NEW RESEARCH: Your Sandbox Is Made of Glass

Read

Trinitite

PricingResearchBlogPodcasts

Enterprise Reporting

Most AI governance emits a dashboard and then dead-ends.

Audit teams, CFOs, and underwriters need a horizontal reporting layer: compose their own views, export to the formats their tooling already understands, and have them show up in their inboxes every Monday morning. Trinitite ships a 60+ report catalog, a safe query builder, five export formats, and cron-driven delivery — on the same tenant-isolated core as the rest of the platform.

report_run · cfo_ai_spend

DELIVERED

schedule

0 7 * * 1 · weekly

format

pdf_branded

delivery

email + s3

sha256

3f9a…c7e1

signed_url

ttl 3600s

org_predicate

enforced

No raw SQL from tenants. Ever. Every query carries an org predicate.

A semantic layer of whitelisted sources with typed dimensions, metrics, and grains sits under everything. Every run writes a tamper-evident audit row, and every artifact is addressable only via an HMAC-signed URL with a bounded TTL — reporting you can sell as its own SKU without widening your attack surface.

The catalog

60+ reports, grouped by the roles you already sell to.

CEO / Board

7

Executive Summary, Governance Health Trend, AI ROI Snapshot

CFO

8

AI Spend Summary, Spend by Model / Provider, CLI-vs-MCP cost arbitrage

CISO

8

MCP Alerts by Severity, Blocked Calls by Liability Class

CRO

8

VaR & CVaR Trend, Liability by Class, Backtest Exceptions

General Counsel

7

Audit Events by Action, Failed Audit Events, Actor Activity

Auditor

7

Monthly Audit Events, Evidence Packs, Governance Coverage

Insurer

7

Monthly Liability Summary (bordereaux), Near-Miss Trend

Ops

8

Top Upstream Errors by Tool, Block & Correction Rates, Privilege Escalations

Render & deliver

Any definition, five formats, on a schedule.

json

API integrations, streaming pipelines.

csv

Data-team intake, Excel imports, RFC 4180.

pdf

Plain tabular PDFs for archival.

pdf_branded

Board-ready cover, KPI tiles, charts, appendix.

xlsx

Native .xlsx, typed columns, metadata tab.

Cron-scheduled in standard 5-field UTC, delivered over email, webhook (HMAC-signed envelope), SFTP, or S3 — identical across SaaS, hybrid, and self-hosted deployment.

Security & compliance posture

The same governed core, under every report.

Tenant isolation

Every compiled query injects organization_id = $orgId — re-checked in unit tests.

No raw SQL

Tenants author JSON report definitions through a semantic layer; there is no code path that executes user-supplied SQL.

Read-only execution

Runs through a dedicated Postgres role with SELECT-only grants on whitelisted tables.

Signed artifacts

Every artifact is SHA-256 fingerprinted and served only via an HMAC-signed URL with a bounded TTL.

Audit evidence

Every run and mutation writes to audit_logs — SOC 2 CC7, ISO 27001 A.12.4, EU AI Act Art. 12 inputs.

PII redaction

Persona-scoped redaction rules apply at render time — e.g. prompt text omitted in GC reports.

In your language

The report in your inbox, in your format.

CFO

AI spend by model, provider, and invocation type in your inbox every Monday — branded PDF for the board, XLSX for the analysts.

Auditor

Evidence packs and governance-coverage reports on a schedule, each artifact fingerprinted and signed.

Insurer / underwriter

Monthly bordereaux and near-miss trends delivered to S3 or SFTP — the upstream format your pricing tooling already expects.

Security reviewer

A horizontal reporting layer with tenant isolation, read-only execution, and no raw-SQL path — a clean procurement story.

Reports read from the same governed ledger behind the audit platform and LLM observability; the underwriter reports feed AI liability pricing.

FAQ

Enterprise reporting, answered

What is the Trinitite enterprise reporting platform?

It is a horizontal reporting layer on top of Trinitite’s governed core: a curated catalog of 60+ persona-grouped reports, a safe query builder that persists reports as JSON definitions (never raw SQL), multi-format export (JSON, CSV, PDF, branded PDF, XLSX), and cron-driven delivery over email, webhook, SFTP, and S3 — all tenant-isolated and entitlement-gated.

How is the query builder safe if tenants author their own reports?

Tenants pick a source, dimensions, metrics, filters, and a time grain from pickers populated by the semantic layer; the definition is stored as JSON and revalidated on every save and run. An unknown source, dimension, metric, or filter — or a limit above the 10,000-row cap — returns a 400. There is no code path that accepts or executes user-supplied SQL, and every compiled query carries a mandatory organization_id predicate.

How are report artifacts secured?

Every generated artifact is SHA-256 fingerprinted, stored in a namespaced path, and served exclusively through an HMAC-signed URL with a configurable TTL (default one hour, 300 seconds when minted manually). Every run writes a tamper-evident audit row, and persona-scoped redaction rules apply at render time.

Does it replace my BI tool?

It augments it. Rather than direct Tableau / Power BI / Looker access, it delivers scheduled CSV / XLSX to S3 or SFTP — the upstream format every enterprise BI tool expects. It reads from the same governed ledger behind the audit platform and LLM observability.

Schedule one report to your inbox this week.

Pick a report from the catalog or build your own from the semantic layer, choose a format, and set a cron — signed, delivered, and audit-logged from the first run.