Compliance evidence and regulated deployments

Request assurance material and preserve deployment-specific evidence of configured controls.

Compliance evidence combines provider assurance material with records from the actual deployment. Product availability and deployment configuration have separate review boundaries.

Assurance materialCopy link

Request assurance documents at Organization → Support → Compliance documents. Collect deployment exports from Organization settings → Governance → Evidence; access depends on the document and export permissions.

Request the assurance material required by your assessment through the support and account process. If the assessment requires a SOC 2 Type II report, obtain the applicable report before treating the service as independently attested. Review its service scope, report period, exceptions, customer responsibilities, and any confidentiality conditions.

A report about the hosted service does not automatically cover an independently operated self-hosted control plane or every external backup provider. Record which parties operate each component.

HIPAA-eligible configurationCopy link

For a regulated workload, establish the applicable service agreement and required provider arrangements before placing protected data in hosted capacity. Select approved regions, access policy, encryption, audit retention, and recovery paths for that deployment.

Eligibility does not configure application permissions or data handling for the workload owner. Guest logs, session recordings, support bundles, and copied backups can contain sensitive data even when the primary volume is correctly placed.

Collect operational evidenceCopy link

Retain role and grant revisions, authentication enforcement, patch status, backup verification results, residency policy, and resource inventory for the review period. Evidence should identify resource IDs and capture times rather than only a screenshot of today's settings.

Audit integrity manifests help verify exported records. A valid manifest does not prove that an application never wrote data to an unapproved external system.

Exceptions and reviewCopy link

Associate approved exceptions with an owner, purpose, expiry, and affected resources. An expired exception can leave resources requiring remediation; it does not move or erase them automatically.

Export evidence to an approved archive and retain the policy revision under which each action was admitted. See data residency, security keys, session recordings, and retention holds.