Compliance — Forage Docs

Overview

Click 🛡️ Compliance in the sidebar to open the Compliance view. For each framework you select, Forage analyzes your project's actual structure — files, components, and annotations already indexed in the knowledge graph — and produces a domain-by-domain assessment with a risk rating and concrete, evidence-based findings.

Seven frameworks are supported:

Framework	Full name
🔐 SOC 2	SOC 2 Type II
🛡️ ISO 27001	ISO/IEC 27001:2022
🇪🇺 GDPR	General Data Protection Regulation (EU/UK)
🏥 HIPAA	HIPAA Security Rule (45 CFR Parts 160/164)
💳 PCI-DSS	PCI Data Security Standard v4.0
🏛️ NIST CSF	NIST Cybersecurity Framework 2.0
📊 SOX	Sarbanes-Oxley Act — IT General Controls

NOTE: This report is generated from automated analysis of the project's knowledge graph, source code structure, annotations, and documentation. It is intended to assist compliance efforts and surface evidence already present in the codebase. It does not constitute a formal audit or legal compliance certification. Engage qualified compliance professionals before using this report in formal assessments.

Generating a report

Check the box next to each framework you want assessed in the left-hand panel (SOC 2 is checked by default).
Choose a detail level: summary (1–2 sentences per sub-section), standard (3–5 sentences, the default), or detailed (thorough, with specific file/component references and concrete recommendations).
Click Generate Report.

Forage processes one framework at a time, showing a live progress row for each. For every framework it gathers the relevant graph context (project summary, files, components, annotations) and asks the configured AI model to assess each domain of that framework, assigning a risk level — Low, Medium, High, or Critical — based on evidence present or absent in the code.

Report generation calls your configured AI model, same as the Code Assistant and AI Chat. See Configuration to set it up if you haven't already.

Reading a report

A generated report opens with a cover page and a table of contents linking to each selected framework's section. Each framework section includes:

An overall risk badge and a 2–3 paragraph executive summary — posture, strengths evidenced in code, and priority gaps.
One expandable block per control domain, each showing:
- Assessment — the current posture for that domain
- Evidence in Codebase — specific files and components the assessment is based on
- Gaps & Recommendations — concrete, actionable next steps

Click a domain header to expand or collapse its detail.

Saving & regenerating

Forage keeps one current report per workspace — it's saved automatically after generation and reloads the next time you open the Compliance view, along with which frameworks and detail level produced it and when. Click Generate Report again at any time to refresh it against the current state of your codebase; the new report replaces the saved one.

Exporting

Use the export menu to download the current report as:

Format	Notes
Markdown (.md)	Converted from the rendered report
HTML	Standalone file with styling included
DOCX	Opens directly in Microsoft Word
PDF	Print-formatted output
Google Docs	Creates a new Google Doc directly in your Drive

HTML, Markdown, DOCX, and PDF export entirely locally — no network request leaves your machine. Google Docs export is the exception: it requires a one-time Google OAuth setup, shared with Documentation's Google Docs export. See Configuration → Google to enable it.