---
title: "Evidence Export"
description: "Export compliance evidence to cloud-native audit tools and GRC platforms."
---

import { Aside } from '@astrojs/starlight/components';

Push compliance evidence directly into your existing audit toolchain.

## Export formats

| Format | Flag | Tier | Description |
|---|---|---|---|
| SCC JSON | `--format=scc-json` | Team+ | Google Security Command Center findings |
| Audit Manager | `--format=audit-manager` | Team+ | AWS Audit Manager evidence |
| Purview | `--format=purview` | Team+ | Microsoft Purview Compliance Manager |
| Vanta | `--format=vanta` | Agency | Vanta integration (file or API) |
| Drata | `--format=drata` | Agency | Drata integration (file or API) |
| Secureframe | `--format=secureframe` | Agency | Secureframe integration (file or API) |
| GRC JSON | `--format=grc-json` | Community+ | Generic GRC interchange format |

## Cloud-native export (Team+)

Export findings directly to your cloud provider's audit service.

```bash
# Google Security Command Center
complyform export --format=scc-json \
  --input=findings.json \
  --project=my-gcp-project \
  --source=organizations/123456/sources/789

# AWS Audit Manager
complyform export --format=audit-manager \
  --input=findings.json \
  --assessment-id=a1b2c3d4-5678-90ab-cdef-111111111111

# Microsoft Purview
complyform export --format=purview \
  --input=findings.json \
  --tenant-id=a1b2c3d4-5678-90ab-cdef-222222222222
```

## GRC platform export (Agency)

Export to third-party GRC platforms. Generate a file for manual upload or push directly via API.

```bash
# File export for manual upload
complyform export --format=vanta \
  --input=findings.json \
  --output-file=vanta-evidence.json

# Direct API push
complyform export --format=drata \
  --input=findings.json \
  --api-key=$DRATA_API_KEY \
  --push
```

## Batch export

Export to multiple formats in one invocation (Agency tier).

```bash
complyform export --format=scc-json,vanta,grc-json \
  --input=findings.json \
  --output-dir=evidence/
```

This writes one file per format into the `evidence/` directory: `evidence/scc-json.json`, `evidence/vanta.json`, `evidence/grc-json.json`.

## Signed attestations

Generate a cryptographically signed attestation for point-in-time compliance evidence.

```bash
# Generate signed attestation during assessment
complyform assess --frameworks=soc2 --attest --output-file=soc2-attestation.json

# Verify an existing attestation
complyform verify --attestation=soc2-attestation.json
```

The attestation includes the assessment timestamp, framework version, resource inventory hash, and an Ed25519 signature. Auditors can verify the attestation independently without access to your infrastructure.

<Aside type="note">
Credentials for API push (`--api-key`, cloud service account keys) are read from environment variables or CLI flags. ComplyForm never writes credentials to disk.
</Aside>

## Next steps

- [`complyform export`](../../cli-reference/export/) — full export options and format details
- [`complyform assess`](../../cli-reference/assess/) — assessment with `--attest` flag
- [Air-Gapped Environments](../air-gapped/) — offline evidence generation
