Checked before it is stored
A file is matched against the requirement it is meant to satisfy and scored before anything is saved, so you see whether it actually answers the control while you can still choose a better document.
Evidence workspace
Collect it once. Reuse it everywhere.
The store of proof: every file and every connector signal that shows a requirement is met, scored on the way in, linked to the controls it answers and credited across every framework that asks for the same thing.
How evidence behaves
Not a folder of attachments.
The difference between an evidence workspace and a shared drive is what happens to a file after someone uploads it.
Scored, hashed and dated
Each item carries a match score, an integrity hash and a validity date. Nothing sits in the vault as an untyped attachment.
Assessed the moment it lands
An upload recomputes coverage for the requirement straight away, and moves the control status if the coverage threshold is met.
Credited across frameworks
Effectiveness is written to the control behind the requirement and then to the equivalent controls in the other frameworks you run. Comply once, satisfy many.
Watched as it ages
Evidence expires. What has passed its validity date, what expires within 30 days and what has gone stale is reported daily rather than discovered at audit.
Gathered without asking
Connector scans turn posture signals from your own systems into control-level evidence, so the trail builds itself between reviews.
Crosswalk
One source, every control it answers.
Overlapping frameworks ask for the same proof in different words. Evidence is mapped to the requirement, and the requirement to the controls, so a single source settles all of them at once.
Source
Quarterly access review
Owner · approval date · integrity hash
Valid until 30 June · re-verify scheduled
Credited controls
ISO 42001 A.9.2DIRECT
ISO 27001 A.5.18CROSSWALK
EU AI Act Art. 14CROSSWALK
NIST GOVERN 2.1CROSSWALK
Connectors
Evidence from the systems you already run.
A connector contributes posture signals and a mapping from those signals to control ids. Everything after that — evidence creation, crosswalk credit, gap proposals and traces — is shared, so coverage grows without new integration work on your side.
- 22
- In the catalogue
- Across source control, ML platforms and document stores
- 9
- Production
- Real SDK or API; failures surface as real errors
- 7
- Beta
- Real path available, SDK optional
- 6
- Coming soon
- Listed and disabled rather than quietly faked
Where a scan cannot see something — a token without the scope to read a setting, say — the result is recorded as undetermined rather than as a failure. The platform does not report a finding it could not actually observe.
Next / evaluate the platform
Bring your frameworks.
See the operating system.
We will walk through the platform against your own governance and compliance needs, and what getting to audit-ready would take.