Compliance
The Compliance page (main navigation, under Compliance & Governance) has two tabs:
- Documents - the compliance documents (NDAs, exit interviews, agreements) and legal holds for each offboarding.
- Policy Engine - a control checklist for the compliance frameworks you follow, with evidence attached to each control.
The Policy Engine tracks your own assessment of each control. It does not certify you: a percentage in PurpletGo is the share of controls you have marked compliant, not an auditor's opinion.
Documents
Each offboarding shows its documents, their status (pending, signed, completed), and badges for NDA and exit interview progress. Documents past their expiry date are marked Expired.
- Add Doc creates a document. If you choose a file, it is uploaded and the document is created in one step.
- Files lists the offboarding's stored files. Each one opens through a link that is valid for one hour.
- Every change to a document (status, signer, dates) and every deletion is written to the audit log with the old and new values.
Viewing documents needs the compliance_view permission (Super Admin, Admin, HR, and Manager by default). Adding, editing, or deleting them needs compliance_manage (Super Admin, Admin, and HR by default). The summary cards follow the same department scope as the offboarding list.
Legal holds
Admins and Super Admins can place an offboarding under legal hold. A reason is required, and placing or lifting a hold is recorded in the audit log together with the reason.
While a record is under hold:
- it cannot be deleted, on its own or in a bulk delete (held records are skipped and reported)
- its compliance documents and files cannot be deleted
- a data erasure request for it cannot be approved or executed
- the retention policy does not anonymize or delete it
- the organization cannot be scheduled for deletion, and a scheduled or automatic organization deletion is postponed (owners and admins are emailed) until every hold is lifted
A hold does not freeze edits: document statuses and dates can still be updated, and each change is audited.
Policy Engine
The Policy Engine is available from the Team plan up, for the Super Admin, Admin, and HR roles.
Frameworks
Enable one or more frameworks:
- SOC 2 (Trust Services Criteria 2017)
- HIPAA Security Rule
- GDPR
- ISO 27001:2022 (Annex A)
- PCI DSS v4.0
Enabling a framework adds the controls that relate to offboarding and access removal - it is not the full standard. Disabling a framework hides it but keeps its controls, statuses, and evidence; enabling it again brings them back.
Controls
Each control has a reference (for example CC6.2 for SOC 2 or A.5.11 for ISO 27001), a title, a category, and a status:
| Status | Meaning |
|---|---|
not_tested | Not assessed yet |
in_progress | Evidence collection has started |
compliant | You have assessed the control as met |
non_compliant | You have assessed the control as not met |
not_applicable | The control is out of scope for you |
The percentage shown is compliant controls divided by all controls except the not-applicable ones. Every status change is timestamped, attributed, and audited.
Evidence
You can add evidence of type document, note, or other, with a title, text, and optionally an https:// link. The types audit_log and revocation are only created by auto-collect.
Auto-Collect Evidence matches recent activity to controls: access revocation results, checklist completion, signed documents, asset returns, SCIM and Azure AD deprovisioning, and data retention runs and erasures (for GDPR storage limitation and right to erasure). It adds up to five items per control per run and never adds the same item twice. A control that was not_tested moves to in_progress when evidence is found; it is never marked compliant for you.
When a person's data is erased, their name and email are replaced with [erased] in evidence linked to their offboarding. Evidence copied from the audit log keeps the person's details encrypted, as the audit log does, so they read [erased] there too (Data Retention: the audit log).
Export
Export checklist (JSON) downloads the framework summary, every control with its status, and its evidence. There is no PDF or CSV export.
Security incident log
The security incident log exists only in the API (server/routes/securityIncidents.js); there is no page for it in the dashboard yet.
Admins and Super Admins can log security incidents and data breaches for GDPR Article 33/34 through the API. An incident needs a severity (low, medium, high, or critical) and a description of at least 10 characters, and can later be updated with reported and resolved dates, whether the authority and the affected users were notified, and notes. Each update is audited. There is no automatic 72-hour countdown.