# SOC 2, PCI DSS and HECVAT compliance evidence - ApiTraffic > Daily evidence of the API controls ApiTraffic sees, mapped to SOC 2, PCI DSS and HECVAT, in signed evidence packs pushed straight to Drata and Sprinto. Source: https://www.apitraffic.io/compliance Compliance # Audit evidence from your APIs. Signed, mapped and already in Drata. ApiTraffic already watches your firewall, your vulnerable packages, your vendors and your sensitive data. Compliance records how each control stands every day, maps it to SOC 2, PCI DSS and HECVAT, and hands your auditor signed evidence packs, uploaded to Drata or Sprinto for you. [Start your free trial](https://app.apitraffic.io/signup?src=compliance-hero)[Read the docs](/docs/compliance) How it works ## Turn it on today. Have evidence today. No questionnaire to fill and no agent to install: the evidence comes from what ApiTraffic already sees in your API traffic. 01 ### Turn it on The checks run the moment you open Compliance, so you see where you stand before your first audit meeting. Run them again whenever you fix something. `Run checks now` 02 ### Evidence every day Every morning each check is recorded for the day before, with the records behind it as they were. A bad day becomes an exception with the day it passed again. `Pass · Attention · Not assessed` 03 ### Packs your auditor trusts On the 2nd of each month, a signed pack per framework. Ask for any other period, environment or set of buckets whenever the auditor does. `manifest.json + manifest.sig` Drata and Sprinto ## Your compliance platform fills itself Connect Drata or Sprinto once and map ApiTraffic’s controls to yours. From then on, each month’s signed evidence pack lands on the controls it backs, without anyone downloading a zip and uploading it again. Drata controls ### Drata ConnectAn API key with workspace, control and evidence permissions, in the NA, EU or APAC region. Every monthOne evidence item in your Evidence Library per pack, holding every file and linked to every control you mapped. Sprinto monitors ### Sprinto ConnectAn admin token from Sprinto’s Developer API, in your region. Every monthThe pack’s files uploaded as evidence to every monitor you mapped, ten files at a time. 01 ### Connect Paste a key or token. ApiTraffic checks it with the platform before saving it, stores it encrypted and only ever shows its last four characters. `Connected` 02 ### Map, with suggestions Each ApiTraffic control comes with a suggested match from your platform. Accept them, change any that are wrong, and leave a control unmapped to keep it in the pack only. `Use suggestions` 03 ### Pushed on the 2nd Each framework’s pack is uploaded as it is built. Push an earlier month any time; a pack that failed is tried again. `Push` | | Uploading evidence by hand | ApiTraffic push | | --- | --- | --- | | Every month | Someone remembers, downloads and uploads | Pushed when the month’s pack is built | | Which controls | Chosen again each time | Mapped once, every change in the account history | | Retries | Duplicates if you try twice | Never a second copy: each push is recorded | | File size limits | Split by hand, signatures broken | Split into zip parts, the signed manifest untouched | | When it breaks | Noticed at audit time | Failing or credential refused, shown and recorded | [How the Drata and Sprinto push works](/docs/compliance-platforms) Frameworks ## The controls ApiTraffic can actually see Each framework maps its controls to checks. Every control says what ApiTraffic shows for it and what you still need to cover yourself, and counts are of controls, never a percentage that would suggest we cover your whole framework. ### SOC 2 2017 Trust Services Criteria CC6.1, CC6.6 to CC6.8, CC7.1 to CC7.4, CC8.1, CC9.2 and C1.1 ### PCI DSS 4.0.1 The API-facing requirements 3.3.1, 3.5.1, 4.2.1, 6.3.1 to 6.3.3, 6.4.1, 6.4.2, 10.2, 10.5.1, 12.5.2 and 12.8.1 ### HECVAT 4.1.6 For higher-education vendors Application security, vulnerability and change management, logging, authentication, third parties and data, each with a suggested answer What is checked ## Evidence an auditor would otherwise ask you for Every check runs for the whole account and for each environment, and keeps the records behind it as they were that day, so evidence for a past day never depends on what is in the app today. ### Firewall enforcing in production Every production bucket with traffic has a WAF policy in block mode, outbound protection is on, and every policy change has its entry in the account history. ### Vulnerabilities fixed on time Critical, KEV and high findings in the packages your services run, held to your SLAs and to PCI DSS 6.3.3’s one-month patch window, with every accepted risk documented. ### Every vendor known and reviewed Destination watch lists every API your code calls. A destination waiting for review longer than 14 days is an exception, and so is one receiving sensitive data unapproved. ### Sensitive data redacted Card numbers, secrets, government ids and health data reaching ApiTraffic unredacted in production put the check in attention until the field is redacted or accepted. ### Changes explained Drift detection is on in production, and no unexplained breaking API change stays open longer than 7 days. ### Logs, access and certificates Request logs kept for 12 months, MFA required for every member, no forgotten API tokens, and every outbound HTTPS host’s certificate monitored. Evidence packs ## Signed, so your auditor never has to take our word for it A pack is a zip with a summary PDF, the daily states, every exception and the records behind each check. manifest.json lists the SHA-256 of every file, and manifest.sig signs it. Packs never hold request bodies, headers or client IP addresses. - **Monthly packs** on the 2nd, per framework, kept for six years - **Any period, environment or set of buckets** on request, for an audit that covers only some APIs - **Every download recorded** in the account history, with who downloaded it ``` # manifest.sig signs the exact bytes of manifest.json (ECDSA P-256) openssl dgst -sha256 -verify key.pem \ -signature manifest.sig manifest.json # Verified OK ``` Sensitive data discovery ## Know where card numbers and secrets flow Discovery samples your traffic and finds the fields carrying card numbers, secrets, government ids, health, student and personal data, inbound and outbound. For each one it shows whether the value is redacted and which vendors receive it. Only where the field is and what it holds are stored, never the value. - **Validated, not guessed:** card numbers pass the Luhn check, IBANs their checksum - **A map by endpoint and destination**, with secrets in credential headers set apart - **An alert** when payment, secret, health or government id data shows up unredacted in production [How discovery works →](/docs/sensitive-data) Honest scope ## What ApiTraffic covers, and what it doesn’t Compliance covers the controls ApiTraffic can see in your APIs: the firewall, vulnerabilities in the packages your services run, outbound vendors, certificates, change detection and sensitive data. Your framework has many more, such as policies, HR, physical security and your infrastructure. Your auditor or your compliance platform tracks those, and every control in ApiTraffic says what you still need. ## See your SOC 2 evidence before your auditor asks. Turn on Compliance, run the checks, and see which controls already pass and which need attention. [Start your free trial](https://app.apitraffic.io/signup?src=compliance-closing) Free trial · No credit card · Set up in minutes