Compliance Reporting

Atlas provides compliance reports built on top of audit log data, PII classifications, and user session history. Reports help answer audit questions like "who accessed what data, when, and how often" — a requirement for SOC2, HIPAA, and similar frameworks.

Report Types

Data Access Report

Answers: Who queried what tables, when, and how often?

Each row represents a unique (table, user) pair within the selected date range:

The report summary includes total queries, unique users, unique tables, and PII tables accessed.

User Activity Report

Answers: What has each user been doing?

Each row represents a single user:

API Endpoints

Both endpoints are mounted under /api/v1/admin/compliance/reports/.

GET /reports/data-access

curl -H "Authorization: Bearer $TOKEN" \
  "https://your-atlas.com/api/v1/admin/compliance/reports/data-access?startDate=2026-01-01&endDate=2026-03-01"

GET /reports/user-activity

curl -H "Authorization: Bearer $TOKEN" \
  "https://your-atlas.com/api/v1/admin/compliance/reports/user-activity?startDate=2026-01-01&endDate=2026-03-01"

Query Parameters

Export Formats

JSON (default)

Returns a structured JSON object with rows, summary, filters, and generatedAt fields.

CSV

Set format=csv to download as a CSV file. The response includes Content-Disposition headers for browser download. CSV follows RFC 4180 escaping rules.

# Download CSV
curl -H "Authorization: Bearer $TOKEN" \
  -o data-access-report.csv \
  "https://your-atlas.com/api/v1/admin/compliance/reports/data-access?startDate=2026-01-01&endDate=2026-03-01&format=csv"

Admin Console

The compliance page in the admin console (/admin/compliance) has two tabs:

1. PII Classifications — Review and manage detected PII columns (see PII Masking guide)
2. Reports — Generate compliance reports with a visual interface

The Reports tab provides:

• Date range picker (defaults to last 30 days)
• Report type selector (Data Access / User Activity)
• Filter controls for user, role, and table
• Results table with detailed breakdown
• Export buttons for CSV and JSON download

All filter state is persisted in the URL via query parameters, so reports are shareable and bookmarkable.

How Reports Query Data

Reports run pure SQL against the internal database. No external services are required.

• Data Access Report queries audit_log with a CROSS JOIN LATERAL on tables_accessed (JSONB array), joined with the user table for email resolution. Role data is enriched from the member table, and PII status is enriched from pii_column_classifications, both via separate concurrent queries.
• User Activity Report queries audit_log grouped by user, joined with the user table for email. Last login timestamp is enriched from the session table, and role information from the member table, both via separate concurrent queries.

Both reports only include successful queries (success = true) and respect the org isolation boundary (org_id).

Related

• PII Detection & Masking — auto-detect and mask PII columns
• Audit Log Retention — configure retention policies and export raw audit logs
• Custom Roles — define roles for role-based report filtering