Compliance Reports
Generate audit-ready compliance reports mapped to SOC 2, ISO 27001, PCI DSS, and GDPR.
Nolax turns your monitoring data into reports you can hand to an auditor.
Before you start: monitored standards
Before running compliance workflows, select standards in Settings → Monitored Standards.
Your monitored standards are used by:
- Posture and controls views
- Compliance report generation
- Scheduled reports
- Monitoring context shown for each standard
If no standards are enabled, report screens send you back to Settings.
What is in a compliance report
A compliance report is a PDF built from your monitoring data and organised by audit control. It shows that your monitoring was running during the report period. It is not a certificate of compliance.
Each report includes:
- Executive summary (AI-written, posture score)
- Standards control mapping (clause numbers, evidence, status)
- API risk classification
- Request volume and error analysis
- Security insights (AI-written, access patterns)
- Alert monitoring status
- AI forecasting status
- Incident timeline
- Recommendations (AI-written, grounded in your data)
- Data retention statement
Supported standards
| Standard | Coverage |
|---|---|
| SOC 2 Type II | CC7.2, CC7.3, CC6.1, A1.1 |
| ISO 27001:2022 | A.8.15, A.8.16, A.5.28 |
| PCI DSS v4.0 | 10.2.1, 10.4.1 (see note below) |
| GDPR | Article 32, Article 33 |
How your plan affects standards selection
| Plan | Standards selection during report generation |
|---|---|
| FREE | Standards selection unavailable |
| PRO | Exactly one standard |
| BUSINESS | One or more standards |
PCI DSS retention gap: PCI DSS Requirement 10 requires 12 months of log retention. Nolax keeps request detail for 90 days at most (Business plan). If you select PCI DSS, the report flags this gap. Do not present a Nolax report as PCI DSS evidence until you cover the gap another way.
Scope boundary
Nolax covers API activity monitoring and audit trail controls. It does not cover:
- Identity and access management (IAM)
- Web application firewall (WAF)
- Vulnerability scanning
- Request or response body inspection
Every report states this boundary.
Plan limits
| Feature | FREE | PRO | BUSINESS |
|---|---|---|---|
| Report type | Operational summary | Full compliance | Full compliance |
| Standards per report | None | 1 | All 4 simultaneously |
| Max report period | 7 days | 30 days | 90 days |
| Scheduled reports | No | No | Yes |
| Report history | Last 5 | Last 10 | Unlimited |
Generating a report
Go to Compliance → Reports → Generate report.
- Select the date range for the report period
- Select the standard(s) to include (PRO: one, BUSINESS: multiple)
- Click Generate
Generation takes 30 to 90 seconds. Nolax notifies you when the PDF is ready. The report stays available for download within your history limit.
Scope each report to one project so it describes one operational context.
Posture score
The posture score on the Compliance page runs from 0 to 100. Nolax recalculates it every 15 minutes from five dimensions:
| Dimension | Weight | Green condition |
|---|---|---|
| Monitoring coverage | 25% | All APIs have alert rules |
| Performance (SLA) | 25% | p95 latency < 1000ms |
| Forecasting accuracy | 20% | Forecast engine active and accurate |
| Incident resolution | 15% | Alert events resolved within 1 hour |
| Security compliance | 15% | After-hours traffic < 80% |
The Performance and Forecasting dimensions score 0 until Nolax has snapshot data. They start scoring after about 3 hours of SDK traffic.
For how the score, the checks and the evidence retention work, see How Compliance Scoring Works.