How Compliance Scoring Works

Nolax produces evidence and figures from your monitoring data. It does not make you compliant, and it is not an auditor or a certification body.

The posture score

The score is the weighted share of passing controls among the automated controls that are either passing or failing, rounded to a whole number. Every control currently has the same weight.

• A control without enough data is listed but left out of the score
• Manual controls and client attestations are never scored, and an attestation never raises the score
• With no scorable control, the score is empty and the label reads "not enough data"

| Score | Label | | --- | --- | | 80 or more | Stable | | 50 to 79 | Degraded | | Below 50 | Critical |

The trend compares today with the stored value from the day before, and moves only when the score differs by more than 5 points.

The six checks

| Check | What it tests | | --- | --- | | Monitoring continuity | Each production API with steady traffic has monitoring snapshots (taken every 15 minutes) in at least 95 percent of its 15-minute periods, after leaving out periods a recorded maintenance window explains | | Telemetry gaps | No such API has an unexplained gap of 3 or more consecutive missing 15-minute periods (over 30 minutes) | | Alert coverage | Every production API classed as high risk has at least one enabled alert | | Incident acknowledgement | Every alert breach older than 60 minutes was acknowledged within 60 minutes of being triggered | | Incident closure | Every alert breach older than 24 hours was resolved within 24 hours, with a resolution note of at least 8 characters | | Record retention | Nolax keeps request detail and monitoring evidence for at least as many days as the control requires |

Breaches still inside their 60 minute or 24 hour window are not judged yet. Record retention describes what Nolax keeps, not your own audit log.

How risk is classed

Alert coverage uses the method and path. Sign-in, payment, checkout, admin, delete and user routes, and the DELETE method, are high risk. POST, PUT and PATCH, create and update routes, and paths under /api/ are medium. Anything else is low.

Why quiet APIs are not judged

The continuity and gap checks judge only APIs older than 24 hours that have snapshots in at least half of their 15-minute periods. For a quiet API, a monitoring failure and a lack of requests look the same, so judging it would produce false failures. When no API qualifies, the result is "not enough data".

Maintenance windows

You can record a window with a start, an end, a reason of 8 to 500 characters and optionally one project. A window lasts at most 14 days and must start within 90 days of today. Gaps fully inside a window are left out and listed with who recorded the window and when. A window recorded after it ended is labelled "recorded after the fact", with the number of days late, in the API and the report.

Attestations

For controls Nolax cannot test, such as SOC 2 A1.1 and GDPR Articles 32 and 33, you record an answer (yes, partly or no), a note and a valid-until date up to 400 days ahead. The control shows your statement until that date passes. It is never scored.

Evidence retention

Nolax keeps compliance evidence (alert events, compliance events, the audit log, daily posture records, reports, maintenance windows and attestations) for at least 400 days on every plan. Other retention depends on the plan:

| Plan | Monitoring snapshots | Request detail | | --- | --- | --- | | Free | 90 days | 7 days | | Pro | 400 days | 30 days | | Business | 400 days | 90 days |

PCI DSS requirement 10.5.1 asks for 90 days of detail and 365 days of evidence. The retention check therefore fails on Free and on Pro, and passes on Business. This is a plan gap, not a configuration error you can fix.

Standards and review status

Nolax maps controls for SOC 2 (2017), ISO 27001 (2022), PCI DSS 4.0 and GDPR (2016/679). Every mapping is a working mapping by Nolax and has not been reviewed by a qualified person. Clause titles and guidance are in our own words, not quoted from the standards.

Verifying a report

Every ready report has a public id and two stored SHA-256 hashes, one for the PDF and one for the evidence data. To check a report you hold, compute the SHA-256 of the PDF and call GET /verify/<publicId>?hash=<sha256>. The answer is valid or not valid, with only the report type, period and generation date.

Control results export

GET /compliance/controls/export.csv returns one row per evidence item with the columns Standard, Version, Clause, Control, Status, Check, Check result, Summary, Evidence item, Evidence value, Evaluated (UTC) and Evaluated (WAT). A manual control has one row with the guidance or your statement.

Scope and times

• Control results in a report cover the selected project. The dashboard covers the whole company
• Times default to West Africa Time (WAT, UTC+1) in the app, reports, emails and messages. The API and the database store UTC
• Forecast accuracy is scored per metric at the 6-hour horizon: the projected value against the value observed then. Forecasts still open are left out
• Every report ends with a disclaimer: it describes what was measured and is not legal, audit or compliance advice