Skip to content
ComplyMynt

Sample report

A report your board and your engineers can both use.

Below is the report structure, scorecards, and example findings. Everything shown here is an illustrative sample built to demonstrate our methodology — it is not client data.

Request the full PDF Book a scoping call
pages
24–60

pages

business days
10–15

business days

severity scoring
3-axis

severity scoring

evidence-backed
100%

evidence-backed

Preview of a ComplyMynt audit report showing the executive summary and scored findings register
Illustrative excerpt — severity scoring, evidence links, and the remediation backlog are included in the full document.

Scorecards

Domain scores, with the evidence behind every number

Scores are recalculated on each re-scan so you can show progress rather than assert it.

0

Privacy & consent

12 findings

0

Accessibility

9 findings

0

Public security

4 findings

0

AI governance

7 findings

Structure

What is inside every report

  1. 1. Executive summary

    One page. Posture, top three exposures, and the recommended sequence of work.

  2. 2. Scope & method

    Surfaces tested, jurisdictions considered, tooling used, and explicit exclusions.

  3. 3. Compliance scorecards

    Domain-level scores with the evidence behind each number, trended across re-scans.

  4. 4. Findings register

    Each finding scored by likelihood, exposure, and remediation cost, with evidence attached.

  5. 5. Remediation backlog

    Written as tickets: owner, acceptance criteria, effort estimate, and regression test.

  6. 6. Monitoring plan

    What to re-verify, how often, and which signals indicate drift.

Example findings

Example entries from the register

Expand any finding to see the evidence attached and the remediation we would ship.

CM-014CriticalConsent

Analytics and ad trackers fire before consent

Six third-party trackers set identifiers on first paint, ahead of any banner interaction, in all tested EU sessions.

Evidence attached

  • HAR trace of first paint showing tracker requests before consent
  • Annotated screenshots of the banner in the pre-interaction state
  • Reproduction steps for a clean EU session profile

Remediation shipped

  • Gate all non-essential tags behind the CMP consent signal
  • Add a server-side check that blocks tag injection without a stored consent record
  • Ship a CI test asserting zero third-party requests before consent
CM-027HighAI

AI feature lacks required automated-processing disclosure

Model-assisted scoring affects user outcomes with no disclosure, opt-out path, or human review documented.

CM-033HighTCPA

SMS opt-in lacks express written consent language

Checkout capture bundles marketing SMS into terms acceptance and stores no timestamped consent record.

CM-041MediumAccessibility

Primary onboarding flow is not keyboard operable

Custom dropdowns trap focus at step two, blocking screen reader and keyboard-only account creation.

Coverage

Every domain, counted and evidenced

The register opens with this table so leadership can see the shape of the risk in ten seconds.

Example findings coverage by domain and severity
DomainCriticalHighMediumMethod
Privacy & cookies246Network traces, CMP behavior, policy review
AI governance133Model/data flow mapping, vendor terms, disclosures
TCPA & marketing122Form capture, opt-out testing, record review
Accessibility036WCAG 2.2 AA automated + manual AT testing
Public security013Header/TLS posture, exposed surface, disclosure

Remediation

What the same surface looks like after the fix

Remediation impact

After

After remediation

  • Zero non-essential requests before consent, enforced in CI
  • Express written consent captured and stored with proof
  • Full keyboard and screen-reader path through onboarding
  • Automated-processing disclosure with human review path

Audiences

One document, three readers

For your board

A one-page posture read, the three exposures that matter, and what each costs to close.

For your counsel

Evidence-backed findings mapped to GDPR, CPRA, TCPA, ADA/WCAG, and state privacy expectations.

For your engineers

Reproduction steps, acceptance criteria, effort estimates, and regression tests per ticket.

Timeline

From kickoff to walkthrough in 15 business days

  1. Day 1

    Kickoff & scope sign-off

  2. Day 2–6

    Evidence collection under NDA

  3. Day 7–10

    Analysis & severity scoring

  4. Day 11–13

    Draft report & internal QA

  5. Day 14–15

    Live walkthrough & backlog handoff

ComplyMynt risk dashboard showing tracked findings and remediation progress over time

Executive summary

Page one, written for the board

One page, no jargon: current posture, the exposures that matter, and the cost of closing them.

The assessment covered six domains across 41 public and authenticated surfaces. Overall posture is moderate risk, driven by two critical findings in consent handling and AI disclosure. Both are contained, well-understood, and closeable inside one release cycle. Security and infrastructure posture is comparatively strong; accessibility carries the largest volume of open work.

  • Top exposure: non-essential tags firing before consent on every EU session.
  • Second: model-assisted decisions shipped with no disclosure or human-review path.
  • Third: keyboard-inoperable checkout blocking assistive-technology users.
41
surfaces tested
32
findings recorded
2
critical open
19
days to close all critical & high

Findings dashboard

Explore the register the way your team will

Filter by severity and open any finding for evidence, affected URLs, business impact, and engineering-ready remediation steps.

Network trace evidence showing third-party tracker requests firing before the consent banner is answered
PRI-014CriticalPrivacy & Consent

Analytics and ad trackers fire before consent

/ , /pricing, /signup

Evidence captured

  • HAR trace of first paint showing six third-party requests before any banner interaction
  • Annotated screenshot of the banner in its pre-interaction state with identifiers already set
  • Reproduction steps against a clean EU session profile

Engineering-ready steps

  1. 1Move all vendor tags out of the base template into a consent-gated container
  2. 2Add a server-side guard that refuses tag injection without a stored consent record
  3. 3Ship a Playwright test asserting zero third-party requests before consent
  4. 4Backfill a consent audit log with timestamp, version, and choice

Business impact

Every European session creates a documented processing event without a lawful basis. This is the single most common trigger for supervisory-authority complaints and the first thing an enterprise buyer's privacy team tests.

Recommended fix. Gate every non-essential tag behind a server-verified consent signal and prove it in CI.

Estimated effort. 3–5 engineering days

Redacted from a real engagement. Technical assessment only — not legal advice.

Evidence gallery

Screenshots, traces, and captures — attached to every finding

Nothing in the report is asserted. Each entry links back to the artifact it came from.

Consent management interface capture used as evidence for a consent finding

Consent captures

Banner states, tag firing order, and network traces from a clean regional session.

Accessibility testing capture showing focus order and contrast evidence

Accessibility evidence

Keyboard traversal recordings, screen-reader transcripts, and contrast measurements.

Security posture capture showing header and TLS check output

Infrastructure checks

Header responses, TLS configuration, and SPF/DKIM/DMARC record captures.

Remediation roadmap

Immediate, 30-day, 60–90 day, and ongoing

The report closes with this plan so the first engineering ticket can be written the same afternoon.

Week 1

Immediate

Stop active exposure

  • Gate all non-essential tags behind verified consent
  • Publish AI disclosure on every model-influenced surface
  • Separate SMS consent capture and begin retaining proof
  • Correct any policy statement that contradicts observed behavior

Weeks 2–4

30-Day

Close material findings

  • Ship the accessible checkout dialog and keyboard path
  • Enforce CSP after a clean report-only window
  • Add HSTS, frame-ancestors, and Referrer-Policy at the edge
  • Stand up the consent and revocation audit log export

Months 2–3

60–90 Day

Systemize and document

  • Complete WCAG 2.2 AA remediation across remaining journeys
  • Move DMARC to enforcement with aligned senders
  • Generate the subprocessor list and sitemap from source of record
  • Document the human-review path and AI risk classification

Continuous

Ongoing Monitoring

Keep closed findings closed

  • Scheduled re-scans across all six assessment domains
  • CI guardrails blocking pre-consent requests and a11y regressions
  • Header, TLS, and DNS baseline drift alerting
  • Quarterly executive report with trended domain scores

Previews

Pick the artifact you want to see

Each preview is sent within one business day, under NDA if you prefer.

Full sample report (PDF)

The complete 40-page document: executive summary, scorecards, register, and backlog.

Request preview

Findings register (CSV)

The machine-readable register with severity inputs, URLs, and remediation steps.

Request preview

Executive one-pager

The board-facing summary on its own, suitable for forwarding without the technical annexes.

Request preview

Questions

About the report itself

Get the full sample report

Sent within one business day, under NDA if you prefer. No sales sequence attached.

Request the full PDF See pricing