# Evidence export (/en/docs/platform/features/pci-dss/evidence-export)



**PCI DSS** > **Overview** > **Export evidence pack** produces a ZIP holding your payment-page scope, your script inventory, and the full history of decisions.

Available to **Viewer** and above, so a compliance lead who cannot change anything can still pull evidence.

## ZIP contents [#zip-contents]

The archive holds three files:

| File                   | Contents                                                                            |
| ---------------------- | ----------------------------------------------------------------------------------- |
| `pci-dss-report.pdf`   | A formatted report in 10 sections, with a reference number and generation timestamp |
| `script-inventory.csv` | Every inventory row, **including retired scripts**, 21 columns                      |
| `change-ledger.csv`    | Every ledger event, all time, untruncated                                           |

The PDF carries these sections:

* Summary
* Payment pages in scope
* How the evidence is collected
* Authorized scripts
* Scripts pending review
* Rejected scripts
* Retired scripts
* Justification rules
* Script origins
* The change ledger

The report states that it addresses PCI DSS v4.0.1 requirements **6.4.3** and **11.6.1**. It is evidence you present, not a certification.

## Truncation limits [#truncation-limits]

This is the part to understand before handing the PDF to anyone.

**The PDF is a summary.** Each section lists at most 300 rows, with a note saying how many were omitted. The ledger section covers the **last 12 months** and prints the 200 most recent entries, though its totals are computed over the whole 12 months.

**The CSVs are complete.** No row limit, no date window. If your assessor wants the full trail, the CSVs are the artefact, and the PDF is the readable overview.

Say this explicitly when you hand it over. An assessor who reads "showing the first 300" in a PDF and is not told the CSV is complete may reasonably ask for something you already gave them.

## When to export [#when-to-export]

Export once early, before anyone asks, so you know what it looks like and can fix gaps while there is time. Empty justifications and a low review coverage are much cheaper to address before an audit window than during one.

Then export at the point you want to freeze: end of an assessment period, or a date your assessor names. The pack is a snapshot for everything except the ledger, so the date you generate it matters.

## Before you export [#before-you-export]

Three things worth checking:

* **Review coverage:** Anything short of complete means scripts with no decision. See the [overview](/en/docs/platform/features/pci-dss).
* **Justification quality:** Sort through the inventory CSV and look for one-word justifications. They will not survive review.
* **Scope accuracy:** Confirm your payment-page patterns still match your real checkout URLs after any redesign. For more information, refer to [Payment pages](/en/docs/platform/features/pci-dss/payment-pages).

## Next steps [#next-steps]

* [Justifying scripts](/en/docs/platform/features/pci-dss/justifying-scripts)
* [Script inventory](/en/docs/platform/features/script-inventory)
* [PCI DSS overview](/en/docs/platform/features/pci-dss)