Platform / Evidence collection

Evidence collection

Evidence that gathers itself, dated and sourced

Connect the systems you already run and evidence is collected on schedule, labelled with its source, collection time, and the controls it supports. Auditors get read-only access to the exact items they asked for.

Evidence collection workspace Cloud · On-prem
Features
4
Connected integrations
10
Deployment options
2

What evidence collection does

The feature list below is the module definition the template ships with; counts and wording come straight from the module data file.

  • Scheduled collection from cloud, identity, and code systems

  • Every item carries source, timestamp, and control mapping

  • Auditor view scoped to the requested framework and period

  • Expiry alerts when an item goes stale before the audit window

Connected integrations

Drawn from the integration directory by category (Identity, Cloud infrastructure, Development, Endpoint): 10 of 18 directory entries connect to this module.

Open the directory

Okta

Live

Single sign-on, MFA enrolment, and access reviews pulled on schedule.

Identity · Cloud

Microsoft Entra ID

Live

User inventory, conditional access policies, and privileged role changes.

Identity · Cloud

Google Workspace

Live

Admin roles, two-step verification settings, and account recovery events.

Identity · Cloud

Active Directory

Live

Directory groups and privileged account membership from on-prem domains.

Identity · On-prem

Amazon Web Services

Live

Configuration evidence for accounts, storage, logging, and network rules.

Cloud infrastructure · Cloud

Microsoft Azure

Live

Subscription policies, resource configuration, and activity log exports.

Cloud infrastructure · Cloud

Google Cloud

Live

Project IAM, audit logs, and firewall rule snapshots.

Cloud infrastructure · Cloud

GitHub

Live

Branch protection, reviewer rules, and admin action history.

Development · Cloud

GitLab

Live

Protected branches, approval rules, and self-hosted runner configuration.

Development · On-prem

Jamf

Live

Device encryption state, OS versions, and compliance profiles.

Endpoint · Cloud

Deployment options

Evidence collection supports two deployment modes. The platform page compares the modes across all five modules.

Cloud

Runs in the hosted service. Collectors connect out to your systems over encrypted links, and the workspace region sets where the stored evidence lives.

On-prem

Runs inside your own network boundary. Collectors and stored evidence stay on infrastructure you operate; auditor access is exposed through a scoped, read-only gateway.

The other modules read and write the same evidence record.

Put evidence collection to work

A demo connects two or three of your source systems and shows the first readiness picture from your own data.