Shareable compliance pack
Mint a password-gated public link to a redacted compliance evidence pack. Hand it to your customer's security team instead of writing a questionnaire response.
Last updated Jun 2, 2026
What it is
A password-gated public URL for the compliance evidence pack. Mint it once, send the URL + one-time password to your customer’s security team (or auditor), and they view a redacted snapshot without an Umbra account.
Same trust model as the cinematic-replay share: 256-bit random token, bcrypt’d password, mandatory expiry, revoke-without- delete, per-token rate limiting.
What it produces
- Public URL:
/#/compliance-share/<token>(43-char base64, un-guessable) - One-time-shown password (16 chars, unambiguous alphabet, readable over a phone call)
- Frozen snapshot of the evidence pack at the moment of creation: new findings tomorrow won’t change what the recipient sees in a link they bookmarked today
Redaction levels
| Level | What’s included |
|---|---|
| Summary only (default) | Counts, per-control metrics, coverage status. No sample findings, no IPs, no titles. Safest for prospects + customers. |
| With samples | Adds up to 5 sample-finding titles per control, but the asset identifier (IP / product) is stripped. Use when an auditor needs concrete examples. |
The snapshot is server-side redacted at share time, then stored. The recipient cannot escalate to a fuller view by manipulating the client.
What to use it for
- Customer security review. Adidas’s procurement team asks how Convert.com does vulnerability management. Convert pastes the share URL + password into the reply.
- Cyber-insurance renewal. Underwriter wants evidence of continuous scanning; share the last 90 days.
- SOC 2 / ISO 27001 audit fieldwork. Auditor reviews the evidence pack remotely without an Umbra account.
- DPA reviews (GDPR Article 32). EU DPA reviewer can verify the technical-measures evidence on demand.
Why it matters
Today the same conversation happens dozens of times per year for a mid-market SaaS: a customer’s security team emails a questionnaire, the vendor writes prose, attaches screenshots, and hopes the answer satisfies them. With this, the vendor sends one URL. The recipient sees real numbers from a real system, not a marketing page.
Why it’s valuable
- Snapshot is stable. A link bookmarked today shows the same numbers tomorrow even if your workspace changes. Evidence isn’t supposed to move.
- Password gate + rate limit. 10 wrong attempts per token per IP per hour. The URL alone isn’t enough.
- Mandatory expiry. Default 90 days, capped at 1 year. No unbounded shares.
- Revocable. One click; the URL stops working immediately.
- View telemetry. The management list shows view count + last- viewed time so the operator knows whether the link was opened.
- Audit-logged. Every create + revoke writes to the audit log with actor + parameters.
- org_admin gated. Only admins can mint shares: the artefact represents the workspace.
How to use it
- Compliance in the left nav.
- Pick a framework + period (same as for generating an internal pack).
- Click Share publicly → in the action row.
- Pick redaction level (summary-only is the default), expiry window, optional label.
- Click Create share. The URL + password appear once. Copy both immediately.
- Send to the recipient via your normal channel (email + chat).
The recipient opens the URL, enters the password, sees the pack.
The Active shares panel on /compliance shows view counts and
lets you revoke any time.