Two reports leave TRUSTIVAN as files: a per-framework evidence report and an executive summary. Both name your organization, state when they were generated, and are produced from the same data the dashboard shows. Both need assets:read.

​
Per-framework evidence report

In the dashboard: Compliance, pick a framework, then Download CSV or Printable report (PDF). Over the API:
Framework IDs are soc2, iso27001, pci-dss, nist-ssdf and eu-cra. The report carries one row per control: its framework identifier, its title, its status, the number of open issues, the capabilities that bear on it, the per-capability evidence, and the note explaining what TRUSTIVAN does and does not observe for it. Before the rows, comment lines (#) carry the organization name, the framework and its version, both timestamps, the disclaimer, and the summary counts — including controls_not_covered.

​
Executive summary

The one page for a risk review: open findings by severity, how many are on the known-exploited catalogue, how many have a fix available, what opened and resolved in the last 30 days, mean time to resolve, and the assets to look at first. In the dashboard it is the first card on Compliance, with the same two download buttons.
Every figure is read from the same aggregates as GET /api/v1/stats and GET /api/v1/stats/posture, so the report you forward and the overview your engineers work from cannot disagree. mttr_hours is null when nothing was resolved in the window. Zero would claim instant fixes. There is no SLA or remediation-target figure. TRUSTIVAN does not record a remediation target, and a report that invented one would be grading you against a policy you never wrote.

​
Why there is no PDF format

format=html is a print-optimised page — A4 page size, print CSS, no page break inside a table row. To produce a PDF, open it and use your browser’s Print → Save as PDF. A server-side PDF would mean carrying a PDF rendering library for a document every browser can already print. The dependency is not worth it, and calling the HTML a PDF would be worse.

​
What the report does not claim

Every rendering carries the framework’s disclaimer in full. TRUSTIVAN maps observed evidence to a framework’s controls; it does not assess, certify or attest compliance. No control is ever reported as satisfied. That conclusion is your auditor’s, and the report is the evidence you hand them.