Evidence Vault

Evidence Vault is where your proof lives — both automated evidence from integrations and manual uploads.

Use this when…

• an auditor asks “show me proof this control operated”
• you need evidence to answer a customer questionnaire
• you’re trying to reduce manual screenshot/CSV chaos

Recommended workflow

Keep evidence mapped

Use Mapped / Unmapped views to keep drift under control.

• Mapped evidence: already supports a control.
• Unmapped evidence: either map it, or decide you don’t need it.

Use filters the way auditors think

Common slices:

• evidence status (approved / needs review / outdated)
• evidence type (document, configuration, log-derived)
• integration/source

Import vs upload

• Upload manual evidence for artifacts that are inherently documents (policy approvals, diagrams, reports).
• Prefer integration evidence for “systems of record” (identity, cloud, ticketing, monitoring).

Where evidence comes from

• Data-source syncs create or update automatic evidence from provider APIs.
• Register mirrors represent structured Noru records such as the personnel directory or privacy data map.
• Manual uploads cover documents and offline activities that no connector can observe.
• Document integrations can detect importable files; importing is a deliberate user action.

Automatic evidence remains tied to its integration and is refreshed by later syncs. Do not upload a screenshot to replace a reliable system-of-record feed unless the screenshot demonstrates something the collector cannot capture.

Working in /evidence-vault

Search and filter by source/integration, type, status, and control mapping. The table shows name, description, integration, evidence type, linked controls, status, and last update. Typical work is to:

1. Review newly collected or imported evidence.
2. Confirm organization, time period, and system scope.
3. Link it to the control and, when available, the specific evidence requirement.
4. Validate selected evidence when it is fit for use.
5. Resolve stale, expired, duplicate, or irrelevant items instead of leaving them ambiguous.

Deleting evidence can remove proof referenced by a control or audit package. Confirm dependencies first.

The historical /evidence-vault/[id] route redirects to the vault with the item selected; the directory and detail drawer are the current experience.

What a reviewer should be able to answer

• Who or what produced the evidence?
• What system, population, and period does it cover?
• Is it complete and tamper-resistant enough for the claim?
• Which control behavior does it prove?
• Is the evidence current for the audit or review period?

Compliance angle

Evidence requirements look different by framework, but the shared theme is “prove operation over time”. As examples:

• SOC 2 / ISO 27001: evidence needs to demonstrate operation over time.
• GDPR: evidence often supports security measures and vendor obligations (DPAs, subprocessors, access controls).