Upload, import, validate, filter, and inspect evidence, and see how automatic evidence arrives.

RolesViewerEditorAdminRoute/evidence-vaultShown toAll organizations

What it is

The evidence vault is every artifact that can prove a control operates: files and links you upload, notes you write, and automatic evidence that data sources sync on a schedule. Each item has a status, a type, the controls it is linked to, and an integrity digest recorded at capture. Control coverage is computed from what is here, so the vault is the source of most of the numbers on the dashboard.

Where to find it

EvidenceEvidence Vault

The evidence vault table with type, status, and source filters and the insight strip — The vault. The Integration column shows which data source produced a row.

The insight strip counts Evidence items, Valid, Expiring in 30 days, and Expired. The header has Upload Evidence and, when a document integration has found files, Import Documents.

Key actions

Upload a file

Click Upload Evidence.

Enter a title ("Evidence title") and a description ("Describe what this evidence shows...").

Pick the type: File ("Drop a file or browse"), Link (a URL such as https://example.com/document), or Note ("Write a note…").

Under Linked controls, use "Search controls..." to attach the controls this evidence supports. You can do this later from the control page too.

Open Advanced to add comma-separated tags.

Click Upload evidence.

The upload dialog with title, description, File, Link, and Note tabs, and the linked controls search — The upload dialog. Linking controls here saves a trip to each control page.

Import detected documents

When a document integration such as Google Drive or SharePoint finds files that look like evidence, a Documents detected banner appears with Import documents, and the header's Import Documents button becomes enabled. Confirm in the Import Documents dialog with Import. Imported rows arrive with their integration named in the Integration column.

Search and filter

Search reads "Search evidence by name or description…". Filters are Type, Status, and Source; columns are Name & Description, Integration, Type, Controls, Status, and Last Updated.

Inspect an item

Click a row to open the detail drawer. Its Properties panel shows Status, Type, the data source and sync time or who uploaded it, the Evidence link, Last updated, and Expires ("No expiry" when unset). Below sit the Integrity row, a Preview rendered for the type (PDF, image, JSON, text note, URL, GitHub and GitLab payloads, rich text), Linked controls, a notes section ("Implementation notes", or "Text content & notes" for notes), and a timeline starting at Uploaded. The menu has Copy ID and Delete, which reads Delete automatic evidence on synced rows.

The evidence detail drawer with properties, the integrity row, a preview, and linked controls — The drawer. The integrity row shows the digest recorded at capture.

Check integrity

Every item captured since integrity was introduced carries a SHA-256 digest over its canonical content, and a second digest over the stored file where there is one, with a Captured time. Click Check it hasn't changed to recompute and compare. A mismatch reads "The evidence content no longer hashes to the digest recorded at capture." Older rows have no digest and say so.

Validate or delete in bulk

Select rows, or Select all followed by the total count. Validate marks the selection valid; automatic evidence is refused with "Automatic evidence needs to be promoted first". Delete asks for confirmation in Delete Evidence. Viewers see the text Read-only access instead of the bulk bar.

Statuses and fields

Status	Meaning	Set by
Valid`valid`	Accepted as current proof; counts toward coverage	You, bulk Validate, or a sync
Pending Review`pending_review`	Needs a person to confirm it before it counts	Upload, a sync, or expiry logic
Expired`expired`	Past its expiry date; no longer counts	Expiry date
Draft`draft`	Filter label for evidence not yet submitted	Filter only
AI Inferred`inferred`	Filter label for evidence proposed by AI	Filter only
Archived`archived`	Filter label for retired evidence	Filter only

Only Valid, Pending Review, and Expired are stored on an evidence row. The other three appear in the status option list and filters but are not lifecycle values Noru stores on an item.

Type	What it is	Qualifies for coverage
File	An uploaded document or image	Yes, when valid
Link	A URL you entered	Yes, when valid
Note	Text written in the dialog	Yes, when valid
Automatic	A row synced from a data source; the provider's own kind is kept alongside it	Yes, when valid
Platform register	The assets register or personnel directory surfaced as evidence	Only the assets register, for the asset inventory control

Tips and gotchas

Delete cascades to controls

Deleting evidence unlinks it from every control and drops their coverage. An implemented control whose evidence you delete moves to pending review. Check Linked controls in the drawer before confirming Delete Evidence.

Set an expiry on evidence that ages, such as pentest reports and access reviews. Expiring in 30 days in the insight strip then becomes a worklist instead of a surprise.

Old links to /evidence-vault/[id] still work: they redirect to the vault with the drawer open for that item.

What Noru does not do

Noru does not read your uploads to decide whether they prove anything; a valid file in the right slot is enough for coverage. Integrity checks show that content has not changed since capture, not that it was correct at capture. Automatic evidence is a snapshot of a provider at sync time and is replaced by the next sync rather than kept as a history.

Evidence vault