The app, screen by screen
Reports
Turns your local detection history into a document someone else will accept — an auditor, your security team, or your own records.
Available toAll plans
Every full report lists the current text strictness setting (relaxed, standard or strict) and every change to it: when, from what, to what, and by whom or what source. It also lists any detection-history clears, with the date range cleared and who approved it.
Locke keeps your detection history on your machine until you set a retention limit. This page turns that history into whichever of four documents the person asking actually needs.
| Report | Written for | Contains |
|---|---|---|
| Compliance report | Auditors, legal, insurers | Your detection history mapped to a specific privacy regime — HIPAA, GDPR, CCPA. |
| Technical report | IT and information security | Metrics, protection rate, data types, AI destinations, direction of exposure, daily activity, recommendations. |
| Detection & masking history | You, and anyone who wants the raw record | The event-by-event log, exportable as CSV or PDF. |
| Export all | Anyone who asked for 'everything' | All three of the above for one period, in a single file. |
Every report follows the same shape: choose a scope, then Generate to preview or Download PDF to save.
- Export all — one file with everything, for when you don't know which report they want.
- Compliance report — pick the privacy regime and the date range.
- Technical report — pick the date range, and optionally append the full event history.
- Detection & masking history — the live table, with CSV and PDF export.
Generating a report
- Choose the report that matches who's asking.
- Set its options — the date range always, plus the privacy regime for a compliance report.
- Press Generate report to open a preview, or Download PDF to go straight to saving it.
- From the preview, print or save as PDF. The preview is the finished document — what you see is what gets saved.
| Range | Covers |
|---|---|
| Last 7 days | The rolling week. |
| Last 30 days | The rolling month. The usual choice for a periodic report. |
| Quarter to date | From the start of the current calendar quarter. |
| All available data | Everything in your local history, within any retention limit you set. |
| Custom range | Pick your own start and end dates. |
Producing a HIPAA compliance report
1Your compliance lead has asked for evidence that patient data isn't reaching AI tools. Open Reports — the Compliance report card is the left of the two.
Read all 5 steps as text
- Your compliance lead has asked for evidence that patient data isn't reaching AI tools. Open Reports — the Compliance report card is the left of the two.
- Set Privacy regime to HIPAA. The report's language, the controls it cites, and the data types it emphasises all change to match the regime you pick.
- Set the date range to cover the period they asked about — last 30 days here.
- Press Generate report.
- The preview opens with the finished document: your figures, the regime mapping, a report ID, and a verification digest. Print it or save it as PDF, and note the ID — it lets you check a copy against the report you generated.
What you'll see
A generated HIPAA compliance report preview, showing the report title, reporting period, report ID, summary figures and regime mapping sections.
Compliance report
The report an auditor wants: your detection record, expressed in the vocabulary of a specific privacy regime, with the mapping done for you.
| Regime | Use when |
|---|---|
| General privacy | You want the evidence without tying it to one framework. |
| HIPAA | US healthcare — protected health information. |
| EU GDPR | You process personal data of people in the EU. |
| UK GDPR | The UK equivalent. |
| CCPA / CPRA | California consumer privacy. |
Technical report
For IT and security readers who want the shape of the risk rather than a regulatory framing. It covers key metrics and protection rate, which data types appeared and how often, which AI destinations received traffic, the direction of each exposure, daily activity over the period, and recommendations based on what it found.
Tick Append detection & masking history to bolt the full event log onto the end over the same date range — useful when you're handing over a single file and expect follow-up questions.
Detection & masking history
The raw record, newest first. The table shows the 25 most recent events in the range; exports include every one of them.
| Column | What it holds |
|---|---|
| Time | When the detection happened. |
| Surface | Where the data was headed — the site or app. |
| Data type | What was found. |
| Direction | Outbound (you to the AI) or inbound (the AI back to you). |
| Action | masked, or detected if it wasn't replaced. |
Export CSV gives you the whole filtered range as a spreadsheet; Export PDF produces the same data as a document. Both cover the full range, not just the visible 25 rows.
Report IDs and digests
Every generated report carries an ID and a digest — a fingerprint of its contents. If a copy of a report is questioned later, the digest lets you check it against the one you generated. Be aware of what it does not do: the digest is computed by the same software that made the report and is not countersigned by anyone, so it is an integrity check for your own records rather than proof against a determined party. Keep the ID with the file.
Team-wide reporting
Available toTeams Admin
Everything above is scoped to your own device. Admins can ask members to generate a report for a privacy regime and date range under My Team › Team reports — see My Team. A member gets a prompt and generates their own full report; the admin sees whether each request is pending or done. No report content is sent to the admin.
One caveat worth stating plainly: these reports show what Locke detected and what it did about it. They are evidence about the tool’s activity, not an audit, a certification, or legal advice, and producing one does not by itself make an organisation compliant with HIPAA, the GDPR, the CCPA or anything else. Detection is best-effort and can miss things. Whether your programme satisfies a given regime is a judgement for your compliance team and your counsel.
