Everything you record in the tracker can come back out — as assessor-ready documents or as a complete data export. Nothing is ever gated on export: the SSP, POA&M, evidence, and database exports are complete on both the free and desktop versions, so your data is never trapped.
All of the following live in the upper-right navigation menu.
Generate Report — your SSP
Generate Report downloads a markdown document covering every requirement's implementation status and your notes, with optional embedded evidence — the working core of a System Security Plan. Because it's markdown, it drops cleanly into whatever your documentation lives in: convert it to Word or PDF, paste it into a wiki, or track it in git.
The notes you write per requirement become the SSP body, so the report is only as good as your notes — write them as you assess and the SSP largely writes itself.
Generate POA&M
Generate POAM downloads a spreadsheet-ready CSV of your gap items — every requirement that isn't fully implemented — with standard Plan of Action & Milestones columns for owners, milestones, and completion dates to fill in.
Export / Import Database
Export Database saves your entire workspace — statuses, notes, evidence, and Examine checklist selections — as a single versioned JSON file. Import Database restores one, replacing what's currently in the app. Use it for:
- Backups. Your data lives only on your device, so exports are your backup strategy — see the FAQ for why this matters especially in the browser.
- Moving between versions. The browser and desktop apps keep separate data; export from one, import into the other.
- Per-client workspaces. Consultants can keep each engagement as a single JSON file and import the one they're working on.
- Archival. A dated export is a point-in-time record of your compliance posture.
Imports accept files from the same or older app versions. Importing overwrites the current workspace — the app asks for confirmation first, so export the current state before importing if you need it.
Evidence downloads and post-processing
Download Evidence saves every artifact as files, and Download Evidence Map saves the JSON index linking artifacts to requirements (with SHA-256 hashes). Since downloads land in your browser's download folder as flat files, the source repository provides post-processing scripts (bash, PowerShell, and Node) that use the map to:
- Sort evidence into per-requirement folders — e.g.
03/01/01/access-control-policy.pdf— matching the paths the generated SSP references. - Generate a markdown evidence report — an index of all evidence by requirement, ready to include in an assessment package.