Skip to content
ComplyForm Docs

Evidence Export

Push compliance evidence directly into your existing audit toolchain.

Export formats

Section titled “Export formats”
FormatFlagTierDescription
SCC JSON--format=scc-jsonTeam+Google Security Command Center findings
Audit Manager--format=audit-managerTeam+AWS Audit Manager evidence
Purview--format=purviewTeam+Microsoft Purview Compliance Manager
Vanta--format=vantaAgencyVanta integration (file or API)
Drata--format=drataAgencyDrata integration (file or API)
Secureframe--format=secureframeAgencySecureframe integration (file or API)
GRC JSON--format=grc-jsonCommunity+Generic GRC interchange format

Cloud-native export (Team+)

Section titled “Cloud-native export (Team+)”

Export findings directly to your cloud provider’s audit service.

Terminal window
# Google Security Command Center
complyform export --format=scc-json \
  --input=findings.json \
  --project=my-gcp-project \
  --source=organizations/123456/sources/789


# AWS Audit Manager
complyform export --format=audit-manager \
  --input=findings.json \
  --assessment-id=a1b2c3d4-5678-90ab-cdef-111111111111


# Microsoft Purview
complyform export --format=purview \
  --input=findings.json \
  --tenant-id=a1b2c3d4-5678-90ab-cdef-222222222222

GRC platform export (Agency)

Section titled “GRC platform export (Agency)”

Export to third-party GRC platforms. Generate a file for manual upload or push directly via API.

Terminal window
# File export for manual upload
complyform export --format=vanta \
  --input=findings.json \
  --output-file=vanta-evidence.json


# Direct API push
complyform export --format=drata \
  --input=findings.json \
  --api-key=$DRATA_API_KEY \
  --push

Batch export

Section titled “Batch export”

Export to multiple formats in one invocation (Agency tier).

Terminal window
complyform export --format=scc-json,vanta,grc-json \
  --input=findings.json \
  --output-dir=evidence/

This writes one file per format into the evidence/ directory: evidence/scc-json.json, evidence/vanta.json, evidence/grc-json.json.

Signed attestations

Section titled “Signed attestations”

Generate a cryptographically signed attestation for point-in-time compliance evidence.

Terminal window
# Generate signed attestation during assessment
complyform assess --frameworks=soc2 --attest --output-file=soc2-attestation.json


# Verify an existing attestation
complyform verify --attestation=soc2-attestation.json

The attestation includes the assessment timestamp, framework version, resource inventory hash, and an Ed25519 signature. Auditors can verify the attestation independently without access to your infrastructure.

Next steps

Section titled “Next steps”