Evidence exports for DPOs, auditors and regulators

Audit evidence, generated from what actually happened.

DPA audit packages, transfer impact assessment evidence, EU AI Act Annex IV evidence and Article 30 records, built from receipts and decision logs rather than from a questionnaire someone filled in last year.

Start 14-day trial Schedule an architecture demo

dpa-export-2026-10.tar.gz

manifest.json signed, 14 file hashes
executive_summary.pdf 11 pages
routes.csv 2,232 rows
decisions.csv 312 denials
roots/ 744 hourly roots
keys/ yttsecunet-eu-2026q4.pub

ytt-verify batch: OK

Report preview: pick a report, then a format

Each report below is for one tenant over October 2026. Fields marked prefilled come from the gateway; fields marked you supply are yours to complete once and are carried forward between exports. Switch formats to see what the PDF, JSON and CSV versions contain.

YTT Secunet compliance reportGrowth and Enterprise Sovereign

Supervisory authority evidence package

Tenant tnt_de_4417 (German insurer, claims assistant) / 1 to 31 October 2026 / zone EU

For: A data protection authority's information request, or a customer audit under your Article 28 terms

Requests: 1,284,906
Routed inside EU: 1,284,594
Denied (HTTP 451): 312
Cross-zone failovers: 0

Every request in the period was evaluated under eu-gdpr-strict (4.1.0 until 14 October, 4.2.0 after). 1,284,594 were routed to three EU endpoints; 312 were denied because the requested model had no EU deployment. No request left the EU zone. All 1,284,906 receipts verify against the hourly roots in this bundle.

manifest sha256 9e41...7c0d / signed yttsecunet-eu-2026q4 / generated 2026-11-01T02:00Z

Fields in this export

manifest.jsonprefilledScope, period, pack versions, key ids and a SHA-256 hash of every file in the bundle
executive_summary.pdfprefilledPlain-language account of routing, denials and incidents for the period
routes.csvprefilledRequests per hour per endpoint, with region id, facility code and jurisdiction
decisions.csvprefilledEvery denial with decision id, pack version and deny reason
receipts/ and proofs/prefilledSigned JWS receipts and inclusion proofs (sampled by default, full set on request)
roots/ and keys/prefilledHourly Merkle roots for the period and the public keys with validity windows
endpoints.csvprefilledEndpoints used, provider, parent jurisdiction, CLOUD Act rating, ZDR status
context.mdyou supplyYour processing description, lawful basis and contact point, attached before sending

dpa.pdf

1. Scope and period2
2. Policy packs and versions in force4
3. Routing summary by endpoint and facility6
4. Denials and their reasons8
5. Incidents and failover events10
6. How to verify this bundle offline12
Annex A. Endpoint register14
Annex B. Key fingerprints16

How evidence maps to articles

Evidence YTT Secunet exports	What it supports	Reference	What remains yours
Signed receipts and inclusion proofs	Showing where each inference ran and under which policy	GDPR Art. 5(2), Art. 24	The account of the processing and its lawful basis
Routing, denial and failover logs	Answering an authority's information order; processor audit cooperation	GDPR Art. 58(1)(a), Art. 28(3)(h)	Your response to the authority
Transfer map and endpoint register	Knowing your transfers and identifying the transfer tool per route	GDPR Arts. 44 to 46; EDPB Recommendations 01/2020, steps 1 and 2	Assessment of third-country law and practice (step 3)
Pseudonymization coverage, ZDR terms, key custody	Supplementary measures; security of processing; protection by design	GDPR Art. 25(1), Art. 32(1)(a); EDPB 01/2020, step 4	Whether the measures are effective for your transfers
Detector categories, recipients, erasure periods	The record of processing for the AI activity	GDPR Art. 30(1)(c) to (g)	Purposes, data subjects, controller and DPO details
Data classes, denials and detector recall reports	Risk and measures input for the impact assessment	GDPR Art. 35(7)(c) and (d)	The DPIA, and prior consultation under Art. 36 where required
Event logs, model inventory and change log	Technical documentation and automatic logging for high-risk AI	AI Act Art. 11 and Annex IV, Art. 12, Arts. 19 and 26(6)	Intended purpose, risk management (Art. 9), conformity assessment
Oversight hook events	Evidence that human oversight measures operate	AI Act Art. 14	Design of the oversight and reviewer competence
Providers and endpoints used per period	Entries for the register of information on ICT third-party services	DORA (Regulation (EU) 2022/2554) Art. 28(3)	Contract details and criticality assessment

Formats, retention and delivery

PDF

For people: the authority, the auditor, the board. Paginated, with a contents page, signed manifest hash in the footer and verification instructions in an annex.

JSON

For GRC tools and your own pipelines. Schema-versioned per report type; every file in a bundle is listed with its SHA-256 hash in manifest.json.

CSV

For spreadsheets and sampling. The same rows as the JSON tables, UTF-8, one file per table, ISO 8601 timestamps in UTC.

Ledger retention by plan

Growth90 days
Enterprise Sovereign7 years
Sovereign Dedicatedyour storage, your policy

The AI Act requires providers and deployers of high-risk systems to keep automatically generated logs for at least six months (Articles 19 and 26(6)). Growth's 90 days does not cover that on its own: high-risk workloads belong on Enterprise Sovereign, or need monthly exports into your archive.

Delivery stays in the zone

Reports are built in the tenant's own zone. Download them from the console, pull them through the API, or schedule a monthly push to a storage bucket you name in the same region. The manifest is signed with the zone key, or with your HSM key on Sovereign Dedicated.

Evidence for your DPIA and TIA, not a replacement for them

A report can show that every request in October stayed in the EU, which pack decided it, and which identifiers were pseudonymized. It cannot decide whether the processing was necessary, whether your lawful basis holds, or whether the measures are enough for a transfer you chose to allow. Those are judgments, and they belong to the controller.

Lawful basis and purpose limitationArticle 6 and, for health data, an Article 9(2) condition.
Necessity and proportionalityArticle 35(7)(b): whether an LLM should see this data at all.
Risks to data subjectsYour assessment, informed by our data class and denial metrics.
Third-country law and practiceStep 3 of EDPB Recommendations 01/2020 for any allowed transfer.
Prior consultationArticle 36, where residual risk stays high after measures.
Which pack appliesPacks encode common readings of the law; counsel chooses and signs off.

What changes is the quality of the evidence. Instead of a vendor letter saying inference stays in Europe, the DPIA can cite a signed export that an auditor can verify without asking us.

Reports through the API

Every report the console produces is also an API call, so evidence can be part of your compliance automation instead of a manual task before an audit. Report types are dpa_audit_package, tia_evidence, ai_act_annex_iv_evidence and ropa_ai_inference.

receipts takes sample (a stratified sample per endpoint and day, the default) or full. A full October bundle for a busy tenant is large; authorities usually accept a sample plus the hourly roots, and can ask for specific receipts by request hash.

Admin keys are separate from inference keys and can be scoped to reporting only. Bucket delivery is checked against the tenant's zone before the job starts, so an EU report cannot be pushed to a bucket outside the EU.

bashcreate a DPA audit package

curl -X POST https://eu.yttsecunet.com/v1/reports \
  -H "Authorization: Bearer $YTT_SECUNET_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "dpa_audit_package",
    "tenant": "tnt_de_4417",
    "period": { "from": "2026-10-01", "to": "2026-11-01" },
    "receipts": "full",
    "formats": ["pdf", "json", "csv"],
    "deliver": { "bucket": "s3://dpo-evidence-eu/yttsecunet/" }
  }'

# {"id":"rpt_7Q2M4K","type":"dpa_audit_package","zone":"eu","status":"building"}

curl -s https://eu.yttsecunet.com/v1/reports/rpt_7Q2M4K \
  -H "Authorization: Bearer $YTT_SECUNET_ADMIN_KEY"
# {"status":"ready","files":14,"manifest_sha256":"9e41...7c0d"}

Frequently asked questions

Does a compliance report replace our DPIA or transfer impact assessment?

No. Reports supply the technical evidence those documents rely on: where inference ran, which measures applied and what changed. The assessment of risks, necessity, proportionality and third-country law, and the conclusions, remain the controller's. YTT Secunet does not give legal advice.

Which plans include which reports?

DPA audit packages, transfer impact assessment evidence and Article 30 records are available on Growth and Enterprise Sovereign. EU AI Act Annex IV evidence exports are part of Enterprise Sovereign, which also keeps the proof ledger for seven years.

Is personal data included in the reports?

Reports contain metadata, counts, hashes, endpoint details and the categories of personal data the detectors saw. They contain no prompt or completion content, because none is stored. Receipts carry a hash of the request, not the request.

Can an auditor access reports directly?

On Enterprise Sovereign you can grant an audit role through SAML SSO, scoped to reports and the proof ledger for named tenants. Many teams prefer to export a signed bundle instead and hand that over; it verifies offline with ytt-verify.

What happens to evidence after the retention period?

The ledger is kept for 90 days on Growth and 7 years on Enterprise Sovereign. A bundle you exported stays verifiable indefinitely, because verification needs only the bundle and the public key. Teams on Growth with longer obligations schedule monthly exports into their own archive.

Sovereign route ready

Stop risking 4% global turnover GDPR fines on AI inference.

Deploy sovereign, cryptographically proven AI routing in 15 minutes.

Schedule an architecture demo Start 14-day trial