Statuses say what you've implemented; evidence proves it. The tracker treats evidence as a first-class part of the assessment, stored locally alongside your statuses and notes.
Attaching evidence
On any requirement you can attach evidence three ways:
- Drag and drop a file — policies, configurations, exports, reports.
- Paste an image — screenshots go straight from your clipboard onto the requirement.
- Add a URL — link out to an intranet page, a ticket, or a hosted document. On the desktop app, links open in your system browser.
Previews
Attached evidence renders in place: images and multi-page PDFs get rich previews, CSV and XLSX files render as tables, and text, JSON, and code display inline — you rarely need to leave the app to check what an artifact contains.
Shared evidence: tag once, attach everywhere
One policy document often satisfies dozens of controls. Rather than uploading it dozens of times:
- Tag an artifact with a shared evidence type — like your System Security Plan or access-control policy — and it's instantly attached to every control whose assessment guidance calls for that document, auto-checking the matching Examine checklist items.
- Link one artifact to multiple requirements manually; renaming, replacing, or deleting a shared artifact prompts sensibly so you know what else is affected.
- Version updates are one step — when a policy is revised, replace the artifact once and every control it supports is current. Keeping your SSP up to date becomes replacing only the evidence that actually changed.
Integrity hashing
Every artifact is SHA-256 hashed — the same way an assessor verifies evidence integrity — and identical files are deduplicated. Hashes appear in the evidence table and in the exported evidence map.
The evidence table
The evidence view shows every artifact across the whole assessment in one screen, with filtering by type, search by filename or hash, and sorting. It's the fastest way to audit what you have — and what's missing.
Getting evidence out
From the upper-right menu you can Download Evidence (every artifact, as files) and Download Evidence Map — a two-way JSON index of artifacts and the requirements they support, with hashes, ready to hand to an assessor. The source repository includes post-processing scripts that sort the downloaded files into per-requirement folders and generate a markdown evidence report — see Reports & Exports.