> ## Documentation Index > Fetch the complete documentation index at: https://docs.quintai.dev/llms.txt > Use this file to discover all available pages before exploring further. # Compliance and Audit Trail > What the Compliance page counts, what the Audit Trail records, and the three exports you can hand an auditor. Both pages sit under **Govern**. **Compliance** maps what the fleet did to named framework controls. **Audit Trail** is the record: every captured agent action, and every action a person took in the console. ## Compliance The page states what it is: "Your fleet's framework coverage, from the served policy pack and the window's detections." And what it is not: "Nothing on this page is a percentage of a framework or a compliance opinion. Quint's own certification status is stated on quintai.dev, not here." **Served pack** facts come first: **Served pack**, **Lease**, **Declared mode**, **Tenant enforcement**, **Enabled families**. These describe the ruleset your machines hold now; see [How policies work](https://docs.quintai.dev/policies/how-policies-work.md). **Controls named by the served pack** lists the controls the pack's rules map to. **Detected activity by framework control** counts detector fires per control for the window, default **Last 7 days**. Its legend: **S** means "control text literally describes what fired"; **P** means "a reasonable analyst would accept the mapping". The window hint says "Kept 14 days": the page looks back 14 days at most. **Technique census** appears only when the window has MITRE technique fires; it is "MITRE catalogues · a census of detector fires, not a compliance card". The frameworks the page maps to: CSA Cloud Controls Matrix; EU AI Act; ISO/IEC 42001; MITRE ATLAS; MITRE ATT\&CK; NCA CCC, NCA DCC and NCA ECC; NIST AI RMF; NIST SP 800-53; OWASP Top 10 for Agentic Applications; OWASP Top 10 for LLM Applications; SAMA CSF; SOC 2 Trust Services Criteria. **Export CSV** downloads the table for the window. Empty states: "No detector fires mapped to a control framework in this window." and, when no ruleset is published yet, a note that every framework shows 0 named controls until one is. ## Audit Trail Two tabs. **Event search** is "captured agent activity · newest first". **Console actions** is the "administrative audit log · newest first". ### Event search Tiles: **Matching server-side**, **Fetched this page**, **Matching on screen** and **Distinct sessions**. Controls: the range (default **Last 24 hours**), **All action types**, verdict **Any verdict**, **Flagged** or **Blocked**, the on-page filter "Filter this page — action, tool, MCP server, session, model…", **Refresh**, and **← Newer** / **Older →**. **Top actions** ranks the window. The columns, in plain words: when the action happened; what kind of action it was; the tool the agent called; what it was aimed at; the decision recorded on it; its risk score; the session it belongs to; the event's own identifier. The empty state: "Empty is not the same as clean — it means nothing arrived in this window. Check a wider range, and check the fleet's capture state before concluding the endpoints were quiet." ### Console actions The tab describes itself: "This log records logins, policy and credential changes, role changes and incident triage." Filters: **All actions**, **All actors**, **Partner actions**. Reading it needs Admin or Owner: "Reading the administrative log requires the admin role." ### Audit-chain integrity The panel reads "last 7 days · verified on request" and checks the log's chain when you ask. Verdicts: **intact**, **broken**, **partially checked**, **indeterminate**, **not checked**. It reports **rows walked**, **chains covered** and **rows not verifiable**. Treat anything other than **intact** as a result to read, not a pass. ### Export **Export** and **Export CSV** download what you are looking at. Of the administrative log, **Settings › Audit** says: "Export downloads the whole log as a file and is itself recorded." ## Evidence for an auditor Three things you can hand over: 1. **Compliance CSV**: **Export CSV** on **Compliance**. The controls the served pack names and detector fires per control, for a window of up to 14 days. Export before the window moves. 2. **Audit Trail export**: **Export** on **Audit Trail**, for captured agent activity or for console actions. The Audit page download is what you see on screen; **Settings › Audit** export is the recorded export. 3. **Streamed audit log**: under **Settings › Audit › Streaming**. "Every enabled batch exporter receives the admin audit log as a second stream beside telemetry; the realtime alert channels do not." Until you set one up it reads "No batch exporter is configured, so the audit log is not streamed anywhere yet." See [Export to your SIEM](https://docs.quintai.dev/integrations/export-to-your-siem.md). > [!NOTE] > > None of these is a compliance opinion. Quint's own certification status is stated on quintai.dev, not in the dashboard. ## Next * [How policies work](https://docs.quintai.dev/policies/how-policies-work.md) for the served pack and shadow mode. * [Workspace and data](https://docs.quintai.dev/settings/workspace-and-data.md) for how long each class of data is kept. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.