Reports & AI Troubleshooting & FAQ

Executive dashboard and PDFs

The PDF shows different framework scores from the dashboard. They come from the same scorer (weighted, active frameworks, N/A excluded) in the current release — ISO 27001 83% on screen is 83% in the PDF. If yours differ, the PDF was generated by an older build that counted framework mapping rows; regenerate after upgrading. The Compliance Trend number on the overview is a third thing: the daily snapshot's plain implemented-plus-half-partial ratio across the whole catalog, used for direction, not for the headline.

Priority gap cards show blanks ("Effort:", "% gap", "Est. Cost"). Older builds rendered fields the API never sent. The current release shows the control name, framework, domain, status, open findings, owner and due date instead. Upgrade.

Every certification card says "SOC 2 Type II". Same cause; fixed in the current release — the card takes the framework name from the payload.

"Organisational compliance maturity" is not the average of the cards I see. It averages every active framework, including ones scrolled out of view. Check the framework activation panel on Compliance Posture.

The roadmap says a phase runs "Weeks 51-50" / phase 1 is a year long. Fixed in the current release: phases are consecutive, sized for parallel work, and an empty phase has no timeline. Either way, treat the roadmap as a skeleton — the durations are not an estimate of your effort.

Scheduled reports

I clicked Schedule and got "Internal server error", but the schedule appeared. An older build saved the schedule and then failed to serialise the response; if you retried, you have a duplicate — delete it. Fixed in the current release.

Quarterly is rejected. Fixed in the current release; earlier builds accepted only daily / weekly / monthly.

The report generated but nobody received it. Delivery needs the platform's SMTP configuration (Notifications). Without it the run records last_delivery as skipped and the PDF is still downloadable from latest / history. Also check the recipient list — entries without @ are dropped.

The scheduled PDF has no framework scores. Older builds resolved the compliance scorer through a handle that exists only in the API process, so the Celery-generated PDF lost its framework table (score for … failed: 'core' in the worker log). Fixed in the current release.

Nothing runs at all. The run-due-scheduled-reports beat fires every 30 minutes on the maintenance queue; a schedule is due once next_run has passed (09:00 UTC on its day). Confirm Celery beat and a worker for that queue are running.

Consolidated and module reports

"Generate" on the consolidated report returns immediately with a job id and no file. That is the contract: rendering (especially with evidence screenshots) can take minutes. Poll GET /api/jobs/{job_id} or watch the Scan Results page; the download link appears when the job completes, and the report is in history afterwards.

Evidence screenshots are missing from the consolidated report. Screenshots are captured live from the affected URLs at generation time (up to max_screenshots, 15 by default). Targets that are unreachable from the platform, need authentication, or block headless browsers produce no screenshot; the finding is still in the report.

A report I generated last quarter is gone. Generated reports are kept for 180 days by default (REPORT_RETENTION_DAYS); per-scan reports follow the scan retention policy. Export and archive anything with a longer obligation.

The cloud findings export returns 401 with an API key. GET /api/cspm/findings/export is session-authenticated only; use the browser, or GET /api/cspm/findings over the API and write the CSV yourself.

AI

The assistant answers "AI features are not available. Configure an LLM provider…" Exactly what it says: no provider is active for your team. Knowledge Base → AI Assistant → AI Configuration → Add Key → Test → Activate (or set ANTHROPIC_API_KEY / OPENAI_API_KEY on the backend). Product questions still work without a provider because they are served from platform knowledge.

It used to say "Internal server error" instead. Older builds turned that message into an opaque 500 (a bug in the error helper that affected several endpoints). Fixed in the current release; the behaviour is the same, the message is now honest.

"Forbidden" when sending a message. The assistant, Explain / Suggest fix / AI Summary and provider configuration require the Manage Integrations permission; scan analysis requires Manage Scans. Give the role the permission or ask an admin.

Test succeeds but Activate does nothing / another provider answers. The first configured provider becomes active automatically; when several are configured, Activate switches. Check GET /api/llm/providers for active_provider — the assistant header shows the model that answered.

The answer is generic and ignores my findings. Two possibilities: the question was recognised as generic and served from platform knowledge (fast, no tenant data — ask about your accounts or findings explicitly), or the page you asked from has no security context to attach (the widget on a settings page knows less than on Scan Results).

AI Summary / Explain is slow or times out. Large scan reports are summarised from counts and the top findings, but the provider call still takes several seconds; the fast model (claude-haiku-4-5, gpt-4o-mini) is used for short helpers. Persistent timeouts usually mean the provider key has hit its rate limit — the provider's error is shown in Test.

Frequently asked questions

Does any report or AI feature send data outside my tenant? Reports never leave the platform unless you email them (scheduled reports) or download them. AI requests go directly to the provider you configured with your key; only tenant-agnostic questions are cached, and never with your data.

Can I brand the PDFs? Yes — every server-rendered document (executive, compliance posture, consolidated, DPDP pack, branded export family) uses the team's brand configuration: logo, colours, confidentiality banner.

Which report do I give an external auditor? Status: Audit Reports (controls CSV). Evidence: the per-framework auditor package. Narrative: the Board Report PDF. For DPDP: the audit pack.

Can I generate reports from CI or a script? Yes — every report on the Report Catalog has an API route; the branded export family is designed for exactly that.

Still stuck?

The platform-wide Troubleshooting page covers login, workers and deployment. When contacting support include the report or job id, the schedule id for scheduled reports, and — for AI — the provider and model from GET /api/llm/providers.