One object. Every control maps to it.
The Evidence Object is the unit everything else is built from. Controls, frameworks, and Evidence Packages all point at the same structured record. Publishing the spec publicly turns our internal ontology into a shared language — for partners, auditors, and AI systems alike.
Categories are built on standards
Most compliance tooling keeps its data model private. We do the opposite: the Evidence Object is documented so a partner can build against it, an auditor can verify it, and a model can reason over it. When a dozen firms export the same shape, the shape becomes the standard.
Every control links to its Evidence Object. Every Evidence Object links to the frameworks it satisfies. Every framework links to playbooks and research. That dense graph is what makes the platform reinforce itself — for users, AI, and search engines at once.
Anatomy of an Evidence Object
Globally unique, time-ordered identifier for this evidence object. The stable key every other record references.
Where the evidence came from — control_output, system_collector, manual_upload, partner_finding, or remediation_request.
When the object was created or last captured. Sourced from the producing system, not the export time.
Who or what produced it: { type: person | system | partner, id, display }. Proof of provenance.
The control it satisfies: { framework, control_id, statement }. One object may map to many controls.
Every framework this object counts toward — SOC 2, ISO 27001, CBN AML/CFT, NDPA, PCI-DSS. Reuse, not rework.
Cryptographic hash of the object content. Any change invalidates the hash and the audit trail records it.
Validation state — pending, passed, failed, waived — set by the QA layer before the object is exportable.
{ policy, expires } — how long the object must be kept per the strictest applicable regulation.
Links to parent controls, sibling objects, and downstream packages — the spine of the knowledge graph.
Type definition
interface EvidenceObject {
id: string; // UUIDv7, time-ordered
origin: 'control_output' | 'system_collector'
| 'manual_upload' | 'partner_finding' | 'remediation_request';
timestamp: string; // RFC 3339
actor: { type: 'person' | 'system' | 'partner'; id: string; display: string };
control: { framework: string; control_id: string; statement: string };
framework_mapping: { framework: string; control_id: string }[];
integrity_hash: string; // SHA-256 of content
qa_status: 'pending' | 'passed' | 'failed' | 'waived';
retention: { policy: string; expires: string };
relationships: { type: string; target: string }[];
}The evidence graph
- →Controls link to their Evidence Object specification — see any control in the Control Mapping.
- →Frameworks (SOC 2, ISO 27001, CBN AML/CFT, NDPA, PCI-DSS) link to the Evidence Objects they require.
- →Evidence Packages are collections of Evidence Objects — the SEP standard.
- →Partners consume and contribute Evidence Objects via the Partner API.