One command

hexr audit

$ hexr audit --framework hipaa --tenant pivot-demo --period 24h
→ pivot-demo-hipaa-2026-09-19.pdf
   7,692 evidence rows · chain intact · 7,676 signatures valid · 0 invalid
   every page carries the row ids it was built from

Control map — what the rows on the Evidence page satisfy

hexr audit --framework soc2 | hipaa | iso42001

Framework	Control	Evidence	Rows (24h)
HIPAA	164.312(b)	Audit controls — hash-chained, signed record of every agent action on claim data	7,692
HIPAA	164.312(a)(2)(iv)	Encryption and decryption — credentials issued per process, expire in minutes, never stored	5
HIPAA	164.308(a)(6)(ii)	Response and reporting — the appeal artefact, its author process, and when it was written	5
SOC 2	CC6.1	Logical access — agent-to-agent calls authenticated by process identity, not network position	1,565

It is not a summary you wrote. Every page is checkable against the original signed record, and the auditor can run GET /v1/evidence/verify themselves.

A regulator, not just SOC 2

HIPAA's audit-controls rule asks for a record of activity on systems that hold protected health information — and asks it of the covered entity, not the vendor. Four agent processes touched claim data today. Each row on the Evidence page names the process, the time, and carries its signature; the appeal itself sits in the tenant's own bucket with the row that wrote it. That is the record, already kept.