The Evidence Object is the unit everything else is built from. Controls, frameworks, and Evidence Packages all point at the same structured record. Publishing the spec publicly turns our internal ontology into a shared language — for partners, auditors, and AI systems alike.
Most compliance tooling keeps its data model private. We do the opposite: the Evidence Object is documented so a partner can build against it, an auditor can verify it, and a model can reason over it. When a dozen firms export the same shape, the shape becomes the standard.
Every control links to its Evidence Object. Every Evidence Object links to the frameworks it satisfies. Every framework links to playbooks and research. That dense graph is what makes the platform reinforce itself — for users, AI, and search engines at once.
Globally unique, time-ordered identifier for this evidence object. The stable key every other record references.
Where the evidence came from — control_output, system_collector, manual_upload, partner_finding, or remediation_request.
When the object was created or last captured. Sourced from the producing system, not the export time.
Who or what produced it: { type: person | system | partner, id, display }. Proof of provenance.
The control it satisfies: { framework, control_id, statement }. One object may map to many controls.
Every framework this object counts toward — SOC 2, ISO 27001, CBN AML/CFT, NDPA, PCI-DSS. Reuse, not rework.
Cryptographic hash of the object content. Any change invalidates the hash and the audit trail records it.
Validation state — pending, passed, failed, waived — set by the QA layer before the object is exportable.
{ policy, expires } — how long the object must be kept per the strictest applicable regulation.
Links to parent controls, sibling objects, and downstream packages — the spine of the knowledge graph.
interface EvidenceObject {
id: string; // UUIDv7, time-ordered
origin: 'control_output' | 'system_collector'
| 'manual_upload' | 'partner_finding' | 'remediation_request';
timestamp: string; // RFC 3339
actor: { type: 'person' | 'system' | 'partner'; id: string; display: string };
control: { framework: string; control_id: string; statement: string };
framework_mapping: { framework: string; control_id: string }[];
integrity_hash: string; // SHA-256 of content
qa_status: 'pending' | 'passed' | 'failed' | 'waived';
retention: { policy: string; expires: string };
relationships: { type: string; target: string }[];
}