Releasing a report and its language

Generate, then release

Producing a deliverable is two steps, on purpose. First you generate a report for a milestone, which runs a job and produces the file (through the isolated rendering sidecar). Then you release it, which is the moment it becomes visible to the client through the portal. A generated report that is not released is internal; only released reports reach the client, scoped to the client they belong to.

The release checkpoint

Releasing runs a short review of the report's compliance mappings, finding by finding, before you confirm. It is a review, not a gate: the DPO or lead passes an eye over the composed map and proceeds. On release the report freezes, capturing the published finding revisions, the compliance mappings and their provenance, and the remediation due dates as they stand, so the delivered report keeps stating what it stated even as the findings keep evolving (see Reports). Withdrawing and releasing again re-freezes from the current state.

Language

A report is generated in the engagement's report locale (for example Portuguese or English). The locale governs the report's own wording, including the compliance line and its provenance. Choose the locale to match the client who reads it.

Generating a retest summary

The retest summary is generated like any other document, and it is a kind of its own rather than a format: always PDF, and always tied to the full report it summarises, whose identifier, format, date and hash it prints (see Reports). Generate it after the retest cycles you want it to reflect, and release it the same way you release any other document.

Withdrawing the full report takes the released summaries of that engagement with it, so plan the order: if a correction forces you to withdraw and re-release the full report, the summaries have to be released again afterwards.

An externally signed PDF

PEART does not sign documents and does not verify legal signatures. When a released PDF is signed by an external authority, the signed file is imported and stored as an artifact of its own, with its own hash, attached to that document. From then on the portal serves the signed file to the client instead of the one PEART produced, because that is the copy that carries the signature. Import is an administrator's gesture and only applies to a document that is already released.

Delivering to the client

The client reaches released reports through the portal, over an authenticated, scoped, TLS channel, rather than by email. A report profile governs what the client's view shows. Each released milestone (the official report, interim retest reports, the final report) is downloadable there, so the whole set of deliverables lives in one controlled place instead of scattered attachments.