google Workspace: `admin.directory.user.readonly`, etc.\n- GCP: `cloud-platform` (required for Security Command Center - no read-only alternative available)\n\n### User Data\n\nWe **never** store user passwords. OAuth flow:\n\n1. User authorizes → Provider gives us an access token\n2. We store the token (encrypted)\n3. We use token to call APIs\n4. User can revoke access anytime in the provider’s settings\n\n***\n\n## Production Considerations\n\n### Google OAuth Verification\n\nIf using Google integrations (Workspace, GCP) in production with external users, you’ll need to submit your app for **Google’s verification process**. **Required for:**\n\n- External user consent screen\n- Requesting sensitive scopes (like `cloud-platform`)\n\n**Process:**\n\n1. Complete OAuth consent screen configuration\n2. Submit for verification at \n3. Provide privacy policy, terms of service\n4. May take 2-6 weeks\n\n**For internal use:** No verification needed if using “Internal” consent screen.\n\n### Rate Limiting\n\nOAuth providers have rate limits. The integration platform handles this by:\n\n- Caching API responses where appropriate\n- Running checks via background jobs (Trigger.dev)\n- Implementing exponential backoff on retries\n\n### Token Refresh\n\nOAuth tokens expire. The platform automatically:\n\n- Stores refresh tokens (when provider supports it)\n- Refreshes access tokens before they expire\n- Re-prompts user to reconnect if refresh fails\n\nNo manual intervention needed!\n\n***\n\n## Summary\n\n**Time investment:** \\~30 minutes to configure all OAuth providers **Benefit:** Users connect with 1 click instead of hunting for API keys **Maintenance:** Minimal - credentials rotate via UI, no code deployments needed **Security:** All credentials encrypted at rest, HTTPS required for callbacks Configure once, benefit forever!\n","2026-05-19T19:46:41.323Z","2026-07-07T16:13:16.866Z","77ca75b4-ddca-4d2e-a4e7-a1beb9716680",{"_15":1066,"_53":1062},[],[],[],"oauth-configuration-for-self-hosters-comp-ai-documentation","https://trycomp.ai/docs/integrations/oauth-setup","# OAuth Configuration for Self-Hosters - Comp AI\n\n## Overview\n\nOAuth integrations require **platform-level credentials** that you (the admin) configure once in your deployment. After that, all users can connect their accounts with a single click. **Without OAuth configured:** Integration shows “Coming Soon” (disabled) \n**With OAuth configured:** Users click “Connect” → OAuth flow → Done!\n\n## Quick Start\n\nFor each OAuth integration you want to enable:\n\n1. Create OAuth app with the provider\n2. Copy Client ID and Client Secret\n3. Go to `/admin/integrations` in your deployment\n4. Find the integration → Click “Configure”\n5. Paste credentials → Save\n\nThat’s it! Users can now connect.\n\n* * *\n\n## Provider Setup Guides\n\n### GitHub\n\n**Important:** The callback URL must exactly match what you enter in your deployment.\n\n* * *\n\n### Google (Workspace & Cloud Platform)\n\n**User Requirements:**\n\n* **Google Workspace**: User must be a Workspace admin\n* **GCP**: User must have Viewer + Security Center Findings Viewer roles at org level\n\n* * *\n\n### Linear\n\n* * *\n\n### Vercel\n\n**Note:** Vercel requires an integration slug as a custom setting.\n\n* * *\n\n### Rippling\n\n* * *\n\n## Non-OAuth Integrations\n\nThese integrations don’t require platform-level OAuth setup:\n\n### AWS, Azure, GCP (Service Accounts)\n\n**No platform configuration needed!** Users provide their own:\n\n* **AWS**: IAM Role ARN, External ID\n* **Azure**: Service Principal credentials\n* **GCP**: OAuth (but users connect with their own Google account)\n\n* * *\n\n## Troubleshooting\n\n### Integration Shows “Coming Soon”\n\n**Cause:** OAuth credentials not configured \n**Fix:** Go to `/admin/integrations` → Configure Client ID/Secret\n\n### OAuth Callback Error\n\n**Cause:** Callback URL mismatch \n**Fix:** Ensure the URL in the OAuth app exactly matches your deployment:\n\n* OAuth app: `https://yourapp.com/v1/integrations/oauth/callback`\n* Your deployment URL: `https://yourapp.com`\n\nThey must match!\n\n### ”Invalid Client” Error\n\n**Cause:** Wrong Client ID or Secret \n**Fix:** Double-check you copied both correctly, no extra spaces\n\n**Cause:** APIs not enabled in your GCP project \n**Fix:** Enable Admin SDK API (Workspace) or Cloud APIs (GCP)\n\n### “Access Denied” After Connecting\n\n**Cause:** User lacks required permissions in their account \n**Fix:** User needs to grant IAM roles in the provider (check integration docs for required roles)\n\n* * *\n\n## Security Notes\n\n### Where Credentials are Stored\n\nOAuth Client IDs and Secrets are stored in the **database**, encrypted at rest using AES-256-GCM. **Not in environment variables** - This allows:\n\n* Multiple deployments with different credentials\n* Easy credential rotation via UI\n* Secure encryption\n* Multi-tenancy support\n\n### Callback URL Security\n\nAlways use **HTTPS** in production:\n\n* `https://yourapp.com/v1/integrations/oauth/callback`\n* `http://yourapp.com/...` (insecure, OAuth will reject)\n\nFor local development:\n\n* `http://localhost:3000/v1/integrations/oauth/callback`\n* `http://127.0.0.1:3000/v1/integrations/oauth/callback`\n\n### OAuth Scopes\n\nWe request the **minimum scopes** needed for each integration:\n\n* GitHub: `repo`, `read:org`, `read:user`\n* Google Workspace: `admin.directory.user.readonly`, etc.\n* GCP: `cloud-platform` (required for Security Command Center - no read-only alternative available)\n\n### User Data\n\nWe **never** store user passwords. OAuth flow:\n\n1. User authorizes → Provider gives us an access token\n2. We store the token (encrypted)\n3. We use token to call APIs\n4. User can revoke access anytime in the provider’s settings\n\n* * *\n\n## Production Considerations\n\n### Google OAuth Verification\n\nIf using Google integrations (Workspace, GCP) in production with external users, you’ll need to submit your app for **Google’s verification process**. **Required for:**\n\n* External user consent screen\n* Requesting sensitive scopes (like `cloud-platform`)\n\n**Process:**\n\n1. Complete OAuth consent screen configuration\n2. Submit for verification at [https://support.google.com/code/contact/oauth\\_app\\_verification](https://support.google.com/code/contact/oauth_app_verification)\n3. Provide privacy policy, terms of service\n4. May take 2-6 weeks\n\n**For internal use:** No verification needed if using “Internal” consent screen.\n\n### Rate Limiting\n\nOAuth providers have rate limits. The integration platform handles this by:\n\n* Caching API responses where appropriate\n* Running checks via background jobs (Trigger.dev)\n* Implementing exponential backoff on retries\n\n### Token Refresh\n\nOAuth tokens expire. The platform automatically:\n\n* Stores refresh tokens (when provider supports it)\n* Refreshes access tokens before they expire\n* Re-prompts user to reconnect if refresh fails\n\nNo manual intervention needed!\n\n* * *\n\n## Summary\n\n**Time investment:** ~30 minutes to configure all OAuth providers **Benefit:** Users connect with 1 click instead of hunting for API keys **Maintenance:** Minimal - credentials rotate via UI, no code deployments needed **Security:** All credentials encrypted at rest, HTTPS required for callbacks Configure once, benefit forever!","2025-12-16T19:35:48.708Z","2026-07-07T16:13:16.864Z","25d8d923-350a-4c02-aeb4-0ac3e570c2ad",{"_15":1066,"_53":1062},[],[],[],"Notion","notion-9","https://kb.trycomp.ai/388a1b1858b8817b9301fa32ed61680d","2026-06-23T17:25:33.329Z","2026-06-23T17:25:33.344Z","f1b4439b-1550-407e-8f78-fcbba70c4868",[],[],[],"notion-16","https://kb.trycomp.ai/Employee-Performance-Evaluations-e9a8547fb7354abcb684128b68b6a331?pvs=25","2026-06-23T17:25:35.943Z","2026-06-23T17:25:35.964Z","ee6c67b0-2cc6-4b49-8967-531d8bc6e892",[],[],[],"notion-8","https://kb.trycomp.ai/Certified-Badges-351a1b1858b88056a511c6dd3d6d3787?pvs=25","2026-06-23T17:25:32.654Z","2026-06-23T17:25:32.670Z","d11cf573-9469-4c5e-b701-281c8acfe662",[],[],[],"notion-18","https://kb.trycomp.ai/375a1b1858b8816ca73bf2ce7b89bf15#d1bba393a82942b1bf90c51c24bcebad","2026-06-23T17:25:36.130Z","2026-06-23T17:25:36.144Z","cd8c1d1b-fcc6-4709-ad08-087da12fa875",[],[],[],"notion-4","https://kb.trycomp.ai/Evidence-2f0a1b1858b880bd8544ecb562b8a0d8?pvs=18","2026-06-10T13:39:32.438Z","2026-06-10T13:39:32.453Z","9afbc350-0714-4ac5-ac95-9587f89a2ffa",[],[],[],"notion-15","https://kb.trycomp.ai/?pvs=18","\\[\n\nSkip to content\n\n]\\()\n","2026-06-23T17:25:35.349Z","2026-06-23T17:25:35.368Z","7c783870-7f39-4c86-8374-4a72abf08e0d",[],[],[],"notion-3","https://kb.trycomp.ai/Documents-313a1b1858b88049b75fe23cbd775298?pvs=18","2026-06-10T13:39:32.220Z","2026-06-10T13:39:32.236Z","70312b02-801d-42d1-b5b5-383720ac3b69",[],[],[],"notion-12","https://kb.trycomp.ai/Physical-Security-313a1b1858b8809f8f54f1b3ca0fe669?pvs=25","2026-06-23T17:25:34.812Z","2026-06-23T17:25:34.830Z","6e6c297e-7406-4bee-93a2-d9a4848fa201",[],[],[],"notion-7","https://kb.trycomp.ai/Evidence-2f0a1b1858b880bd8544ecb562b8a0d8?pvs=25","2026-06-23T17:25:32.266Z","2026-06-23T17:25:32.281Z","68973cc5-d3a6-444e-97bc-f1cdd564ac93",[],[],[],"notion-6","https://kb.trycomp.ai/p/Evidence-2f0a1b1858b880bd8544ecb562b8a0d8?pvs=24","2026-06-23T17:25:32.049Z","2026-06-23T17:25:32.065Z","672e1998-5e65-4a02-baaf-1365a9bd9805",[],[],[],"notion-5","https://kb.trycomp.ai/p/Documents-313a1b1858b88049b75fe23cbd775298?pvs=24","2026-06-23T17:25:31.638Z","2026-06-23T17:25:31.654Z","5013e80a-9f02-4849-8457-b24dcf8a0f26",[],[],[],"notion-14","https://kb.trycomp.ai/Governance-Risk-Compliance-327a1b1858b880caa42cc9a4ad6c9e62?pvs=25","2026-06-23T17:25:35.232Z","2026-06-23T17:25:35.253Z","4c5ec86a-ac66-4d8a-b637-8164c5361bc5",[],[],[],"notion-10","https://kb.trycomp.ai/Governance-Roles-Documentation-388a1b1858b8810297fadd25c3c15653?pvs=25","2026-06-23T17:25:33.789Z","2026-06-23T17:25:33.804Z","483abcd4-b01a-478e-8110-8afc0cae1cf5",[],[],[],"notion-11","https://kb.trycomp.ai/Device-Management-313a1b1858b880eea571c7583e17aaed?pvs=25","2026-06-23T17:25:34.710Z","2026-06-23T17:25:34.727Z","4476c8b3-a0af-4c4f-bfa2-b33bbc680681",[],[],[],"notion-19","https://kb.trycomp.ai/388a1b1858b8813e853dd7ab7b286d38","2026-06-23T17:25:36.565Z","2026-06-23T17:25:36.581Z","41d93532-6775-463c-a8cb-168c69170565",[],[],[],"notion-13","https://kb.trycomp.ai/Access-Control-313a1b1858b8800d9a7ac8f56af18382?pvs=25","2026-06-23T17:25:34.911Z","2026-06-23T17:25:34.929Z","4131b788-a414-4e58-be47-e8f846f270e0",[],[],[],"notion-17","https://kb.trycomp.ai/p/Policies-313a1b1858b880d594a9c69d83ded6f5?pvs=24","2026-06-23T17:25:36.040Z","2026-06-23T17:25:36.054Z","3ec0fab4-cac3-4818-8128-8b358a9d2496",[],[],[],"notion-21","https://kb.trycomp.ai/GDPR-Templates-388a1b1858b88119bd44f3662ac507bb?pvs=18","2026-06-23T17:25:37.678Z","2026-06-23T17:25:37.693Z","36674a2e-169a-4f65-82d1-0eef330afc2d",[],[],[],"notion","https://kb.trycomp.ai/p/313a1b1858b880d594a9c69d83ded6f5?pvs=25","2026-06-10T13:39:14.256Z","2026-06-10T13:39:14.273Z","23b41946-970f-42c3-bae6-cb3fd8674541",[],[],[],"notion-20","https://kb.trycomp.ai/Cookie-Register-388a1b1858b881f9b935da31a2888a43?pvs=25","2026-06-23T17:25:37.365Z","2026-06-23T17:25:37.379Z","18e6b7c9-f085-4ed4-a629-d323e1c2f735",[],[],[],"get-audit-ready","https://kb.trycomp.ai","2026-06-10T13:39:13.339Z","2026-06-24T12:19:07.923Z","0d22ab03-adcb-4767-a7cf-5adcb5b2ecb1",[],[],[],"notion-2","https://kb.trycomp.ai/Policies-313a1b1858b880d594a9c69d83ded6f5?pvs=25","2026-06-10T13:39:16.266Z","2026-06-10T13:39:16.283Z","00157ab1-d717-4080-a084-d048dfe03de1",[],[],[],"Notificaitons for completed tasks","notificaitons-for-completed-tasks","Notifications are now controlled at the org level. If employees are receiving notifications for tasks, and we want to disable those, you can update these your app in the Settings => Notifications tab","2026-03-16T21:45:31.501Z","a4c6df12-377b-41d0-961b-e73d5ff5b04d",[],[],[],"Next steps after uploading penetration testing to schedule an audit","next-steps-after-uploading-penetration-testing-to-schedule-an-audit","https://compai.unthread.io/dashboard/inbox/all/conversations/b54933bc-ab2a-46cb-bf9c-47ece19d870c","## Question\n\nNow that penetration testing is complete and uploaded, what are the next steps to continue the review so an audit can be scheduled?\n\n## Answer / Resolution\n\nBefore audit handoff (and moving toward scheduling the audit), complete the following:\n\n1. **Ensure all employee portal tasks are completed**\n\n - Check the Portal for any outstanding employee tasks.\n - Arrange for employees to complete any remaining tasks.\n\n2. **Upload your organization logo**\n\n - Go to **Settings >> General >> Organization Logo** and upload your logo.\n - The auditor will use this logo when compiling your SOC 2 report. This must be done before audit handoff.\n\n3. **Review and complete Context settings — especially SubService Organizations and Critical Vendors**\n\n - Go to **Settings → Context**.\n - Review all entries and **correct any invalid or blank data**.\n - Pay special attention to the **SubService Organizations** and **Critical Vendors** subsections, as auditors rely heavily on this information when completing their review. Inaccurate or incomplete entries in these sections can block or undermine the audit review.\n\n **SubService Organizations** are vendors that operate controls which are actually part of your own system — the things your audit report relies on. Most commonly this is your cloud host (AWS, GCP, or Azure). They are disclosed in your system description alongside the controls you assume they perform.\n\n **Critical Vendors** is a broader category covering any third party whose failure or compromise would significantly impact you or your customers' data. These are managed through your vendor risk management process.\n\n## What happens next\n\nOnce all three items above are complete, Support can proceed with **audit handoff**. Audit scheduling will need to wait until these items are done.","2026-03-18T18:16:40.992Z","2026-06-30T22:34:50.232Z","efa3d000-4b1a-41eb-a43a-b0e585342496",[],[],[],"Network Diagram","network-diagram","https://kb.trycomp.ai/Network-Diagram-8746b51df45e496e92c8060e41f40705","![🗺️ Callout icon](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)\n\nGoal: Document your security boundary and data flow, including what is public vs private.\n\nA diagram that clearly identifies boundaries such as:\n\nPublic Internet\n\nPrivate network (where sensitive systems and data live)\n\nA clear view of how data flows through your system.\n\n![🔗 Callout icon](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)\n\nIf you maintain architecture diagrams in a live tool, click + New Submission.\n\nPaste the URL into the Link to diagram field.\n\nSupported tools include Lucidchart, [draw.io](http://draw.io/), and Confluence.\n\n![📎 Callout icon](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)\n\nExport your diagram and upload a PDF, image, or Visio file (up to 100 MB) via the submission form.\n\nSmall teams: keep it high-level. A simple flow like User → Load Balancer → App Server → Database is fine.\n\nSolo founders: a logical diagram showing front-end to back-end (for example, Vercel functions calling a Supabase DB) is sufficient.\n","2026-03-18T15:19:13.617Z","2026-06-10T13:39:30.742Z","fa3f654c-381d-4706-ab33-8794c8a1ecc7",[],[],[],"network-diagram-2","https://kb.trycomp.ai/Network-Diagram-8746b51df45e496e92c8060e41f40705?pvs=25","🗺️\n\nGoal: Document your security boundary and data flow, including what is public vs private.\n\nA diagram that clearly identifies boundaries such as:\n\nPublic Internet\n\nPrivate network (where sensitive systems and data live)\n\nA clear view of how data flows through your system.\n\n🔗\n\nIf you maintain architecture diagrams in a live tool, click + New Submission.\n\nPaste the URL into the Link to diagram field.\n\nSupported tools include Lucidchart, [draw.io](http://draw.io/), and Confluence.\n\n💡\n\nNeed to generate a diagram quickly? You can use [eraser.io's AI architecture diagram generator](https://www.eraser.io/ai/architecture-diagram-generator) to create a network diagram, then submit the URL or export and upload the result.\n\n📎\n\nExport your diagram and upload a PDF, image, or Visio file (up to 100 MB) via the submission form.\n\nSmall teams: keep it high-level. A simple flow like User → Load Balancer → App Server → Database is fine.\n\nSolo founders: a logical diagram showing front-end to back-end (for example, Vercel functions calling a Supabase DB) is sufficient.","2026-06-23T17:25:35.751Z","2026-07-01T00:13:37.362Z","73cff9fc-668d-4d8d-a5fc-bb6b1820779a",[],[],[],{"_15":647,"_53":641},[],[],[],{"_15":792,"_53":787},[],[],[],"Meeting Minutes","meeting-minutes","https://kb.trycomp.ai/Meeting-Minutes-326a1b1858b880008db7c53e6d6dd154","![✅ Callout icon](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)\n\nGoal: Provide evidence that leadership takes security seriously and discusses it at a high level.\n\nMeeting minutes from your most recent board, management, or risk committee meeting showing security topics were discussed.\n\n“Independence” evidence (for larger organisations): proof that governance includes people who are not full-time employees.\n\n![📎 Callout icon](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)\n\nClick Upload Evidence.\n\nUpload your existing minutes (PDF, email agenda, or similar) from the most recent relevant meeting.\n\nTo show Independence, also upload screenshots of LinkedIn profiles or CVs for any external board or advisory members.\n\n![📝 Callout icon](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)\n\nClick + New Submission to open the built-in form with a pre-loaded template.\n\nFill in details of your latest internal Management Meeting.\n\nDo not remove the sections covering security and risk topics.\n\nIf you have external advisors, you can still use Upload Evidence to add LinkedIn profiles to show outside oversight.\n\n![👤 Callout icon](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)\n\nMeeting Minutes can be disregarded.\n\n![🤖 Callout icon](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==)\n\nIf you are getting audited for ISO 42001, the auditor needs extra proof that leadership oversees your AI Management System (AI MS).\n\nIn your minutes, explicitly document:\n\nManagement reviewed internal and external issues related to AI.\n\nManagement considered potential AI impacts.\n\nExtra evidence needed (upload as “Leadership Action”):\n\nA signed commitment statement, or\n\nAn executive team email, or\n\nMeeting records showing management:\n\nAligns AI objectives with business goals\n\nProvides resources for AI security\n\nPromotes continual improvement\n","2026-06-10T13:39:30.070Z","2026-06-23T17:25:35.533Z","5dc6b17e-db03-4d71-9940-50e522ad2449",[],[],[],"MCP Server - Comp AI - Documentation","mcp-server-comp-ai-documentation","https://www.trycomp.ai/docs/mcp-server","# MCP Server - Comp AI\n\nThe Comp AI MCP server lets you and your team operate your entire compliance program from inside any modern AI assistant. Ask in plain language; the AI uses real Comp AI tools to read evidence, manage tasks, generate questionnaire answers, connect cloud accounts, and more — all under your existing API key and permissions.\n\n> Built on the [Model Context Protocol](https://modelcontextprotocol.io/) — an open standard that lets AI clients talk to external tools. The Comp AI MCP server publishes hundreds of tools spanning evidence, policies, integrations, frameworks, cloud security, vendors, risks, people, and tasks.\n\n## Why use it\n\nCompliance work is full of repetitive, multi-step actions: gathering evidence, answering questionnaires, reviewing tasks, connecting cloud accounts. The MCP server collapses those into one-line natural-language requests. Examples your team can run today:\n\n- _“Show me my open SOC 2 controls and tell me which ones are missing evidence.”_\n- _“Upload this vendor security questionnaire and generate the answers from our policies.”_\n- _“Connect our production AWS account for monitoring.”_\n- _“List employees who haven’t completed offboarding yet.”_\n- _“Mark the AWS audit task on Sarah’s account as done.”_\n- _“Export our SOC 2 evidence bundle for the upcoming audit.”_\n\nThe AI assistant figures out which tools to call. Your team types the request and reviews the result.\n\n## Get an API key\n\n1. Sign in to [Comp AI](https://app.trycomp.ai/).\n2. Open **Settings → API Keys**.\n3. Click **Create new key**. Scope it to the actions the AI assistant should be allowed to take.\n4. Copy the key (it starts with `comp_…`) — you will paste it into your AI client’s config once.\n\nThe API key carries your existing RBAC and permissions. The AI assistant can only do what _your_ role can do in the dashboard.\n\n## Install per AI client\n\nYou don’t manually download anything. The Comp AI MCP server is distributed as a public npm package — [`@trycompai/mcp-server`](https://www.npmjs.com/package/@trycompai/mcp-server) — and every install path below uses `npx -y` (or a one-click button / drag-and-drop bundle) to fetch it on demand the first time your AI client starts a session. New versions are picked up automatically on the next session. Pick the tab for your client. Each tab shows the easiest install path first, with a manual JSON option below for advanced setups.\n\n- Claude Desktop\n\n- Cursor\n\n- VS Code\n\n- Claude Code (CLI)\n\n- Codex CLI\n\n- Gemini CLI\n\n- Windsurf\n\n**Easiest path — drag-and-drop install:**\n\n1. Download the latest [`mcp-server.mcpb`](https://github.com/trycompai/comp/releases) bundle from our GitHub Releases page.\n2. Drag the `.mcpb` file directly onto the Claude Desktop window.\n3. Claude Desktop shows an install prompt — confirm, then paste your Comp AI API key in the extension settings.\n4. Restart any open chats. Comp AI tools are now available.\n\nNo JSON editing required.\n\nAdvanced — manual JSON config\n\nIf you prefer to manage `claude_desktop_config.json` yourself, open **Settings → Developer → Edit Config** and merge:\n\n```\n{\n \"mcpServers\": {\n \"comp-ai\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"@trycompai/mcp-server\",\n \"start\",\n \"--apikey\",\n \"comp_…your_key_here…\"\n ]\n }\n }\n}\n```\n\nFully quit and reopen Claude Desktop.\n\n**Easiest path — one-click install:**[![Install in Cursor](/api/knowledge-base/images/6612e6bc-7320-4d4b-8aed-20a1b9fb324b)](cursor://anysphere.cursor-deeplink/mcp/install?name=CompAi\\&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyJAdHJ5Y29tcGFpL21jcC1zZXJ2ZXIiLCJzdGFydCIsIi0tYXBpa2V5IiwiIl19)Click the button above, confirm in Cursor, then paste your Comp AI API key when prompted.\n\nAdvanced — manual JSON config\n\nOpen **Cursor → Settings → Tools and Integrations → New MCP Server** and paste:\n\n```\n{\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"@trycompai/mcp-server\",\n \"start\",\n \"--apikey\",\n \"comp_…your_key_here…\"\n ]\n}\n```\n\nSave and reload Cursor.\n\n**Easiest path — one-click install:**[![Install in VS Code](/api/knowledge-base/images/ed52deb2-6f49-462f-ad65-43fb0129f56d)](vscode://ms-vscode.vscode-mcp/install?name=CompAi\\&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyJAdHJ5Y29tcGFpL21jcC1zZXJ2ZXIiLCJzdGFydCIsIi0tYXBpa2V5IiwiIl19)Click the button above, confirm in VS Code, then paste your Comp AI API key when prompted.\n\nAdvanced — manual JSON config\n\nOpen the **Command Palette → MCP: Open User Configuration** and paste:\n\n```\n{\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"@trycompai/mcp-server\",\n \"start\",\n \"--apikey\",\n \"comp_…your_key_here…\"\n ]\n}\n```\n\nInstall with one command:\n\n```\nclaude mcp add CompAI -- npx -y @trycompai/mcp-server start --apikey comp_…your_key_here…\n```\n\nClaude Code registers the server immediately — Comp AI tools become available in your next session.\n\nInstall with one command:\n\n```\ncodex mcp add comp-ai -- npx -y @trycompai/mcp-server start --apikey comp_…your_key_here…\n```\n\nCodex registers the server immediately — Comp AI tools become available in your next session.For ChatGPT desktop / web with MCP support, follow OpenAI’s MCP integration docs and use the same `command` + `args` shape shown in the manual JSON sections of the other tabs.\n\nInstall with one command:\n\n```\ngemini mcp add CompAI -- npx -y @trycompai/mcp-server start --apikey comp_…your_key_here…\n```\n\nOpen **Windsurf → Settings → Cascade → Manage MCPs → View raw config** and paste:\n\n```\n{\n \"mcpServers\": {\n \"comp-ai\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"@trycompai/mcp-server\",\n \"start\",\n \"--apikey\",\n \"comp_…your_key_here…\"\n ]\n }\n }\n}\n```\n\nSave and reload Windsurf.\n\nThat’s it. The first time you start a chat in your AI client after install, the assistant will discover the Comp AI tools and start using them.\n\n## Verify it worked\n\nOpen a fresh chat in your AI client and ask:\n\n> _“List my open compliance tasks.”_\n\nIf the install succeeded, the AI will call Comp AI’s `list-tasks` tool and return tasks from your organization. If you see no tool calls or an authentication error, jump to **Troubleshooting** below.\n\n## Troubleshooting\n\n## What your AI assistant can do\n\nThe MCP server publishes tools across the Comp AI surface:\n\n| Area | Examples |\n| ----------------------------------- | --------------------------------------------------------------------------- |\n| **Evidence and tasks** | List tasks, upload evidence, complete checklist items, export audit bundles |\n| **Policies** | List policies, generate drafts, publish versions, attach PDFs |\n| **Security questionnaires** | Upload, parse questions, generate answers, export reviewer-ready files |\n| **Frameworks and controls** | Inspect SOC 2 / ISO 27001 / HIPAA / GDPR coverage and missing evidence |\n| **Integrations and cloud security** | Connect AWS, Azure, GCP and other providers; run checks; review findings |\n| **Vendors and risks** | List vendors, manage assessments, track risk and remediation |\n| **People and devices** | Invite members, manage offboarding, inspect device compliance |\n| **Trust Center** | Review and approve Trust Access requests, manage shared documents |\n\nSome endpoints are intentionally **not** exposed to AI clients for security or compatibility reasons — for example, anything that rotates raw credentials, and a small number of long-lived streaming endpoints that don’t fit the request/response shape AI clients expect. The web UI continues to support those flows directly.\n\n## Common workflows\n\n## Security\n\n- **Your API key, your scope.** The MCP server runs locally on your machine and authenticates to the Comp AI API using the key you paste. It carries the same permissions you configured for that key — no escalation.\n- **Multi-tenant safety.** Every request is scoped to the organization the API key belongs to. The AI cannot read or modify data belonging to other Comp AI organizations.\n- **Secrets stay on your machine.** Your API key lives in your AI client’s local config file. It is never sent to Comp AI, npm, or any third party except your own AI client’s vendor.\n- **Sensitive endpoints are hidden.** Endpoints that handle raw secrets (credential rotation, vault material) are deliberately excluded from the MCP tool surface. They remain available in the Comp AI web UI for human operators only.\n- **All actions are logged.** Mutations performed through the MCP server appear in your Comp AI audit log marked with API-key authentication, so you can review who did what.\n\n## When to use the MCP server vs the API\n\n| If you want to… | Use |\n| ------------------------------------------------------------------------- | ------------------------------------------------------------------------------ |\n| Operate your compliance program day-to-day with help from an AI assistant | **MCP server** |\n| Build a custom internal tool, dashboard, or one-off automation | **[Comp AI API](https://www.trycomp.ai/docs/api-reference/overview)** directly |\n| Pipe Comp AI data into your data warehouse on a schedule | **API** directly |\n| Onboard a new auditor or external reviewer to your Trust Center | **Comp AI web UI** |\n\nThe MCP server and the public API hit the same endpoints with the same RBAC — the only difference is the consumer (an AI assistant vs your own code).\n\n## FAQ\n\n## Resources\n\n- **npm package:** [`@trycompai/mcp-server`](https://www.npmjs.com/package/@trycompai/mcp-server)\n- **Source:** [github.com/trycompai/comp](https://github.com/trycompai/comp/tree/main/apps/mcp-server)\n- **Direct API reference:** [Comp AI API](https://www.trycomp.ai/docs/api-reference/overview)\n- **Model Context Protocol overview:** [modelcontextprotocol.io](https://modelcontextprotocol.io/)\n","2026-06-10T14:43:00.553Z","2026-07-07T16:13:16.862Z","187f8b69-504b-49a0-abf8-344e0f3849b1",{"_15":1066,"_53":1062},[],[],[],"Marking Evidence Item Findings as Accepted Risk or Exception","marking-evidence-item-findings-as-accepted-risk-or-exception","## Marking Evidence Item Findings as Accepted Risk or Exception\n\nFor **evidence items**, there is no dedicated \"Accepted Risk\" or \"Exception\" flag. To formally record that a finding has been reviewed and the risk accepted, leave a comment in the **Comments section** of the evidence item explaining the reason the risk is accepted.\n\n### How to do it\n\n1. Open the evidence item containing the finding.\n2. Navigate to the **Comments** section.\n3. Leave a comment stating that the risk has been accepted and include the justification or reason.\n\n### Note\n\nThis comment-based approach applies specifically to **evidence items**. Cloud tests have a separate accepted risk workflow.","2026-06-18T13:22:49.084Z","553f715b-af98-4ec1-9b95-633502b32d84",[],[],[],{"_15":998,"_53":994},[],[],[],"Magic Link Invalid Token Error","magic-link-invalid-token-error","To resolve issues where magic links are marked as \"already used\", or \"Invalid Token\" upon arrival, please follow these steps:\n\n- **Identify Security Software:** Confirm if the organization uses Microsoft 365 Defender or a similar email security gateway. These tools often pre-scan links, inadvertently \"consuming\" the one-time login token.\n\n- **Utilize SSO Alternatives:** Sign in with Microsoft or Google. Utilizing Single Sign-On (SSO) bypasses the email delivery process and avoids the link-scanning conflict entirely.\n\n- **Configure Whitelisting:** Request that the IT department add `app.trycomp.ai` to the \"Allow List\" or \"URL Rewrite Bypass\" list. This prevents the security tool from pre-clicking the links during its safety inspection.\n\n- **Generate New Request:** After the whitelist is applied, the user must request a **fresh magic link**. Previously sent links are permanently invalidated once scanned and cannot be reused.","2026-04-23T09:21:47.312Z","2026-04-23T09:27:12.879Z","6c03380f-5058-4c1b-81d8-2a3cb6d22cb1",[],[],[],"List policies by access token - Comp AI - Documentation","list-policies-by-access-token-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/trust-access/list-policies-by-access-token","# List policies by access token - Comp AI\n\nList policies by access token\n\nGet list of published policies available for download\n\n#### Path Parameters\n\n#### Response","2025-11-25T14:46:30.478Z","2026-07-07T16:13:16.861Z","0daf73dd-590a-4917-8caa-63bfb9b8bbc0",{"_15":1066,"_53":1062},[],[],[],"List access requests - Comp AI - Documentation","list-access-requests-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/trust-access/list-access-requests","# List access requests - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\n#### Query Parameters\n\nAvailable options\n\n:\n\n`under_review`,\n\n`approved`,\n\n`denied`,\n\n`canceled`\n\n#### Response\n\nAccess requests retrieved","2025-11-25T14:41:39.849Z","2026-07-07T16:13:16.860Z","fcd0f45e-4203-4045-8afd-48b1cc3a103c",{"_15":1066,"_53":1062},[],[],[],"List access grants - Comp AI - Documentation","list-access-grants-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/trust-access/list-access-grants","# List access grants - Comp AI\n\n[Skip to main content](https://trycomp.ai/docs/api-reference/trust-access/list-access-grants#content-area)\n\n[Comp AI - Documentation home page![light logo](https://mintcdn.com/bubbaaiinc/K62d4Im87dsqHChw/logo/compai-white.png?fit=max&auto=format&n=K62d4Im87dsqHChw&q=85&s=474d8b432f94b87ab4b32f18061dce83)![dark logo](https://mintcdn.com/bubbaaiinc/K62d4Im87dsqHChw/logo/compai-dark.png?fit=max&auto=format&n=K62d4Im87dsqHChw&q=85&s=abe217a77ac02bd308c8b8e5d77e1b13)](https://trycomp.ai/docs)\n\n[Guides](https://trycomp.ai/docs/introduction)[Cloud Tests](https://trycomp.ai/docs/cloud-tests)[API](https://trycomp.ai/docs/api-reference/organization/get-organization-information)\n\n* [Join us on Discord](https://discord.gg/compai)\n\n##### Organization\n\n* [GET\n \n Get organization information\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/get-organization-information)\n* [DEL\n \n Delete organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/delete-organization)\n* [PATCH\n \n Update organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/update-organization)\n\n##### People\n\n* [GET\n \n Get all people\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/get-all-people)\n* [POST\n \n Create a new member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/create-a-new-member)\n* [POST\n \n Add multiple members to organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/add-multiple-members-to-organization)\n* [GET\n \n Get person by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/get-person-by-id)\n* [DEL\n \n Delete member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/delete-member)\n* [PATCH\n \n Update member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/update-member)\n\n##### Risks\n\n* [GET\n \n Get all risks\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/get-all-risks)\n* [POST\n \n Create a new risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/create-a-new-risk)\n* [GET\n \n Get risk by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/get-risk-by-id)\n* [DEL\n \n Delete risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/delete-risk)\n* [PATCH\n \n Update risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/update-risk)\n\n##### Vendors\n\n* [GET\n \n Get all vendors\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/get-all-vendors)\n* [POST\n \n Create a new vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/create-a-new-vendor)\n* [GET\n \n Get vendor by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/get-vendor-by-id)\n* [DEL\n \n Delete vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/delete-vendor)\n* [PATCH\n \n Update vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/update-vendor)\n\n##### Context\n\n* [GET\n \n Get all context entries\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/get-all-context-entries)\n* [POST\n \n Create a new context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/create-a-new-context-entry)\n* [GET\n \n Get context entry by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/get-context-entry-by-id)\n* [DEL\n \n Delete context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/delete-context-entry)\n* [PATCH\n \n Update context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/update-context-entry)\n\n##### Devices\n\n* [GET\n \n Get all devices\n \n \n \n ](https://trycomp.ai/docs/api-reference/devices/get-all-devices)\n* [GET\n \n Get devices by member ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/devices/get-devices-by-member-id)\n\n##### Policies\n\n* [GET\n \n Get all policies\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/get-all-policies)\n* [POST\n \n Create a new policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/create-a-new-policy)\n* [GET\n \n Get policy by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/get-policy-by-id)\n* [DEL\n \n Delete policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/delete-policy)\n* [PATCH\n \n Update policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/update-policy)\n\n##### Device Agent\n\n* [GET\n \n Download macOS Device Agent\n \n \n \n ](https://trycomp.ai/docs/api-reference/device-agent/download-macos-device-agent)\n* [GET\n \n Download Windows Device Agent ZIP\n \n \n \n ](https://trycomp.ai/docs/api-reference/device-agent/download-windows-device-agent-zip)\n\n##### Attachments\n\n* [GET\n \n Get attachment download URL\n \n \n \n ](https://trycomp.ai/docs/api-reference/attachments/get-attachment-download-url)\n\n##### Tasks\n\n* [GET\n \n Get all tasks\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-all-tasks)\n* [GET\n \n Get task by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-task-by-id)\n* [GET\n \n Get task attachments\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-task-attachments)\n* [POST\n \n Upload attachment to task\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/upload-attachment-to-task)\n* [GET\n \n Get attachment download URL\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-attachment-download-url)\n* [DEL\n \n Delete task attachment\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/delete-task-attachment)\n\n##### Task Automations\n\n* [GET\n \n Get all automations for a task\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-automations-for-a-task)\n* [POST\n \n Create a new evidence automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/create-a-new-evidence-automation)\n* [GET\n \n Get automation details\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-automation-details)\n* [DEL\n \n Delete an automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/delete-an-automation)\n* [PATCH\n \n Update an existing automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/update-an-existing-automation)\n* [GET\n \n Get all versions for an automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-versions-for-an-automation)\n* [GET\n \n Get all automation runs for a task\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-automation-runs-for-a-task)\n\n##### Comments\n\n* [GET\n \n Get comments for an entity\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/get-comments-for-an-entity)\n* [POST\n \n Create a new comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/create-a-new-comment)\n* [PUT\n \n Update a comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/update-a-comment)\n* [DEL\n \n Delete a comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/delete-a-comment)\n\n##### Health\n\n* [GET\n \n Health check\n \n \n \n ](https://trycomp.ai/docs/api-reference/health/health-check)\n\n##### Trust Portal\n\n* [GET\n \n Get domain verification status\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-portal/get-domain-verification-status)\n\n##### Trust Access\n\n* [POST\n \n Submit data access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/submit-data-access-request)\n* [GET\n \n List access requests\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-access-requests)\n* [GET\n \n Get access request details\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-access-request-details)\n* [POST\n \n Approve access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/approve-access-request)\n* [POST\n \n Deny access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/deny-access-request)\n* [GET\n \n List access grants\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-access-grants)\n* [POST\n \n Revoke access grant\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/revoke-access-grant)\n* [GET\n \n Get NDA details by token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-nda-details-by-token)\n* [POST\n \n Preview NDA by token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/preview-nda-by-token)\n* [POST\n \n Sign NDA\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/sign-nda)\n* [POST\n \n Resend NDA email\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/resend-nda-email)\n* [POST\n \n Preview NDA PDF\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/preview-nda-pdf)\n* [POST\n \n Reclaim access\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/reclaim-access)\n* [GET\n \n Get grant data by access token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-grant-data-by-access-token)\n* [GET\n \n List policies by access token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-policies-by-access-token)\n* [GET\n \n Download all policies as watermarked PDF\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/download-all-policies-as-watermarked-pdf)\n\n##### Framework Editor Task Templates\n\n* [GET\n \n Get all framework editor task templates\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/get-all-framework-editor-task-templates)\n* [GET\n \n Get framework editor task template by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/get-framework-editor-task-template-by-id)\n* [DEL\n \n Delete framework editor task template\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/delete-framework-editor-task-template)\n* [PATCH\n \n Update framework editor task template\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/update-framework-editor-task-template)\n\nList access grants\n\n```\ncurl --request GET \\\n --url https://api.trycomp.ai/v1/trust-access/admin/grants \\\n --header 'X-API-Key: ' \\\n --header 'X-Organization-Id: '\n```\n\nTrust Access\n\nGet all active and expired grants\n\nGET\n\n/\n\nv1\n\n/\n\ntrust-access\n\n/\n\nadmin\n\n/\n\ngrants\n\nList access grants\n\n```\ncurl --request GET \\\n --url https://api.trycomp.ai/v1/trust-access/admin/grants \\\n --header 'X-API-Key: ' \\\n --header 'X-Organization-Id: '\n```\n\n#### Authorizations\n\n[](https://trycomp.ai/docs/api-reference/trust-access/list-access-grants#authorization-x-api-key)\n\nX-API-Key\n\nstring\n\nheader\n\nrequired\n\nAPI key for authentication\n\n#### Headers\n\n[](https://trycomp.ai/docs/api-reference/trust-access/list-access-grants#parameter-x-organization-id)\n\nX-Organization-Id\n\nstring\n\nrequired\n\nOrganization ID\n\n#### Response\n\n200\n\nGrants retrieved\n\nWas this page helpful?\n\n[Deny access request](https://trycomp.ai/docs/api-reference/trust-access/deny-access-request)[Revoke access grant](https://trycomp.ai/docs/api-reference/trust-access/revoke-access-grant)\n\n⌘I","2025-11-25T14:41:45.508Z","2026-07-07T16:13:16.859Z","94905c2b-7aaa-4cd8-ad6a-59d1a22b7df9",{"_15":1066,"_53":1062},[],[],[],"Inviting Admins","inviting-admins","https://kb.trycomp.ai/Inviting-Admins-31ba1b1858b880478a37e83f49c6b47a","You should add anybody who needs the ability to work on Policies or upload Evidences as admins so they have access to [app.trycomp.ai](http://app.trycomp.ai/)\n","2026-06-10T13:39:14.115Z","2026-06-23T17:25:31.053Z","5ceb4abb-0991-4449-b6e1-30bc826ad31d",[],[],[],"Integrations - Comp AI - Documentation","integrations-comp-ai-documentation-2","https://www.trycomp.ai/docs/integrations","> ## Documentation Index\n>\n> Fetch the complete documentation index at: \n>\n> Use this file to discover all available pages before exploring further.\n\n## Overview\n\nIntegrations let you connect third-party services (GitHub, AWS, Google Cloud, etc.) to automatically run compliance checks and collect evidence. **Key Features:**\n\n- Extensible architecture for adding new integrations\n- Multiple auth strategies (OAuth, API keys, custom credentials)\n- Automated compliance checks that map to tasks\n- Background execution via Trigger.dev\n- Type-safe with full TypeScript support\n\n## How It Works\n\n### 1. Integration Manifests\n\nEach integration is defined by a **manifest** that describes:\n\n- Authentication method (OAuth, API key, custom)\n- Available compliance checks\n- User-configurable variables\n- API endpoints and headers\n\n### 2. Checks\n\nChecks are compliance validations that run against the external service. For example:\n\n- GitHub: “Are all repos using branch protection?”\n- AWS: “Are there any high-severity findings in Security Hub?”\n- Google Workspace: “Do all users have 2FA enabled?“\n\n### 3. Task Mapping\n\nChecks can map to compliance task templates. When a check passes, the associated task is auto-completed. Example: The GitHub “Branch Protection” check maps to the “Code Changes” task. When the check passes, the “Code Changes” task is automatically marked as done.\n\n### 4. Connection Flow\n\n**OAuth integrations:**\n\n1. User clicks “Connect”\n2. Redirected to provider’s OAuth screen\n3. User authorizes\n4. Token stored securely (encrypted at rest)\n5. Checks run automatically (if no variables needed) or after user configures variables\n\n**Custom auth integrations:**\n\n1. User clicks “Connect”\n2. User enters credentials (API keys, service account, etc.)\n3. Credentials stored securely (encrypted at rest)\n4. Checks run automatically (if no variables needed) or after user configures variables\n\n### 5. Auto-Run Logic\n\nAfter connecting an integration:\n\n- If all required variables are configured → Checks run automatically via Trigger.dev\n- If variables needed → User configures them → Checks run\n- Checks also run daily via scheduled Trigger.dev task\n\n## Architecture\n\n```\nIntegrations\n├── Manifests (define integrations)\n│ ├── Auth config (OAuth, API key, custom)\n│ ├── Checks (compliance validations)\n│ └── Variables (user configuration)\n├── Runtime (execute checks)\n│ ├── Check context (API, logging, reporting)\n│ └── Check runner (orchestration)\n├── API (NestJS backend)\n│ ├── Connections (manage user connections)\n│ ├── OAuth (handle OAuth flow)\n│ ├── Checks (run checks)\n│ └── Variables (manage user settings)\n└── Trigger Tasks (background execution)\n ├── run-connection-checks (auto-run after connect)\n ├── run-task-integration-checks (daily scheduled)\n └── sync-employees-schedule (daily employee sync)\n```\n\n## Built-in Integrations\n\n### Cloud Providers\n\n- **AWS** - Security Hub findings\n- **Azure** - Microsoft Defender for Cloud\n- **GCP** - Security Command Center\n\n### Identity & Access\n\n- **Google Workspace** - User compliance, 2FA checks\n- **Rippling** - Employee sync\n\n### Developer Tools\n\n- **GitHub** - Code security, branch protection, Dependabot\n- **Vercel** - Deployment monitoring\n- **Linear** - Team privacy, SSO checks\n\n## Next Steps\n","2026-05-19T19:46:40.158Z","2026-07-07T16:13:16.858Z","d389badf-1efc-416f-9166-fd6508c94139",{"_15":1066,"_53":1062},[],[],[],"integrations-comp-ai-documentation","https://trycomp.ai/docs/integrations","## Overview\n\nIntegrations let you connect third-party services (GitHub, AWS, Google Cloud, etc.) to automatically run compliance checks and collect evidence. **Key Features:**\n\n* Extensible architecture for adding new integrations\n* Multiple auth strategies (OAuth, API keys, custom credentials)\n* Automated compliance checks that map to tasks\n* Background execution via Trigger.dev\n* Type-safe with full TypeScript support\n\n## How It Works\n\n### 1\\. Integration Manifests\n\nEach integration is defined by a **manifest** that describes:\n\n* Authentication method (OAuth, API key, custom)\n* Available compliance checks\n* User-configurable variables\n* API endpoints and headers\n\n### 2\\. Checks\n\nChecks are compliance validations that run against the external service. For example:\n\n* GitHub: “Are all repos using branch protection?”\n* AWS: “Are there any high-severity findings in Security Hub?”\n* Google Workspace: “Do all users have 2FA enabled?“\n\n### 3\\. Task Mapping\n\nChecks can map to compliance task templates. When a check passes, the associated task is auto-completed. Example: The GitHub “Branch Protection” check maps to the “Code Changes” task. When the check passes, the “Code Changes” task is automatically marked as done.\n\n### 4\\. Connection Flow\n\n**OAuth integrations:**\n\n1. User clicks “Connect”\n2. Redirected to provider’s OAuth screen\n3. User authorizes\n4. Token stored securely (encrypted at rest)\n5. Checks run automatically (if no variables needed) or after user configures variables\n\n**Custom auth integrations:**\n\n1. User clicks “Connect”\n2. User enters credentials (API keys, service account, etc.)\n3. Credentials stored securely (encrypted at rest)\n4. Checks run automatically (if no variables needed) or after user configures variables\n\n### 5\\. Auto-Run Logic\n\nAfter connecting an integration:\n\n* If all required variables are configured → Checks run automatically via Trigger.dev\n* If variables needed → User configures them → Checks run\n* Checks also run daily via scheduled Trigger.dev task\n\n## Architecture\n\n```\nIntegrations\n├── Manifests (define integrations)\n│ ├── Auth config (OAuth, API key, custom)\n│ ├── Checks (compliance validations)\n│ └── Variables (user configuration)\n├── Runtime (execute checks)\n│ ├── Check context (API, logging, reporting)\n│ └── Check runner (orchestration)\n├── API (NestJS backend)\n│ ├── Connections (manage user connections)\n│ ├── OAuth (handle OAuth flow)\n│ ├── Checks (run checks)\n│ └── Variables (manage user settings)\n└── Trigger Tasks (background execution)\n ├── run-connection-checks (auto-run after connect)\n ├── run-task-integration-checks (daily scheduled)\n └── sync-employees-schedule (daily employee sync)\n```\n\n## Built-in Integrations\n\n### Cloud Providers\n\n* **AWS** - Security Hub findings\n* **Azure** - Microsoft Defender for Cloud\n* **GCP** - Security Command Center\n\n### Identity & Access\n\n* **Google Workspace** - User compliance, 2FA checks\n* **Rippling** - Employee sync\n\n### Developer Tools\n\n* **GitHub** - Code security, branch protection, Dependabot\n* **Vercel** - Deployment monitoring\n* **Linear** - Team privacy, SSO checks\n\n## Next Steps\n\n[\n\n## Writing Integrations\n\nLearn how to create your own integration\n\n\n\n](https://trycomp.ai/docs/integrations/writing-integrations)[\n\n## Contributing\n\nContribute integrations to the platform\n\n\n\n](https://trycomp.ai/docs/integrations/contributing)[\n\n## Self-Hosting OAuth\n\nConfigure OAuth for self-hosted deployments\n\n\n\n](https://trycomp.ai/docs/integrations/oauth-setup)","2025-12-16T19:35:41.753Z","2026-07-07T16:13:16.857Z","d0d9638f-19c8-414a-8a59-901739f2b7e5",{"_15":1066,"_53":1062},[],[],[],"In Progress badges for your site","in-progress-badges-for-your-site","https://kb.trycomp.ai/In-Progress-Badges-351a1b1858b88010b11fe6f9284efa31","","2026-05-05T17:34:57.028Z","baa58849-fffc-4967-8483-6a14ec1f282a",[],[],[],"In Progress Badges","in-progress-badges","\\[\n\nSkip to content\n\n]\\()\n\n\\[\n\nGet Audit Ready\n\n]\\()\n\nIn Progress Badges\n\nGet Notion free\n\n![](/api/knowledge-base/images/7f9429aa-a5e6-4811-a26b-584e19a4ff65)\n\n![](/api/knowledge-base/images/955523c7-df60-4321-ae89-77943728b2e4)\n\n![](/api/knowledge-base/images/35d917b7-e37a-4984-a2c6-2697d84ca7e2)\n\n![](/api/knowledge-base/images/8e972902-a177-4d27-863e-35d5cd6a2989)\n\n![](/api/knowledge-base/images/d7ca72d5-327b-4f84-bfbf-3cd4320c84d4)\n\n![](/api/knowledge-base/images/20bc8127-9367-4fe6-bbda-82da435b0daa)\n\n![](/api/knowledge-base/images/c417ff8a-825a-448c-acfc-a65226778075)\n\n![](/api/knowledge-base/images/5cd7b306-8c7e-439c-b329-1021bddc07f2)\n","2026-06-10T13:39:16.485Z","2026-06-10T13:39:22.514Z","8fc6735a-2070-430c-afcb-8cf8967f8c6b",[],[],[],"in-progress-badges-2","https://kb.trycomp.ai/In-Progress-Badges-351a1b1858b88010b11fe6f9284efa31?pvs=25","2026-06-23T17:25:32.562Z","2026-06-23T17:25:32.577Z","0c20b952-958a-49ac-9d6b-6be03c20e660",[],[],[],"Infrastructure Inventory","infrastructure-inventory","https://kb.trycomp.ai/Infrastructure-Inventory-13a5eb0ee3a04af7a291c70960df8798","Even if you only run a single managed service (Heroku, Vercel, Supabase, etc.), you still need to account for it.\n","2026-06-10T13:39:30.626Z","2026-06-23T17:25:35.703Z","505f87f3-0854-48f3-8cf4-2d5977e64dc4",[],[],[],"Incident Response Tabletop Exercise","incident-response-tabletop-exercise-2","https://kb.trycomp.ai/Incident-Response-Tabletop-Exercise-5a8505766a4d416481f39425a618296d?pvs=25","Run a “mental simulation” and use the form to document steps and gaps (for example, backup keys, emergency contacts, account recovery).\n","2026-06-23T17:25:35.843Z","2026-06-23T17:25:35.858Z","e4342445-4f97-4930-a180-ceeebc61f4b0",[],[],[],"incident-response-tabletop-exercise","https://kb.trycomp.ai/Incident-Response-Tabletop-Exercise-5a8505766a4d416481f39425a618296d","2026-06-10T13:39:30.854Z","2026-06-10T13:39:30.880Z","4c49fa7a-ff0b-4333-995c-6e4b7752aa10",[],[],[],{"_15":792,"_53":787},[],[],[],{"_15":647,"_53":641},[],[],[],{"_15":647,"_53":641},[],[],[],{"_15":647,"_53":641},[],[],[],[],[],[],"Health check - Comp AI - Documentation","health-check-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/health/health-check","# Health check - Comp AI\n\n```\ncurl --request GET \\\n --url https://api.trycomp.ai/v1/health\n```\n\n```\n{\n \"status\": \"ok\",\n \"timestamp\": \"2023-11-07T05:31:56Z\",\n \"uptime\": 123,\n \"version\": \"1.0.0\"\n}\n```\n\nReturns the health status of the API\n\n```\ncurl --request GET \\\n --url https://api.trycomp.ai/v1/health\n```\n\n```\n{\n \"status\": \"ok\",\n \"timestamp\": \"2023-11-07T05:31:56Z\",\n \"uptime\": 123,\n \"version\": \"1.0.0\"\n}\n```\n\n#### Response\n\nProcess uptime in seconds","2025-11-25T14:41:39.615Z","2026-07-07T16:15:33.846Z","29fdb546-430f-4fc1-9a62-b38b0149aa3f",{"_15":1066,"_53":1062},[],[],[],{"_15":647,"_53":641},[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],"Get vendor by ID - Comp AI - Documentation","get-vendor-by-id-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/vendors/get-vendor-by-id","# Get vendor by ID - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nVendor ID\n\nExample:\n\n`\"vnd_abc123def456\"`\n\n#### Response\n\nVendor retrieved successfully\n\nVendor ID\n\nExample:\n\n`\"vnd_abc123def456\"`\n\nVendor name\n\nExample:\n\n`\"CloudTech Solutions Inc.\"`\n\nVendor description\n\nExample:\n\n`\"Cloud infrastructure provider offering AWS-like services including compute, storage, and networking solutions for enterprise customers.\"`\n\nAvailable options\n\n:\n\n`cloud`,\n\n`infrastructure`,\n\n`software_as_a_service`,\n\n`finance`,\n\n`marketing`,\n\n`sales`,\n\n`hr`,\n\n`other`\n\nAvailable options\n\n:\n\n`not_assessed`,\n\n`in_progress`,\n\n`assessed`\n\nAvailable options\n\n:\n\n`very_unlikely`,\n\n`unlikely`,\n\n`possible`,\n\n`likely`,\n\n`very_likely`\n\nAvailable options\n\n:\n\n`insignificant`,\n\n`minor`,\n\n`moderate`,\n\n`major`,\n\n`severe`\n\nAvailable options\n\n:\n\n`very_unlikely`,\n\n`unlikely`,\n\n`possible`,\n\n`likely`,\n\n`very_likely`\n\nAvailable options\n\n:\n\n`insignificant`,\n\n`minor`,\n\n`moderate`,\n\n`major`,\n\n`severe`\n\nExample:\n\n`\"https://www.cloudtechsolutions.com\"`\n\nExample:\n\n`\"org_abc123def456\"`\n\nID of the user assigned to manage this vendor\n\nExample:\n\n`\"mem_abc123def456\"`\n\nWhen the vendor was created\n\nWhen the vendor was last updated\n\nHow the request was authenticated\n\nAvailable options\n\n:\n\n`api-key`,\n\n`session`\n\nUser information (only for session auth)\n\nHide child attributes\n\nExample:\n\n`\"usr_def456ghi789\"`\n\nExample:\n\n`\"user@example.com\"`","2025-11-25T14:46:39.979Z","2026-07-07T16:13:16.856Z","9dd69879-c198-4ab5-bfc1-1bc457e122b3",{"_15":1066,"_53":1062},[],[],[],{"_15":1617,"_53":1613},[],[],[],[],[],[],"Get task by ID - Comp AI - Documentation","get-task-by-id-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/tasks/get-task-by-id","# Get task by ID - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nUnique task identifier\n\nExample:\n\n`\"tsk_abc123def456\"`\n\n#### Response\n\nTask retrieved successfully\n\nUnique identifier for the task\n\nExample:\n\n`\"tsk_abc123def456\"`\n\nTask title\n\nExample:\n\n`\"Implement user authentication\"`\n\nTask status\n\nAvailable options\n\n:\n\n`todo`,\n\n`in_progress`,\n\n`done`,\n\n`blocked`\n\ncreatedAt\n\nstring\n\nrequired\n\nTask creation timestamp\n\nExample:\n\n`\"2024-01-15T10:30:00Z\"`\n\nupdatedAt\n\nstring\n\nrequired\n\nTask last update timestamp\n\nExample:\n\n`\"2024-01-15T10:30:00Z\"`\n\nTask description\n\nExample:\n\n`\"Add OAuth 2.0 authentication to the platform\"`\n\nTask template ID\n\nExample:\n\n`\"frk_tt_68406e353df3bc002994acef\"`","2025-11-25T14:46:34.394Z","2026-07-07T16:13:16.854Z","48684473-fa90-4869-a254-de5c3f56bf84",{"_15":1066,"_53":1062},[],[],[],"Get task attachments - Comp AI - Documentation","get-task-attachments-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/tasks/get-task-attachments","# Get task attachments - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nUnique task identifier\n\nExample:\n\n`\"tsk_abc123def456\"`\n\n#### Response\n\nAttachments retrieved successfully\n\nUnique identifier for the attachment\n\nExample:\n\n`\"att_abc123def456\"`\n\nFile type/MIME type\n\nExample:\n\n`\"application/pdf\"`\n\nSigned URL for downloading the file (temporary)\n\nExample:\n\n`\"https://bucket.s3.amazonaws.com/path/to/file.pdf?signature=...\"`\n\ncreatedAt\n\nstring\n\nrequired\n\nUpload timestamp\n\nExample:\n\n`\"2024-01-15T10:30:00Z\"`","2025-11-25T14:46:34.717Z","2026-07-07T16:13:16.853Z","e0b2ab6f-4a1a-4b54-8514-7bf3bf5c4624",{"_15":1066,"_53":1062},[],[],[],"Get risk by ID - Comp AI - Documentation","get-risk-by-id-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/risks/get-risk-by-id","# Get risk by ID - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nRisk ID\n\nExample:\n\n`\"rsk_abc123def456\"`\n\n#### Response\n\nRisk retrieved successfully\n\nRisk ID\n\nExample:\n\n`\"rsk_abc123def456\"`\n\nRisk title\n\nExample:\n\n`\"Data breach vulnerability in user authentication system\"`\n\nRisk description\n\nExample:\n\n`\"Weak password requirements could lead to unauthorized access to user accounts\"`\n\nAvailable options\n\n:\n\n`customer`,\n\n`governance`,\n\n`operations`,\n\n`other`,\n\n`people`,\n\n`regulatory`,\n\n`reporting`,\n\n`resilience`,\n\n`technology`,\n\n`vendor_management`\n\nAvailable options\n\n:\n\n`none`,\n\n`admin`,\n\n`gov`,\n\n`hr`,\n\n`it`,\n\n`itsm`,\n\n`qms`\n\nAvailable options\n\n:\n\n`open`,\n\n`pending`,\n\n`closed`,\n\n`archived`\n\nAvailable options\n\n:\n\n`very_unlikely`,\n\n`unlikely`,\n\n`possible`,\n\n`likely`,\n\n`very_likely`\n\nAvailable options\n\n:\n\n`insignificant`,\n\n`minor`,\n\n`moderate`,\n\n`major`,\n\n`severe`\n\nAvailable options\n\n:\n\n`very_unlikely`,\n\n`unlikely`,\n\n`possible`,\n\n`likely`,\n\n`very_likely`\n\nAvailable options\n\n:\n\n`insignificant`,\n\n`minor`,\n\n`moderate`,\n\n`major`,\n\n`severe`\n\ntreatmentStrategyDescription\n\nExample:\n\n`\"Implement multi-factor authentication and strengthen password requirements\"`\n\nAvailable options\n\n:\n\n`accept`,\n\n`avoid`,\n\n`mitigate`,\n\n`transfer`\n\nExample:\n\n`\"org_abc123def456\"`\n\nID of the user assigned to this risk\n\nExample:\n\n`\"mem_abc123def456\"`\n\nWhen the risk was created\n\nWhen the risk was last updated\n\nHow the request was authenticated\n\nAvailable options\n\n:\n\n`api-key`,\n\n`session`\n\nUser information (only for session auth)\n\nHide child attributes\n\nExample:\n\n`\"usr_def456ghi789\"`\n\nExample:\n\n`\"user@example.com\"`","2025-11-25T14:46:39.252Z","2026-07-07T16:13:16.852Z","075ba5a8-62ac-472b-ad86-627fc5a483e1",{"_15":1066,"_53":1062},[],[],[],"Get policy by ID - Comp AI - Documentation","get-policy-by-id-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/policies/get-policy-by-id","# Get policy by ID - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nPolicy ID\n\nExample:\n\n`\"pol_abc123def456\"`\n\n#### Response\n\nPolicy retrieved successfully\n\nThe policy ID\n\nExample:\n\n`\"pol_abc123def456\"`\n\nName of the policy\n\nExample:\n\n`\"Data Privacy Policy\"`\n\nDescription of the policy\n\nExample:\n\n`\"This policy outlines how we handle and protect personal data\"`\n\nStatus of the policy\n\nAvailable options\n\n:\n\n`draft`,\n\n`published`,\n\n`needs_review`\n\nContent of the policy as TipTap JSON (array of nodes)\n\nExample:\n\n```\n[ { \"type\": \"heading\", \"attrs\": { \"level\": 2, \"textAlign\": null }, \"content\": [{ \"type\": \"text\", \"text\": \"Purpose\" }] }, { \"type\": \"paragraph\", \"attrs\": { \"textAlign\": null }, \"content\": [ { \"type\": \"text\", \"text\": \"Verify workforce integrity and grant the right access at start, revoke at end.\" } ] }]\n```\n\nfrequency\n\nenum | null\n\nrequired\n\nReview frequency of the policy\n\nAvailable options\n\n:\n\n`monthly`,\n\n`quarterly`,\n\n`yearly`\n\ndepartment\n\nenum | null\n\nrequired\n\nDepartment this policy applies to\n\nAvailable options\n\n:\n\n`none`,\n\n`admin`,\n\n`gov`,\n\n`hr`,\n\n`it`,\n\n`itsm`,\n\n`qms`\n\nWhether this policy requires a signature\n\nList of user IDs who have signed this policy\n\nreviewDate\n\nstring | null\n\nrequired\n\nReview date for the policy\n\nExample:\n\n`\"2024-12-31T00:00:00.000Z\"`\n\nWhether this policy is archived\n\ncreatedAt\n\nstring\n\nrequired\n\nWhen the policy was created\n\nExample:\n\n`\"2024-01-01T00:00:00.000Z\"`\n\nupdatedAt\n\nstring\n\nrequired\n\nWhen the policy was last updated\n\nExample:\n\n`\"2024-01-15T00:00:00.000Z\"`\n\nlastArchivedAt\n\nstring | null\n\nrequired\n\nWhen the policy was last archived\n\nExample:\n\n`\"2024-02-01T00:00:00.000Z\"`\n\nlastPublishedAt\n\nstring | null\n\nrequired\n\nWhen the policy was last published\n\nExample:\n\n`\"2024-01-10T00:00:00.000Z\"`\n\nOrganization ID this policy belongs to\n\nExample:\n\n`\"org_abc123def456\"`\n\nID of the user assigned to this policy\n\nExample:\n\n`\"usr_abc123def456\"`\n\nID of the user who approved this policy\n\nExample:\n\n`\"usr_xyz789abc123\"`\n\nID of the policy template this policy is based on\n\nExample:\n\n`\"plt_template123\"`","2025-11-25T14:46:33.198Z","2026-07-07T16:13:16.846Z","2fab5f23-cc98-4e84-addf-df4eddc65bd2",{"_15":1066,"_53":1062},[],[],[],"Get person by ID - Comp AI - Documentation","get-person-by-id-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/people/get-person-by-id","# Get person by ID - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nMember ID\n\nExample:\n\n`\"mem_abc123def456\"`\n\n#### Response\n\nPerson retrieved successfully\n\nMember ID\n\nExample:\n\n`\"mem_abc123def456\"`\n\nOrganization ID this member belongs to\n\nExample:\n\n`\"org_abc123def456\"`\n\nUser ID associated with member\n\nExample:\n\n`\"usr_abc123def456\"`\n\ncreatedAt\n\nstring\n\nrequired\n\nWhen the member was created\n\nExample:\n\n`\"2024-01-01T00:00:00Z\"`\n\nMember department\n\nAvailable options\n\n:\n\n`none`,\n\n`admin`,\n\n`gov`,\n\n`hr`,\n\n`it`,\n\n`itsm`,\n\n`qms`\n\nFleetDM label ID for member devices\n\nUser information\n\nHide child attributes\n\nUser ID\n\nExample:\n\n`\"usr_abc123def456\"`\n\nUser email\n\nExample:\n\n`\"john.doe@company.com\"`\n\nWhether email is verified\n\nUser profile image URL\n\nExample:\n\n`\"https://example.com/avatar.jpg\"`\n\nuser.createdAt\n\nstring\n\nrequired\n\nWhen the user was created\n\nExample:\n\n`\"2024-01-01T00:00:00Z\"`\n\nuser.updatedAt\n\nstring\n\nrequired\n\nWhen the user was last updated\n\nExample:\n\n`\"2024-01-15T00:00:00Z\"`\n\nLast login time\n\nExample:\n\n`\"2024-01-15T12:00:00Z\"`","2025-11-25T14:46:39.046Z","2026-07-07T16:13:16.845Z","f6396b39-2502-4fc0-ab71-c0b197ce1ede",{"_15":1066,"_53":1062},[],[],[],"Get organization information - Comp AI - Documentation","get-organization-information-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/organization/get-organization-information","# Get organization information - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Response\n\nOrganization information retrieved successfully\n\nThe organization ID\n\nExample:\n\n`\"org_abc123def456\"`\n\nOrganization name\n\nExample:\n\n`\"Acme Corporation\"`\n\nOrganization logo URL\n\nExample:\n\n`\"https://example.com/logo.png\"`\n\nAdditional metadata in JSON format\n\nExample:\n\n`\"{\\\"theme\\\": \\\"dark\\\", \\\"preferences\\\": {}}\"`\n\nOrganization website URL\n\nExample:\n\n`\"https://acme-corp.com\"`\n\nWhether onboarding is completed\n\nWhether organization has access to the platform\n\nFleetDM label ID for device management\n\nWhether FleetDM setup is completed\n\nWhen the organization was created\n\nHow the request was authenticated\n\nAvailable options\n\n:\n\n`api-key`,\n\n`session`","2025-11-25T14:41:38.406Z","2026-07-07T16:13:16.844Z","c759fc81-76f2-41e7-84d2-ff80d28d474f",{"_15":1066,"_53":1062},[],[],[],"Get NDA details by token - Comp AI - Documentation","get-nda-details-by-token-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/trust-access/get-nda-details-by-token","# Get NDA details by token - Comp AI\n\n* [Join us on Discord](https://discord.gg/compai)\n\n##### Organization\n\n* [GET\n \n Get organization information\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/get-organization-information)\n* [DEL\n \n Delete organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/delete-organization)\n* [PATCH\n \n Update organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/update-organization)\n\n##### People\n\n* [GET\n \n Get all people\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/get-all-people)\n* [POST\n \n Create a new member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/create-a-new-member)\n* [POST\n \n Add multiple members to organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/add-multiple-members-to-organization)\n* [GET\n \n Get person by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/get-person-by-id)\n* [DEL\n \n Delete member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/delete-member)\n* [PATCH\n \n Update member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/update-member)\n\n##### Risks\n\n* [GET\n \n Get all risks\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/get-all-risks)\n* [POST\n \n Create a new risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/create-a-new-risk)\n* [GET\n \n Get risk by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/get-risk-by-id)\n* [DEL\n \n Delete risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/delete-risk)\n* [PATCH\n \n Update risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/update-risk)\n\n##### Vendors\n\n* [GET\n \n Get all vendors\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/get-all-vendors)\n* [POST\n \n Create a new vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/create-a-new-vendor)\n* [GET\n \n Get vendor by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/get-vendor-by-id)\n* [DEL\n \n Delete vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/delete-vendor)\n* [PATCH\n \n Update vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/update-vendor)\n\n##### Context\n\n* [GET\n \n Get all context entries\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/get-all-context-entries)\n* [POST\n \n Create a new context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/create-a-new-context-entry)\n* [GET\n \n Get context entry by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/get-context-entry-by-id)\n* [DEL\n \n Delete context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/delete-context-entry)\n* [PATCH\n \n Update context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/update-context-entry)\n\n##### Devices\n\n* [GET\n \n Get all devices\n \n \n \n ](https://trycomp.ai/docs/api-reference/devices/get-all-devices)\n* [GET\n \n Get devices by member ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/devices/get-devices-by-member-id)\n\n##### Policies\n\n* [GET\n \n Get all policies\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/get-all-policies)\n* [POST\n \n Create a new policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/create-a-new-policy)\n* [GET\n \n Get policy by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/get-policy-by-id)\n* [DEL\n \n Delete policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/delete-policy)\n* [PATCH\n \n Update policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/update-policy)\n\n##### Device Agent\n\n* [GET\n \n Download macOS Device Agent\n \n \n \n ](https://trycomp.ai/docs/api-reference/device-agent/download-macos-device-agent)\n* [GET\n \n Download Windows Device Agent ZIP\n \n \n \n ](https://trycomp.ai/docs/api-reference/device-agent/download-windows-device-agent-zip)\n\n##### Attachments\n\n* [GET\n \n Get attachment download URL\n \n \n \n ](https://trycomp.ai/docs/api-reference/attachments/get-attachment-download-url)\n\n##### Tasks\n\n* [GET\n \n Get all tasks\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-all-tasks)\n* [GET\n \n Get task by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-task-by-id)\n* [GET\n \n Get task attachments\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-task-attachments)\n* [POST\n \n Upload attachment to task\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/upload-attachment-to-task)\n* [GET\n \n Get attachment download URL\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-attachment-download-url)\n* [DEL\n \n Delete task attachment\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/delete-task-attachment)\n\n##### Task Automations\n\n* [GET\n \n Get all automations for a task\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-automations-for-a-task)\n* [POST\n \n Create a new evidence automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/create-a-new-evidence-automation)\n* [GET\n \n Get automation details\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-automation-details)\n* [DEL\n \n Delete an automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/delete-an-automation)\n* [PATCH\n \n Update an existing automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/update-an-existing-automation)\n* [GET\n \n Get all versions for an automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-versions-for-an-automation)\n* [GET\n \n Get all automation runs for a task\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-automation-runs-for-a-task)\n\n##### Comments\n\n* [GET\n \n Get comments for an entity\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/get-comments-for-an-entity)\n* [POST\n \n Create a new comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/create-a-new-comment)\n* [PUT\n \n Update a comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/update-a-comment)\n* [DEL\n \n Delete a comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/delete-a-comment)\n\n##### Health\n\n* [GET\n \n Health check\n \n \n \n ](https://trycomp.ai/docs/api-reference/health/health-check)\n\n##### Trust Portal\n\n* [GET\n \n Get domain verification status\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-portal/get-domain-verification-status)\n\n##### Trust Access\n\n* [POST\n \n Submit data access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/submit-data-access-request)\n* [GET\n \n List access requests\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-access-requests)\n* [GET\n \n Get access request details\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-access-request-details)\n* [POST\n \n Approve access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/approve-access-request)\n* [POST\n \n Deny access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/deny-access-request)\n* [GET\n \n List access grants\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-access-grants)\n* [POST\n \n Revoke access grant\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/revoke-access-grant)\n* [GET\n \n Get NDA details by token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-nda-details-by-token)\n* [POST\n \n Preview NDA by token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/preview-nda-by-token)\n* [POST\n \n Sign NDA\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/sign-nda)\n* [POST\n \n Resend NDA email\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/resend-nda-email)\n* [POST\n \n Preview NDA PDF\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/preview-nda-pdf)\n* [POST\n \n Reclaim access\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/reclaim-access)\n* [GET\n \n Get grant data by access token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-grant-data-by-access-token)\n* [GET\n \n List policies by access token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-policies-by-access-token)\n* [GET\n \n Download all policies as watermarked PDF\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/download-all-policies-as-watermarked-pdf)\n\n##### Framework Editor Task Templates\n\n* [GET\n \n Get all framework editor task templates\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/get-all-framework-editor-task-templates)\n* [GET\n \n Get framework editor task template by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/get-framework-editor-task-template-by-id)\n* [DEL\n \n Delete framework editor task template\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/delete-framework-editor-task-template)\n* [PATCH\n \n Update framework editor task template\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/update-framework-editor-task-template)\n\nGet NDA details by token\n\n```\ncurl --request GET \\\n --url https://api.trycomp.ai/v1/trust-access/nda/{token}\n```\n\nTrust Access\n\nFetch NDA agreement details for signing\n\nGET\n\n/\n\nv1\n\n/\n\ntrust-access\n\n/\n\nnda\n\n/\n\n{token}\n\nGet NDA details by token\n\n```\ncurl --request GET \\\n --url https://api.trycomp.ai/v1/trust-access/nda/{token}\n```\n\n#### Path Parameters\n\n[](https://trycomp.ai/docs/api-reference/trust-access/get-nda-details-by-token#parameter-token)\n\ntoken\n\nstring\n\nrequired\n\n#### Response\n\n200\n\nNDA details returned\n\nWas this page helpful?\n\n[Revoke access grant](https://trycomp.ai/docs/api-reference/trust-access/revoke-access-grant)[Preview NDA by token](https://trycomp.ai/docs/api-reference/trust-access/preview-nda-by-token)\n\n⌘I","2025-11-25T14:41:43.757Z","2026-07-07T16:13:16.843Z","9d6cfef2-c53a-4d0d-b255-1c840e7b78f2",{"_15":1066,"_53":1062},[],[],[],"Get grant data by access token - Comp AI - Documentation","get-grant-data-by-access-token-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/trust-access/get-grant-data-by-access-token","# Get grant data by access token - Comp AI\n\n[Skip to main content](https://trycomp.ai/docs/api-reference/trust-access/get-grant-data-by-access-token#content-area)\n\n[Comp AI - Documentation home page![light logo](https://mintcdn.com/bubbaaiinc/K62d4Im87dsqHChw/logo/compai-white.png?fit=max&auto=format&n=K62d4Im87dsqHChw&q=85&s=474d8b432f94b87ab4b32f18061dce83)![dark logo](https://mintcdn.com/bubbaaiinc/K62d4Im87dsqHChw/logo/compai-dark.png?fit=max&auto=format&n=K62d4Im87dsqHChw&q=85&s=abe217a77ac02bd308c8b8e5d77e1b13)](https://trycomp.ai/docs)\n\n[Guides](https://trycomp.ai/docs/introduction)[Cloud Tests](https://trycomp.ai/docs/cloud-tests)[API](https://trycomp.ai/docs/api-reference/organization/get-organization-information)\n\n* [Join us on Discord](https://discord.gg/compai)\n\n##### Organization\n\n* [GET\n \n Get organization information\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/get-organization-information)\n* [DEL\n \n Delete organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/delete-organization)\n* [PATCH\n \n Update organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/organization/update-organization)\n\n##### People\n\n* [GET\n \n Get all people\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/get-all-people)\n* [POST\n \n Create a new member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/create-a-new-member)\n* [POST\n \n Add multiple members to organization\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/add-multiple-members-to-organization)\n* [GET\n \n Get person by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/get-person-by-id)\n* [DEL\n \n Delete member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/delete-member)\n* [PATCH\n \n Update member\n \n \n \n ](https://trycomp.ai/docs/api-reference/people/update-member)\n\n##### Risks\n\n* [GET\n \n Get all risks\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/get-all-risks)\n* [POST\n \n Create a new risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/create-a-new-risk)\n* [GET\n \n Get risk by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/get-risk-by-id)\n* [DEL\n \n Delete risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/delete-risk)\n* [PATCH\n \n Update risk\n \n \n \n ](https://trycomp.ai/docs/api-reference/risks/update-risk)\n\n##### Vendors\n\n* [GET\n \n Get all vendors\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/get-all-vendors)\n* [POST\n \n Create a new vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/create-a-new-vendor)\n* [GET\n \n Get vendor by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/get-vendor-by-id)\n* [DEL\n \n Delete vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/delete-vendor)\n* [PATCH\n \n Update vendor\n \n \n \n ](https://trycomp.ai/docs/api-reference/vendors/update-vendor)\n\n##### Context\n\n* [GET\n \n Get all context entries\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/get-all-context-entries)\n* [POST\n \n Create a new context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/create-a-new-context-entry)\n* [GET\n \n Get context entry by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/get-context-entry-by-id)\n* [DEL\n \n Delete context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/delete-context-entry)\n* [PATCH\n \n Update context entry\n \n \n \n ](https://trycomp.ai/docs/api-reference/context/update-context-entry)\n\n##### Devices\n\n* [GET\n \n Get all devices\n \n \n \n ](https://trycomp.ai/docs/api-reference/devices/get-all-devices)\n* [GET\n \n Get devices by member ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/devices/get-devices-by-member-id)\n\n##### Policies\n\n* [GET\n \n Get all policies\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/get-all-policies)\n* [POST\n \n Create a new policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/create-a-new-policy)\n* [GET\n \n Get policy by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/get-policy-by-id)\n* [DEL\n \n Delete policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/delete-policy)\n* [PATCH\n \n Update policy\n \n \n \n ](https://trycomp.ai/docs/api-reference/policies/update-policy)\n\n##### Device Agent\n\n* [GET\n \n Download macOS Device Agent\n \n \n \n ](https://trycomp.ai/docs/api-reference/device-agent/download-macos-device-agent)\n* [GET\n \n Download Windows Device Agent ZIP\n \n \n \n ](https://trycomp.ai/docs/api-reference/device-agent/download-windows-device-agent-zip)\n\n##### Attachments\n\n* [GET\n \n Get attachment download URL\n \n \n \n ](https://trycomp.ai/docs/api-reference/attachments/get-attachment-download-url)\n\n##### Tasks\n\n* [GET\n \n Get all tasks\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-all-tasks)\n* [GET\n \n Get task by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-task-by-id)\n* [GET\n \n Get task attachments\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-task-attachments)\n* [POST\n \n Upload attachment to task\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/upload-attachment-to-task)\n* [GET\n \n Get attachment download URL\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/get-attachment-download-url)\n* [DEL\n \n Delete task attachment\n \n \n \n ](https://trycomp.ai/docs/api-reference/tasks/delete-task-attachment)\n\n##### Task Automations\n\n* [GET\n \n Get all automations for a task\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-automations-for-a-task)\n* [POST\n \n Create a new evidence automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/create-a-new-evidence-automation)\n* [GET\n \n Get automation details\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-automation-details)\n* [DEL\n \n Delete an automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/delete-an-automation)\n* [PATCH\n \n Update an existing automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/update-an-existing-automation)\n* [GET\n \n Get all versions for an automation\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-versions-for-an-automation)\n* [GET\n \n Get all automation runs for a task\n \n \n \n ](https://trycomp.ai/docs/api-reference/task-automations/get-all-automation-runs-for-a-task)\n\n##### Comments\n\n* [GET\n \n Get comments for an entity\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/get-comments-for-an-entity)\n* [POST\n \n Create a new comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/create-a-new-comment)\n* [PUT\n \n Update a comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/update-a-comment)\n* [DEL\n \n Delete a comment\n \n \n \n ](https://trycomp.ai/docs/api-reference/comments/delete-a-comment)\n\n##### Health\n\n* [GET\n \n Health check\n \n \n \n ](https://trycomp.ai/docs/api-reference/health/health-check)\n\n##### Trust Portal\n\n* [GET\n \n Get domain verification status\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-portal/get-domain-verification-status)\n\n##### Trust Access\n\n* [POST\n \n Submit data access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/submit-data-access-request)\n* [GET\n \n List access requests\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-access-requests)\n* [GET\n \n Get access request details\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-access-request-details)\n* [POST\n \n Approve access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/approve-access-request)\n* [POST\n \n Deny access request\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/deny-access-request)\n* [GET\n \n List access grants\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-access-grants)\n* [POST\n \n Revoke access grant\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/revoke-access-grant)\n* [GET\n \n Get NDA details by token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-nda-details-by-token)\n* [POST\n \n Preview NDA by token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/preview-nda-by-token)\n* [POST\n \n Sign NDA\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/sign-nda)\n* [POST\n \n Resend NDA email\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/resend-nda-email)\n* [POST\n \n Preview NDA PDF\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/preview-nda-pdf)\n* [POST\n \n Reclaim access\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/reclaim-access)\n* [GET\n \n Get grant data by access token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/get-grant-data-by-access-token)\n* [GET\n \n List policies by access token\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/list-policies-by-access-token)\n* [GET\n \n Download all policies as watermarked PDF\n \n \n \n ](https://trycomp.ai/docs/api-reference/trust-access/download-all-policies-as-watermarked-pdf)\n\n##### Framework Editor Task Templates\n\n* [GET\n \n Get all framework editor task templates\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/get-all-framework-editor-task-templates)\n* [GET\n \n Get framework editor task template by ID\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/get-framework-editor-task-template-by-id)\n* [DEL\n \n Delete framework editor task template\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/delete-framework-editor-task-template)\n* [PATCH\n \n Update framework editor task template\n \n \n \n ](https://trycomp.ai/docs/api-reference/framework-editor-task-templates/update-framework-editor-task-template)\n\nGet grant data by access token\n\n```\ncurl --request GET \\\n --url https://api.trycomp.ai/v1/trust-access/access/{token}\n```\n\nTrust Access\n\nRetrieve compliance data using access token\n\nGET\n\n/\n\nv1\n\n/\n\ntrust-access\n\n/\n\naccess\n\n/\n\n{token}\n\nGet grant data by access token\n\n```\ncurl --request GET \\\n --url https://api.trycomp.ai/v1/trust-access/access/{token}\n```\n\n#### Path Parameters\n\n[](https://trycomp.ai/docs/api-reference/trust-access/get-grant-data-by-access-token#parameter-token)\n\ntoken\n\nstring\n\nrequired\n\n#### Response\n\n200\n\nGrant data returned\n\nWas this page helpful?\n\n[Reclaim access](https://trycomp.ai/docs/api-reference/trust-access/reclaim-access)[List policies by access token](https://trycomp.ai/docs/api-reference/trust-access/list-policies-by-access-token)\n\n⌘I","2025-11-25T14:46:29.217Z","2026-07-07T16:13:16.841Z","8174f052-0cfd-4323-ac5f-766afcad8561",{"_15":1066,"_53":1062},[],[],[],"Get framework editor task template by ID - Comp AI - Documentation","get-framework-editor-task-template-by-id-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/framework-editor-task-templates/get-framework-editor-task-template-by-id","# Get framework editor task template by ID - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nFramework editor task template ID\n\nExample:\n\n`\"frk_tt_abc123def456\"`\n\n#### Response\n\nSuccessfully retrieved framework editor task template\n\nThe response is of type `any`.","2025-11-25T14:46:32.369Z","2026-07-07T16:13:16.840Z","5a2eecc0-b073-400f-92b3-5bbffd90b15d",{"_15":1066,"_53":1062},[],[],[],"Get domain verification status - Comp AI - Documentation","get-domain-verification-status-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/trust-portal/get-domain-verification-status","# Get domain verification status - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Query Parameters\n\nThe domain name to check status for\n\nExample:\n\n`\"portal.example.com\"`\n\n#### Response\n\nDomain status retrieved successfully\n\nWhether the domain is verified\n\nVerification records for the domain\n\nShow child attributes\n\nVerification type (e.g., TXT, CNAME)\n\nReason for verification status","2025-11-25T14:41:39.492Z","2026-07-07T16:13:16.839Z","4ae0af37-e060-47b7-8b2c-8aeb978088a9",{"_15":1066,"_53":1062},[],[],[],"Get context entry by ID - Comp AI - Documentation","get-context-entry-by-id-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/context/get-context-entry-by-id","# Get context entry by ID - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nContext entry ID\n\nExample:\n\n`\"ctx_abc123def456\"`\n\n#### Response\n\nContext entry retrieved successfully\n\nExample:\n\n`\"ctx_abc123def456\"`\n\nExample:\n\n`\"org_xyz789uvw012\"`\n\nExample:\n\n```\n[\"authentication\", \"security\"]\n```\n\nAvailable options\n\n:\n\n`api-key`,\n\n`session`","2025-11-25T14:46:36.918Z","2026-07-07T16:13:16.838Z","916186de-a888-4cac-b664-0ba1c9a4bad9",{"_15":1066,"_53":1062},[],[],[],"Get comments for an entity - Comp AI - Documentation","get-comments-for-an-entity-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/comments/get-comments-for-an-entity","# Get comments for an entity - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Query Parameters\n\nID of the entity to get comments for\n\nExample:\n\n`\"tsk_abc123def456\"`\n\nType of entity\n\nAvailable options\n\n:\n\n`task`,\n\n`vendor`,\n\n`risk`,\n\n`policy`\n\n#### Response\n\nComments retrieved successfully\n\nUnique identifier for the comment\n\nExample:\n\n`\"cmt_abc123def456\"`\n\nComment content\n\nExample:\n\n`\"This task needs to be completed by end of week\"`\n\nComment author information\n\nAttachment metadata (URLs generated on-demand)\n\ncreatedAt\n\nstring\n\nrequired\n\nComment creation timestamp\n\nExample:\n\n`\"2024-01-15T10:30:00Z\"`","2025-11-25T14:46:35.672Z","2026-07-07T16:13:16.837Z","792c91b3-545e-4b13-8f81-c5a6cfb55222",{"_15":1066,"_53":1062},[],[],[],"Get automation details - Comp AI - Documentation","get-automation-details-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/task-automations/get-automation-details","# Get automation details - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nUnique task identifier\n\nExample:\n\n`\"tsk_abc123def456\"`\n\nUnique automation identifier\n\nExample:\n\n`\"auto_abc123def456\"`\n\n#### Response\n\nAutomation details retrieved successfully","2025-11-25T14:46:34.989Z","2026-07-07T16:13:16.836Z","ef9ad66b-4a18-4a28-b3b6-4dae5e97624f",{"_15":1066,"_53":1062},[],[],[],"Get attachment download URL - Comp AI - Documentation","get-attachment-download-url-comp-ai-documentation-2","https://bubbaaiinc.mintlify.dev/docs/api-reference/attachments/get-attachment-download-url","# Get attachment download URL - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nUnique attachment identifier\n\nExample:\n\n`\"att_abc123def456\"`\n\n#### Response\n\nDownload URL generated successfully\n\nSigned URL for downloading the file\n\nExample:\n\n`\"https://bucket.s3.amazonaws.com/path/to/file.pdf?signature=...\"`\n\nURL expiration time in seconds","2025-11-25T14:46:34.205Z","2026-07-07T16:13:16.833Z","af1dd6ba-96e1-459d-93ae-762aff845642",{"_15":1066,"_53":1062},[],[],[],"get-attachment-download-url-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/tasks/get-attachment-download-url","# Get attachment download URL - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\nUnique task identifier\n\nExample:\n\n`\"tsk_abc123def456\"`\n\nUnique attachment identifier\n\nExample:\n\n`\"att_abc123def456\"`\n\n#### Response\n\nDownload URL generated successfully\n\nSigned URL for downloading the file\n\nExample:\n\n`\"https://bucket.s3.amazonaws.com/path/to/file.pdf?signature=...\"`\n\nURL expiration time in seconds","2025-11-25T14:46:34.619Z","2026-07-07T16:13:16.832Z","490c7498-3d3a-42ab-bdd1-8cf517c0b5ce",{"_15":1066,"_53":1062},[],[],[],"Get all versions for an automation - Comp AI - Documentation","get-all-versions-for-an-automation-comp-ai-documentation","https://bubbaaiinc.mintlify.dev/docs/api-reference/task-automations/get-all-versions-for-an-automation","# Get all versions for an automation - Comp AI\n\n#### Authorizations\n\nAPI key for authentication\n\n#### Headers\n\nOrganization ID (required for session auth, optional for API key auth)\n\n#### Path Parameters\n\n#### Query Parameters\n\n#### Response\n\nVersions retrieved successfully","2025-11-25T14:46:35.585Z","2026-07-07T16:13:16.830Z","bfdfd2b1-0bfa-4d2d-b54f-1ef308187575",{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":998,"_53":994},[],[],[],{"_15":998,"_53":994},[],[],[],{"_15":998,"_53":994},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],{"_15":792,"_53":787},[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],{"_15":792,"_53":787},[],[],[],[],[],[],[],[],[],{"_15":792,"_53":787},[],[],[],[],[],[],[],[],[],[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1617,"_53":1613},[],[],[],[],[],[],[],[],[],[],[],[],{"_15":792,"_53":787},[],[],[],[],[],[],{"_15":792,"_53":787},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],[],[],[],[],[],[],{"_15":792,"_53":787},[],[],[],[],[],[],[],[],[],[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],[],[],[],[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":792,"_53":787},[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],{"_15":1066,"_53":1062},[],[],[],[],[],[],{"_15":1617,"_53":1613},[],[],[],{"_15":792,"_53":787},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],{"_15":1617,"_53":1613},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],[],[],[],[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":998,"_53":994},[],[],[],{"_15":792,"_53":787},[],[],[],{"_15":647,"_53":641},[],[],[],[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":1066,"_53":1062},[],[],[],[],[],[],{"_15":1066,"_53":1062},[],[],[],{"_15":792,"_53":787},[],[],[],{"_53":3032,"_3033":3034,"_3035":78,"_76":-5,"_3036":-5,"_170":3037,"_172":3038,"_15":83,"_17":18},"Comp AI CS","supportName","Comp AI CS Agent","supportLogo","defaultTriageChannelId","2025-09-16T19:34:15.787Z","2026-07-07T14:56:43.285Z","user",{"_3042":3043,"_3041":20},"anonymous","uid","anon_1783451144820_isn4m17","apiKey","AIzaSyDCG_xdkCxQ0mNJT1LKg2XIf0cHJwSISYU","authDomain","unthread"]

Sign in to Comp AI's support portal