Compliance Policy Engine
PurpletGo's Compliance Policy Engine lets you enable one or more compliance frameworks for your organization, track the status of each framework's controls, and attach evidence - manual or pulled automatically from your audit log - to prove those controls are being met.
The Compliance Policy Engine is available from the Team plan up. Viewing frameworks and controls requires the Super Admin, Admin, or HR role; enabling frameworks, updating controls, and managing evidence requires the same three roles as well (there's no separate "view only" role split here).
Enabling a framework
Go to Settings → Compliance and enable a framework. PurpletGo supports:
- SOC 2
- HIPAA
- GDPR
- ISO 27001
- PCI DSS
- Custom (bring your own control set)
Enabling a framework seeds a starter set of controls for it automatically. If you disable a framework later, it's soft-disabled (its enabled flag flips to false) rather than deleted - re-enabling it later picks the same framework record back up along with any evidence and control status you'd already recorded.
Controls
Each framework's controls page lists every control with a reference code (e.g. CC6.2 for SOC 2, 164.308(a)(3)(ii)(C) for HIPAA), a title, a category, and a status:
| Status | Meaning |
|---|---|
not_tested | No evidence collected yet |
in_progress | Evidence collection has started |
compliant | The control is met |
non_compliant | The control is failing |
You can filter the controls list by framework or by status, and update a control's status and notes directly from the list. Every update is timestamped and attributed to whoever made it.
Evidence
Each control can carry evidence of type audit_log, revocation, document, note, or other. You can attach evidence manually - give it a title, some content, and optionally a link to a file (must be an https:// URL) - or let PurpletGo collect it for you.
Auto-collect
Clicking Auto-Collect Evidence on a framework pulls recent audit log entries - things like access revocations, offboarding completions, checklist items, document signatures, and SCIM or Azure AD deprovisioning events - and matches them against a built-in mapping of audit actions to controls for that framework. Matching entries are attached as evidence (up to five per control per run, and PurpletGo won't attach the same entry twice). If a control was still not_tested and evidence was found for it, its status automatically moves to in_progress - it doesn't get marked compliant for you; that judgment call is still yours.
Exporting a report
From a framework's page, Export Report downloads a JSON file containing the framework's summary (total controls, how many are compliant/non-compliant/not-tested, and a completion percentage) plus every control and its attached evidence. There's no PDF or CSV export for this report - it's JSON only, intended to be handed to an auditor or fed into another system.
Security incident log
Separately from the policy engine, Settings → Security Incidents gives Admins and Super Admins a place to log security incidents and data breaches for GDPR Article 33/34 purposes - HR does not have access to this log.
Logging an incident requires a severity (low, medium, high, or critical) and a description of at least 10 characters; you can optionally note which users were affected. Once logged, you can update an incident with a reported-at date, a resolved-at date, whether the data protection authority was notified, whether affected users were notified, and free-form notes - each update is recorded in the audit log.
There's no automatic 72-hour countdown or notification workflow built around this - it's a structured log you fill in yourself as you work through your breach response process.