AuditRails supports 8 compliance frameworks out of the box. For each one, specific event types, storage guarantees, and dashboard features map directly to regulatory controls, so you can demonstrate compliance without manual evidence collection.
The authoritative list is always GET https://app.auditrails.io/api/v1/frameworks. If a framework is not in that response, it is not available to enable.
Getting Started
Before mapping events to controls, make sure you’re set up correctly.
Enable a Compliance Framework
Navigate to Settings → Compliance Frameworks and toggle on the frameworks relevant to your organization. Every plan includes compliance framework logging. How many you can enable at once depends on your plan: Starter Trails gets one, chosen at signup and locked; Framework Trails gets up to three, swappable self-service; Compliance Trails gets all of them, bundled free.
Review the Compliance Checklist
Open Dashboard → Compliance and select your framework. Each checklist item maps to a specific control and shows its current status.
Start Logging Required Events
Instrument your application to emit the event types listed for your framework in the sections below. Use the AuditRails SDK or REST API.
Run Auto-Verification
Use the auto-verification feature in the compliance dashboard to confirm your hash chain is intact and required event coverage is met.
Track Progress
Monitor the checklist over time. Each control turns green once AuditRails detects the required events and configuration.
Framework Reference
The EU Digital Operational Resilience Act (2022/2554) applies to financial entities and their ICT providers. It emphasises operational continuity, incident timelines, and third-party risk.Reporting deadlines: 4 hours (initial notification), 72 hours (intermediate report), 1 month (final report). Log incident.detected and incident.notified events to create a timestamped paper trail for each deadline.Retention: 5 years (set automatically when DORA is enabled).DORA’s Art.6 requirement for hash-chained logging is natively satisfied. Every event is chained with SHA-256, and you can verify the chain at any time via the dashboard or API.
GDPR obligations span data processing accountability, consent management, subject rights, and breach notification. See the GDPR Compliance guide for full configuration steps.Retention: 5 years (set automatically when GDPR is enabled).consent.given requires actor_id, metadata.legal_basis, and metadata.purpose. Events missing a required field are rejected at ingest, so a passing checklist means the evidence is actually complete.
The EU NIS2 Directive (2022/2555) applies to essential and important entities. It mandates security event logging, access controls, supply chain monitoring, and incident reporting.Reporting deadlines: 24 hours (early warning), 72 hours (incident notification), 1 month (final report). incident.early_warning requires actor_id, metadata.incident_id, and metadata.authority.Retention: 5 years (set automatically when NIS2 is enabled). Regulation (EU) 2024/1689 applies to providers and deployers of AI systems. Article 12 requires high-risk systems to automatically record events over their lifetime, which is exactly what an append-only, hash-chained trail provides.Retention: 10 years, the longest of any framework AuditRails supports (set automatically when the EU AI Act is enabled).aiact.model_inference_logged requires actor_id, resource, metadata.system_id, and metadata.model_id. Optional fields cover input_hash, output_hash, risk_tier, decision, and human_oversight, which is what turns a raw inference log into Art.12 evidence.
ISO 27001:2022 Annex A controls map closely to AuditRails’ logging, monitoring, and integrity capabilities.Retention: 3 years (set automatically when ISO 27001 is enabled).Tenant isolation means each customer’s hash chain is independent. A breach in one tenant’s chain cannot affect another’s, satisfying A.5.23 multi-tenancy controls.
SOC 2 Trust Services Criteria require you to log access events, authentication activity, permission changes, and configuration changes, and to demonstrate that those logs cannot be tampered with.Key capabilities: Immutable audit trail, WORM storage, RBAC auditor role (read-only access for auditors), CSV export for evidence packages.Retention: 1 year (set automatically when SOC 2 is enabled).The RBAC auditor role lets you grant your external auditor read-only access to the compliance dashboard without exposing sensitive configuration settings.
The Italian Garante’s provision of 27 November 2008 (updated 2009) on amministratori di sistema requires that every administrative access to systems processing personal data be individually attributable, completely logged, tamper-proof, and retained for at least six months.Retention: 1 year, which clears the provision’s six-month minimum (set automatically when the framework is enabled).admin.operation requires actor_id, resource, metadata.operation_type, metadata.before, and metadata.after. The before/after pair is what makes the record evidential rather than merely a note that something changed.
PCI DSS v4.0 Requirement 10 mandates detailed audit logs for all access to cardholder data environments, with tamper protection and time-range search.Retention: 1 year (set automatically when PCI DSS is enabled). This meets Requirement 10.7’s 12-month minimum with 3 months immediately available.Every event in AuditRails includes actor_id, resource, action, timestamp, IP address, and outcome fields by default, satisfying Requirement 10.3’s “complete record” mandate without extra configuration.
Retention at a Glance
Enabling a framework raises your effective retention to its minimum. Where several are enabled, the longest wins.
Retention is not itself a plan-tier feature. See Data Retention for how the base period and framework minimums interact.
Multi-Framework Coverage
If your organization must satisfy multiple frameworks simultaneously, AuditRails merges their requirements. A single auth.login event, for example, satisfies SOC 2 CC6.2, PCI DSS 10.2.1, and NIS2 Art.21(2)(i) at the same time.
Enable all applicable frameworks before you start logging. This ensures the compliance dashboard tracks coverage across all of them from day one and that the correct retention period (the longest of all enabled frameworks) is applied.
