Compliance
Evidence reports for OWASP and India's DPDP Act, built from what Guard records.
Compliance turns what Guard already records (traces, rules, approvals, content-safety findings, alerts and the audit log) into PDF evidence reports. Beta includes two frameworks:
| Framework | Based on |
|---|---|
OWASP Top 10 for Agentic Applications 2026 (owasp_agentic_ai) | The official OWASP GenAI Security Project, ASI01 to ASI10 |
India DPDP Act 2023 and DPDP Rules 2025 (dpdp) | The official MeitY texts of the Act and the Rules |
Evidence, not certification
A report shows the evidence Guard holds. It is not legal advice, an assessment or a certification, and it does not say that you, or Impraint, are compliant with OWASP or the DPDP Act.
Other frameworks (EU AI Act, GDPR in depth, SOC 2, ISO 42001, NIST) are not part of beta.
Reading a status
Every requirement in a report carries one status, computed from your data and never written by hand:
| Status | Meaning |
|---|---|
| Evidence available | Guard has the control in place and has seen it work in the report period |
| Partly evidenced | Guard holds some evidence, but a known gap caps it, or the control exists with no activity yet |
| No data this period | Guard has no evidence for this requirement in the period |
| Not provided by Guard | Guard does not offer the capability at all, for example DPDP 8(7) retention and erasure |
Each requirement also has a short "Why this status" line, and two parts: what Guard did or holds, and what your own agent or process must still do.
Findings from trial (dry-run) rules and findings an analyst marked as false positives are left out of the counts and listed as "Not counted". "None detected" means none detected, not proof that none occurred.
Generate a report
In the dashboard, open Analyse → Compliance and select a framework card. Its page shows:
- A link to the official text of the framework, with the issuing body.
- What is this framework? and What does Impraint Guard cover?
- A section-by-section breakdown. Each item links to its source document and has a note on how Guard behaves there.
- Generate report and Previously generated, at the bottom.
To generate a report, pick a Period start and Period end, then click Generate Report. The period can be at most 365 days, and the end date cannot be in the future. A status line shows the progress while the report is built in the background. When it is ready, it appears in Previously generated, where you can download the PDF.
- Only an admin can generate reports. Other roles see a note and can still view and download the reports in the list.
- If a report takes longer than expected, the page says so and offers Check again.
- The requester gets an email when the report is ready or has failed, if email is configured for your deployment.
# 1. Request a report (period: 1 to 365 days)
curl -X POST https://guard.impraint.com/compliance/report \
-H "Authorization: Bearer <admin access token>" \
-H "Content-Type: application/json" \
-d '{"framework": "dpdp", "period_start": "2026-10-01", "period_end": "2026-10-31"}'
# returns 202 with a report_id
# 2. Poll until the status is "ready" (or "failed", which includes an error message)
curl https://guard.impraint.com/compliance/reports/<report_id>/status \
-H "Authorization: Bearer <access token>"
# 3. Download the PDF
curl -o report.pdf https://guard.impraint.com/compliance/reports/<report_id>/download \
-H "Authorization: Bearer <access token>"GET /compliance/reports lists your reports, newest first. Through the API, the start must be before the end, the same date twice means that whole day, and an end date in the future is cut to now.
What a report contains
OWASP. All ten risks, ASI01 Agent Goal Hijack to ASI10 Rogue Agents. Each one shows the evidence Guard has, such as injection counts, rule decisions, approvals, anomalies and audit entries, and says what Guard cannot see. For example, ASI05 (unexpected code execution) always reads "No data this period", because Guard cannot see code execution.
DPDP. Section 8 (8(3) to 8(7)), a full coverage page for Sections 8 to 10, the DPDP Rules 6, 7 and 8(3), and a breach timeline. The timeline lists personal-data and secret findings with the first successful alert for each one and how many minutes it took.
- Guard does not notify the Data Protection Board or Data Principals, decide what counts as a breach, or run the 72-hour clock under Rule 7. The report says so.
- Guard does not enforce a retention period or erase personal data, so 8(7) reads "Not provided by Guard".
- Under Rule 1(4), Rules 3, 5 to 16, 22 and 23 come into force 18 months after the gazette of 13 November 2025, about May 2027. The report says this in its Rules section.
Official sources: the DPDP Act 2023 and the DPDP Rules 2025, G.S.R. 846(E), both from MeitY, and the OWASP Top 10 for Agentic Applications 2026 on genai.owasp.org.
Set your deployment mode
The DPDP report includes a note on who acts as the Data Processor. An admin sets this under Settings → Organisation → How is Guard deployed?: choose hosted (Impraint processes data on your behalf) or self-hosted (you do). If it is left unset, the note explains both cases.
Report integrity and the audit log
Guard keeps an append-only audit log of rule changes, API key changes, logins, approval decisions, pauses and report downloads. Each entry is chained to the one before it, so editing or deleting an entry is detectable, and the database refuses edits to the audit table.
Admins see two things at the bottom of the Compliance page:
- Audit chain integrity. Click Verify Now to check the whole chain. The result reads Chain intact or Integrity check failed, with the number of entries and signatures checked. If a check fails, it names the first broken entry and why. Entries without a signature are noted as not verifiable by signature.
- Audit log. A table of entries with the time, event, agent, a link to the trace, a short entry hash and whether it is Signed or Unsigned. You can filter by event type, and it shows 50 entries per page.
Three things let you prove a report and its history were not changed:
- Chain proof in the report. Each report records the audit chain's tip, entry count, intact flag and check time at generation.
- PDF fingerprint. The download carries
X-Report-SHA256(the hash of the file you received) andX-Report-SHA256-Recorded(the hash saved when the report was generated). If both are present and differ, the file changed after generation. - Daily chain-tip email. Every day, at 06:07 IST (00:37 UTC), your organisation's admins receive the current chain tip and entry count. Because the email sits outside the database, a rewritten history is detectable: that hash would be missing from the log, or the log would have fewer entries than the email said.
Known limits in beta
- Only OWASP and DPDP are available.
- Evidence for OWASP ASI04 (supply chain) and ASI05 (code execution) is thin.
- Significant Data Fiduciary duties are not covered.
- There is no retention purge job and no personal-data erasure.
- There is no audit export, SIEM feed or auditor role. Signatures cannot be verified offline.
- Viewing the audit log is not itself audited.
- A report can stay
pendingorprocessingif the system that builds reports is not running. Nothing times it out.