{
  "certifications": [
    {
      "auditor_firm": "Mercer & Hale CPA",
      "cpa_firm": "Mercer & Hale CPA",
      "cpa_license": "AICPA #84421",
      "cpa_signer": "J. Mercer, CPA",
      "expires_at": null,
      "framework": "hipaa",
      "opinion": "In our opinion, the controls in scope were suitably designed and operated effectively to provide reasonable assurance that the service organization's service commitments and system requirements were achieved.",
      "payload_sha256": "990c9b7163a72f39ec1ae0373e7066919935eda73bd333b39895ff3d0ba2828a",
      "period_end": "2027-01-14",
      "period_start": "2026-01-15",
      "signature_b64": "QU1mSvUeGwqoAA0F3NlEkaqV3isxG/uAHrR85eI3wKY=",
      "signed_at": "2026-05-15T14:14:02.645841+00:00",
      "slug": "acme-hipaa-2026",
      "status": "active"
    },
    {
      "auditor_firm": "Mercer & Hale CPA",
      "cpa_firm": "Mercer & Hale CPA",
      "cpa_license": "AICPA #84421",
      "cpa_signer": "J. Mercer, CPA",
      "expires_at": null,
      "framework": "iso27001",
      "opinion": "In our opinion, the controls in scope were suitably designed and operated effectively to provide reasonable assurance that the service organization's service commitments and system requirements were achieved.",
      "payload_sha256": "1d69a873958df939a25a0000edf800338a108dced0c7131f5e7bfb4b6967d130",
      "period_end": "2026-08-31",
      "period_start": "2025-09-01",
      "signature_b64": "DkzHcf3H9wHGmVODyh8ckGMulSDoB/SqYNXnUUXb5Hc=",
      "signed_at": "2026-05-15T14:14:02.645841+00:00",
      "slug": "acme-iso27001-2025",
      "status": "active"
    },
    {
      "auditor_firm": "Mercer & Hale CPA",
      "cpa_firm": "Mercer & Hale CPA",
      "cpa_license": "AICPA #84421",
      "cpa_signer": "J. Mercer, CPA",
      "expires_at": null,
      "framework": "soc2_type2",
      "opinion": "In our opinion, the controls in scope were suitably designed and operated effectively to provide reasonable assurance that the service organization's service commitments and system requirements were achieved.",
      "payload_sha256": "19ddaa4c065f23494c591738abe7b04834e6394587cd6afc3709f853c4fc7acc",
      "period_end": "2026-04-30",
      "period_start": "2026-02-01",
      "signature_b64": "SaUzO0dBwe86vdmxAUUX9rdbILDVJOJ2MTAbHbCMBB8=",
      "signed_at": "2026-05-15T14:14:02.645841+00:00",
      "slug": "acme-soc2-2026",
      "status": "active"
    }
  ],
  "controls": {
    "exceptions": 2,
    "satisfied": 2,
    "total": 5
  },
  "latestRoot": {
    "anchored_at": "2026-05-18T13:28:37.358847+00:00",
    "leaf_count": 30,
    "rekor_uuid": "local-3c370df9afe8290976e93960",
    "root_hex": "3c370df9afe8290976e939605cca700b377b9e27ea43a9e8c973133e05bfef21",
    "signature_b64": "seed-3c370df9afe82909"
  },
  "merkleLeaves": [],
  "openFindings": [
    {
      "control_code": "CC1.4",
      "id": "2b96a61d-e293-4a29-9d43-1f528ed9424d",
      "status": "open",
      "title": "Annual security training completion 87%"
    },
    {
      "control_code": "CC6.2",
      "id": "37ed1b13-7893-4022-8c2c-8c96f8d3dfa5",
      "status": "open",
      "title": "Joiner pre-provisioning pattern"
    },
    {
      "control_code": "CC8.1",
      "id": "826397f2-2aec-4ec8-9b71-55de341c6f98",
      "status": "in_remediation",
      "title": "Branch protection gap on production repos"
    }
  ],
  "org": {
    "name": "Acme Robotics",
    "slug": "acme"
  }
}