Compliance

Workflow-level evidence mapped to your auditor's controls.

Flowcerta tags every governance rule with the specific compliance controls it supports. When a finding lands in a workflow scan, it carries the framework references with it — so you can show an auditor not just that a finding was caught, but exactly which control it relates to and how the exception was reviewed.

6Frameworks mapped
36Controls covered
170Rule → control mappings
New

Downloadable signed audit evidence

One click in the dashboard generates a signed PDF (or JSON) snapshot of your org's governance posture — workflow inventory, framework coverage, recurring findings, and a per-workflow detail view. Hand it to auditors. Attach it to a vendor review. The HMAC-SHA256 signature lets anyone verify the file is exactly what Flowcerta produced.

  • Org pack — portfolio health, framework coverage, top recurring findings.
  • Workflow pack — per-validation findings, effective policy, controls touched.
  • Signed & portable — base64 HMAC over canonical JSON; no server round-trip needed to verify.

Available to every plan tier inside the dashboard's Portfolio and Validation Detail views. Open the Flowcerta dashboard and look for Download audit pack.

How the mapping works

Every rule in the Flowcerta catalog declares the controls it speaks to via compliance tags on the rule definition. When a validation runs, each resulting finding inherits those tags. The dashboard groups findings by control to produce per-framework reports, and the API exposes a per-validation export endpoint for audit evidence packages.

1
Rules carry control tags.

e.g. FC-UIP-HCD-001 (hardcoded credential) tags SOC2-CC6.1 and PCI-DSS-6.3.

2
Findings inherit the tags.

The findings[].compliance_tags array on every validation response surfaces the same data programmatically.

3
Reports group findings by control.

The dashboard's Compliance view and the /api/v1/results/{id}/compliance/{frameworkId}/export endpoint produce per-framework evidence.

See the request and response schemas on the API docs page, or try the live endpoint from the interactive explorer.

SOC2

SOC 2 Type II

Trust Services Criteria for security, availability, and processing integrity.

Who reads this: B2B SaaS buyers, prospects running customer security reviews, vendor risk teams. · Official spec →

6controls covered
SOC2-A1.1Availability — performance capacity
SOC2-A1.2Availability — recovery and resilience
SOC2-CC6.1Logical and physical access controls
SOC2-CC8.1Change management
HIPAA

HIPAA Security Rule

US healthcare privacy and security requirements for systems handling protected health information.

Who reads this: Healthcare, life sciences, and any organization processing PHI. · Official spec →

1control covered
HIPAA-164.312Technical Safeguards
GDPR

General Data Protection Regulation

EU regulation governing processing of personal data, including the obligation to ensure appropriate security.

Who reads this: Any organization processing personal data of EU residents. · Official spec →

1control covered
GDPR-Art32Security of Processing
PCI

PCI DSS

Payment Card Industry Data Security Standard for any entity that stores, processes, or transmits cardholder data.

Who reads this: Retail, fintech, ecommerce, and any program touching payment card flows. · Official spec →

1control covered
PCI-DSS-6.3Internal and external software applications developed securely
NIST

NIST SP 800-53

US federal control catalog for security and privacy. Coverage is derived from the SOC 2 / HIPAA / GDPR / PCI mappings via a standard crosswalk.

Who reads this: US public sector, FedRAMP-adjacent vendors, and enterprises that standardize on the NIST control set. · Official spec →

15controls covered
NIST-AU-2Event Logging
NIST-CM-3Configuration Change Control
NIST-CP-10System Recovery and Reconstitution
NIST-SA-11Developer Testing and Evaluation
NIST-SC-13Cryptographic Protection
NIST-SC-28Protection of Information at Rest
NIST-SC-5Denial-of-Service Protection
NIST-SI-10Information Input Validation
ISO27001

ISO/IEC 27001:2022

International standard for information security management. Coverage is derived from the SOC 2 / HIPAA / GDPR / PCI mappings via a standard crosswalk.

Who reads this: Global enterprises and any organization certifying its ISMS to ISO 27001. · Official spec →

12controls covered
ISO27001-A.5.30ICT readiness for business continuity
ISO27001-A.5.34Privacy and protection of PII
ISO27001-A.8.24Use of cryptography
ISO27001-A.8.32Change management
ISO27001-A.8.6Capacity management

Frameworks on the roadmap

NIST SP 800-53 and ISO/IEC 27001 coverage is derived from the SOC 2 / HIPAA / GDPR / PCI mappings above via a standard control crosswalk, so both report controls today. The CIS Controls are supported in the dashboard's framework selector but not yet mapped. If you have a specific framework or control your audit needs mapped, tell us which controls matter most and we'll prioritise it accordingly.

Audit evidence

Pull a per-framework report from any validation

Every authenticated validation supports GET /api/v1/results/{id}/compliance/{frameworkId}/export — a structured export with the controls touched, the findings under each, and the exception-history context attached. Use it as the evidence package for an audit cycle or a vendor risk review.

Available on Pro and Enterprise plans. Talk to sales if you need bulk per-org exports for a compliance review.

API docs →See a sample report →