Clients in healthcare, defense supply chains or with a cyber insurance policy are asked for evidence: who has access, how leavers were offboarded, whether every device has EDR and backup, whether staff take security training. SeatReaper already reads that from the tools you connect, so it can print it as a report.
Open Reports, then Compliance evidence. The reports are included on Growth and Pro.
What these reports are, and are not
They are evidence from the tools connected to SeatReaper, on the date shown. Each report lists the safeguards it is usually asked for under:
- the HIPAA Security Rule (45 CFR Part 164, Subpart C),
- CIS Critical Security Controls v8,
- NIST SP 800-171 Rev. 2, the requirements behind CMMC Level 2,
- common cyber insurance questionnaire questions.
They are not an audit, legal advice, a risk analysis, or a statement that you or your client meet any of these. Whether a safeguard is met depends on policies, procedures and tools that SeatReaper does not see. A report is only as complete as the tools connected for that client: a device that no connected tool knows about is not in the device inventory.
SeatReaper does not sign Business Associate Agreements (BAAs), is not designed to receive protected health information (PHI), and has not itself been audited or certified against any framework.
Overview across clients
Reports > Compliance evidence opens with one table for every client you can see: MFA registered, accounts to review, active devices without EDR or backup, stale backups (and Microsoft 365 users without a Datto SaaS Protection seat), and staff not in training. Each number opens the report that lists the people or devices behind it. A dash means the tool behind that number is not connected for that client; 0 means it was checked and nothing was found. It is not a score and does not say whether a client is compliant. Download CSV saves the table.
Trend over time
Reports > Compliance evidence > Open the trend (or Trend under a client's name in the overview) shows how one client's numbers changed: MFA registered (as a percentage), admins without MFA, accounts to review, active devices without EDR or backup, stale backups, Microsoft 365 users without SaaS backup, and staff not in training. Pick the last 30 days, 90 days or year.
- SeatReaper records each Growth and Pro client's numbers once a day, after the morning sync. The history starts on the day recording began for that client; earlier days cannot be filled in, and the page says when it starts. The last point is always the live numbers.
- Each card shows the number now and the change since the first day shown, marked as an improvement or worse. A gap in a line means the tool behind it was not connected that day, or nothing was recorded for more than two days.
- The history holds counts only, no names or accounts. It is kept for two years and is included in Download all workspace data. Download CSV gives one row a day.
Like the reports, the trend is evidence from the connected tools, not an audit or a score.
In the Quarterly Savings Review
The Quarterly Savings Review ends with a Security and compliance snapshot: the same numbers as this client's row in the overview, as of the moment the report is opened. It appears in the app, on shared links and in scheduled emails, so a client's quarterly review covers savings and security gaps together.
The reports
| Report | What it shows | Period |
|---|---|---|
| Access review | Every Microsoft 365 account; enabled accounts with no sign-in for your inactive threshold; blocked accounts that still have licenses or seats in other tools; Google Workspace accounts to review; seats in other tools with no Microsoft 365 account | As of now |
| Offboarding evidence | Each offboarding started, closed or still open, with every item on its checklist and who confirmed each one, or that a sync confirmed it | A period you choose |
| Device inventory and gaps | Every device seen by an RMM, EDR or backup tool, matched by name across tools, with active devices missing EDR or backup listed first | As of now |
| Backup status | The last successful backup of each Cove and Acronis device, and which licensed Microsoft 365 users have a Datto SaaS Protection seat | As of now |
| Security training status | Each licensed Microsoft 365 user and whether they have a KnowBe4 account, with their last KnowBe4 sign-in | As of now |
| MFA coverage | Each enabled Microsoft 365 account, whether it has registered a method for multifactor authentication and which methods, with admins who have none listed first | As of now |
| Change log | What changed for the client in SeatReaper (flags, offboardings, removals, client settings), who changed it and when, from the audit log | A period you choose |
Pick a client, and for the offboarding evidence and change log a period of up to two years (the last 90 days unless you choose). Offboardings still open are always included.
How each one is worked out
- Inactive accounts use your inactive threshold (set under Settings > Price book, or the client's own Thresholds for this client; see Price book). Sign-in dates need a Microsoft Entra ID P1 or P2 license in the client's tenant; without one, no account is listed as inactive, and the report says so.
- Active devices are devices a tool saw within your device threshold, or that backed up within your backup threshold. A device is matched across tools by its name, the same way the offboarding checklist matches it.
- Missing EDR or backup is only counted when the client has at least one EDR or backup tool linked. If none is linked, the report says so instead of listing every device as unprotected.
- MFA coverage comes from Microsoft's authentication methods registration report, read with each Microsoft 365 sync. Like sign-in dates it needs Entra ID P1 or P2; without one the report says registration is unavailable. Registered means the person has set up a method that can be used for MFA. The report does not show whether MFA is required when they sign in (security defaults or Conditional Access): check that in the client's Microsoft Entra admin center. Blocked accounts are left out, because Microsoft's report does not cover them.
- Training is KnowBe4 accounts and sign-ins only. SeatReaper does not read course completions or phishing test results, so the report does not show them.
- Who confirmed an offboarding item: a person's email when someone on your team marked it, or "confirmed removed by a sync" when SeatReaper saw it gone from the tool.
Who can open them
Owners, techs and viewers can open the reports for the clients they can see. The change log is owners only, because it comes from the audit log. Two-step verification is needed when you have it turned on or your workspace requires it.
Print, save or download
Print or save as PDF prints the report with your branding (see Branding and white label). Download CSV gives the same rows as a spreadsheet, for an auditor's evidence folder or an insurer's portal.
Evidence pack
Reports > Compliance evidence > Open the evidence pack puts every report for one client on one page, for an audit, an insurance renewal or a client review. Pick the client and, for the offboarding evidence and change log, a period.
- It starts with a cover: the contents, in order, and an evidence index listing each safeguard the reports are usually asked for under (HIPAA, CIS v8, NIST SP 800-171, cyber insurance) and which reports give evidence for it. The index is a map to the evidence, not a statement that any safeguard is met.
- Print or save as PDF prints the cover and every report, each starting on a new page, with your branding.
- Download ZIP of CSVs gives one folder with a README,
index.csv(each safeguard and the files that give evidence for it) and one CSV per report.
The change log is in the pack for owners only. If one report cannot be built, the page says which one, and the ZIP is not offered until every report can be built, so a pack never looks complete when it is not.
Share a link or send on a schedule
Owners and techs can send a compliance report to someone who does not use SeatReaper, such as an auditor, an insurer or the client's office manager:
- Share a read-only link: open the report for the client, choose how long the link lasts (7, 30 or 90 days) and choose Create share link. Copy it straight away; it is shown once. The person sees that one report, read-only, with your branding. A report about today (access review, devices, backups, training, MFA) shows the latest synced data each time the link is opened. The offboarding evidence and change log keep the period you chose.
- Send on a schedule: on the Reports page, under Scheduled delivery, pick the compliance report, the client, monthly or quarterly, and up to 10 email addresses. The offboarding evidence and change log cover the month or quarter that just ended.
The change log can only be shared or scheduled by an owner. Links are listed under Shared links on the Reports page, where they can be revoked, and they stop working if the client is archived or the workspace drops below Growth. See Reports and Scheduled delivery.