Monthly Audit Pack

An Audit Pack is a cryptographically signed monthly evidence bundle your auditor expects for NIS2 + CRA + ISO 27001. One file instead of 17 dashboards.

What’s in it

Per tenant per calendar month:

/var/lib/monsys/audit-packs/<tenant_id>/2026-04.jsonl.gz   ← machine-readable
/var/lib/monsys/audit-packs/<tenant_id>/2026-04.pdf        ← human-readable
/var/lib/monsys/audit-packs/<tenant_id>/2026-04.sig        ← Ed25519

JSONL.gz: trust_score_snapshot, emergency_token, console_session, cve_fix_landed, alert, agent, ai_evidence_pack_ref.

PDF: cover page, Trust Score breakdown, compliance coverage matrix, KEV CVE table, EAT log table, verify appendix.

Offline verification

Auditor needs nothing but the files + our public key. No runtime access to monsys.ai.

curl -fsSL https://get.monsys.ai/monsys-verify-pack-linux-x64 -o monsys-verify-pack
chmod +x monsys-verify-pack
./monsys-verify-pack 2026-04.jsonl.gz --pubkey <hub-pubkey-hex>

Cadence

AuditPackWorker runs on the 1st of each month at 02:00 UTC. Idempotent.

API

GET /api/v1/audit-packs
GET /api/v1/audit-packs/:id/download?format=jsonl|pdf|sig

Requires auditor or admin role.