Your site's compliance posture, provable from your live data — not a
spreadsheet you maintain by hand. The Compliance dashboard (System →
Compliance, or /compliance) shows how your site measures up against the
frameworks that matter (GDPR, CCPA/CPRA, WCAG), reads most of its answers
straight from what your site is actually doing, and lets you record the rest as
you go. Every change you make here is written to your site's tamper-evident
history, so the record of how you got compliant is itself provable.
The short version: open it, read your posture, act on the recommendations, attest what's true, and track the gaps to closure.
The overview
The first tab is your at-a-glance posture:
- Integrity headline — whether your tamper-evident history verifies clean, and how many changes it holds. This is the foundation the rest rests on.
- Recommendations — live findings that need attention, worst-first: a broken audit chain, a data-subject request past its deadline, retention left unlimited, a consent banner not configured, trackers with no subprocessor record. Each links straight to the tool that fixes it.
- Framework coverage — a percentage and a colour per framework, with clickable counts. Click any count (gaps, partials…) to drill into exactly which controls are in that state.
- Remediation — a summary of open and overdue action items, with a small burndown so you can see the trend.
- Weekly email digest — a preview of what will be emailed, and to whom.
Frameworks and controls
The Frameworks tab lists each framework's controls and how your site addresses them. Most statuses are derived from your live site state — turn on a consent banner and the relevant GDPR/CCPA controls go green on the next load; let the audit chain verify and the integrity controls follow.
Each control shows one of these statuses:
| Status | Meaning |
|---|---|
| Addressed | Fully met. |
| Partial | Partly met — usually a manual step remains. |
| Gap | Not met. Worth a remediation item. |
| N/A | Doesn't apply to your site. |
| Accepted risk | A gap you've consciously decided to accept, for now. |
| Pending | A decision you haven't made yet. |
Expand a control to:
- Set the status yourself (an attestation) with an optional note and an owner. Your attestation overrides the derived value and is recorded in the history with who and when. "Reset" reverts to the live-derived value.
- Attach evidence — a link, a document, an audit reference, a note, or a link to a live page on your own site. Linked-content evidence shows the page's current title and warns you if that page is later deleted, so your evidence can't quietly go stale.
- See the full change history — every status this control has held, who set it, when, and their note, straight from the tamper-evident chain.
- Track remediation — on a gap or partial, jump straight to a pre-filled remediation item for that control.
Data & privacy
The Data & privacy tab summarises the operational surfaces your compliance depends on — data-subject requests, consent, retention, subprocessors — and deep-links to the tools that manage them (under Privacy). Fix things there; the coverage here updates.
Remediation
Turn gaps into tracked work. The Remediation tab is a lightweight task tracker built for compliance:
- Each item has a priority (high / medium / low), an owner, a due date, a detail, and the controls it addresses (as jump-links).
- Advance an item through open → in progress → blocked → done. When you mark one done, you can attest the controls it covered as addressed in the same step.
- Overdue items are flagged; the overview and the weekly digest surface them.
Accepted risks & decisions
Not every gap gets fixed immediately — sometimes you consciously accept a risk or defer a decision. Record those so they're documented, owned, and revisited: a decision has a status (accepted-risk / pending / resolved), an owner, a rationale, a review-by date, and the controls it affects. When a review date approaches or passes, it shows up in your recommendations and your digest so an accepted risk never silently becomes a forgotten one.
Point-in-time
Because your history is bitemporal, you can ask "what was our posture on
The weekly digest
Owners get a weekly email of the compliance work coming due or overdue — reviews to re-affirm, remediation reaching its due date. Items route to the owner's email address where you've set one, and to your site admin otherwise. Anyone who's turned off email notifications is skipped. Want to see it now? Use "Send me a test" on the dashboard — it emails the digest only to you.
Export & report
Two buttons, top-right:
- Report — a printable, auditor-ready document: your posture, the integrity proof, findings, per-control ownership and evidence, accepted risks, the remediation plan, and the evidence register. Print it to PDF.
- Export bundle — the same picture as JSON, including your live compliance state, for your own records or an external tool.
Share a verifiable public summary
Beyond a printout, you can publish a public compliance page — a link you hand to an auditor, a prospect, or your own customers. What makes it different from a "compliance badge" anyone can fake: it's anchored to your tamper-evident history. When you publish, StaticOwl stamps the snapshot with your audit chain's current state (how many records, verified clean). When someone opens the link, the page re-checks your chain live and shows the snapshot as verified only if the record is still intact and has only grown since — so the viewer can see it's consistent with what actually happened, not just a number you typed.
From the overview: Publish → you get a shareable link (copy it, or open the
page), an embeddable badge you can drop on your own site (a small
compliance 92% ✓ shield that stays live and links back to your trust page), and
a downloadable attestation (a signed record carrying the anchor + a link to
re-verify — handy for an auditor's file). Refresh re-anchors it to your latest
posture; Unpublish takes it all offline instantly. The link is a capability token scoped to your site — it can
never expose another site's data — and the page is set to noindex so it won't
show up in search engines unless you share it. This is what "we prove, you don't
just claim" looks like in practice.
For agents (MCP)
Everything above is scriptable from an AI agent through the compliance MCP tools
(compliance_state, compliance_set_status, compliance_add_evidence,
compliance_set_decision, compliance_set_action, …). See
mcp.md. The same operations are available over HTTP under
/api/compliance/* — see api.md.
A note on honesty
Nothing here fabricates a green checkmark. Statuses are either derived from what your site genuinely does, or attested by you and recorded with your name on them. A control you haven't evaluated stays "pending", not "addressed" — because the whole point is that your compliance posture is something you can prove, not just claim.