Compliance evidence
What the platform records for an audit and how to hand it over: the audit and system audit logs, their export and retention, archive checksums, configuration snapshots, scheduled reports, and the standards XPLG itself attests to.
What you will do: assemble the evidence an audit asks for — who did what, when, from where, and proof the record is complete and unaltered — and answer the questions about XPLG's own posture.
Two kinds of evidence are involved. Evidence from the platform is the activity it collected and the activity on the platform itself. Evidence about the platform is what XPLG attests to as a vendor. The wiki documents both; this page maps them to what an auditor asks.
Evidence the platform produces
| Record | Content | Where |
|---|---|---|
audit log | every user operation from sign-in on — identity, timestamp, action, result, source — including the federated groups resolved at sign-in | Support Portal (administrators), or ingested as a log and searched like any other |
system audit log | everything the server did: collection, indexing, monitor executions, dashboard generation | same |
| Collected logs | the raw copy is never altered by parsing or enrichment and can be exported raw | Search, Log Viewer, export |
| Archive | compressed copies with an MD5, SHA1 or SHA-256 checksum compared on every run; tampering raises an alert | Collection Policy; see Collection policies and archive |
| Configuration snapshots | the full configuration as versioned exports, for backup, rollback, cloning and audit evidence; daily backups kept 30 days | EXTERNAL_CONFIGURATION_DIRECTORY/temp/backups/ |
| Monitor history | executions and alerts as logs (logtype.executions, logtype.alerts) | dashboards, Search |
| Reports | dashboards exported as PDF or CSV on a schedule, by email or to a file with retention | Dashboards |
| Access model | users, groups and policies with per-folder, log and App permissions; privileged activity separately logged and alerted | Security settings; see Security posture |
Audit logs can be kept as long as needed and exported to Syslog, AWS CloudWatch Logs and GCP Cloud Logging. LogX anomaly detection can be pointed at the platform's own audit logs to watch privileged activity. The wiki also states the governance practices XPLG expects around the access model — periodic access-rights reviews and joiner, mover and leaver revocation — as practices, not as records the platform produces.
Steps: an evidence pack
- Confirm the audit logs are ingested as logs under an AppTag the reviewers may read.
- Build the searches the control asks for — who accessed a data set, who changed a policy, which accounts were created or removed in the period — and save them with a severity; see Identity timeline.
- Put them on a dashboard with a User Input for the review period and an export scheduler to PDF and CSV with the retention the control requires.
- Record the Collection Policy of the evidence logs: hot and archive retention, checksum algorithm, archive location.
- Export a configuration snapshot at the end of the period.
- For the vendor questionnaire, attach the statements below.
Standards XPLG attests to
| Standard or regulation | Status stated by XPLG |
|---|---|
| ISO/IEC 27001 | certified ISMS covering development and operations |
| FIPS 140-2 Level 2 | Java JCE cryptographic modules "in accordance with" the level; no certificate is claimed |
| EU GDPR | supported by architecture: personal data never leaves the customer environment; a Data Protection Officer is appointed |
| Israeli Privacy Protection Law and Regulations 5777-2017 | compliant, including the data-security regulations |
| SOC 2 (AICPA) | not applicable in standard scope: no hosted customer data; an ISO 27001 to Trust Services Criteria mapping and a signed applicability letter are available |
| FedRAMP | not applicable to self-hosted software; NIST SP 800-53-mappable documentation supports the agency's own authorization |
| EU DORA | readiness program for ICT third-party provider obligations |
| OWASP, ISO 27034, NIST SP 800-64 | the frameworks governing the secure development lifecycle |
| Banking supply chain | assessed under Israeli banking-supervision-derived questionnaires and enterprise third-party risk programs |
Support access to a customer environment, when granted, is VPN-only, MFA-enforced and fully logged. These statements cover the self-hosted platform; dock.xplg.com is a hosted portal scoped separately under Security and compliance.
SOX, PCI-DSS and other frameworks
The wiki names no SOX or PCI-DSS mapping. The records above are the raw material for those programs too, but a published control mapping is pending from XPLG engineering; ask support for the current questionnaire answers.
Next: Enrichment
Source: XPLG wiki, pages 1594132942, 1594132940, 3161751578, 3161849908, 3161489438, 3161587738, 3161489464, 1594132976, 1597539357, 1594133710, 1595637833, 3161489481, 2377023584 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/3161751578).
