Evidence

Evidence is the documentation that backs up your answers — policies, screenshots, reports, signed agreements. Auditors expect to see it, so attach it as you go.

Attaching evidence

Upload files directly on a question, finding, or remediation task, or from the Evidence library. Accepted types include PDF, Office documents, images, text, CSV, and ZIP.

Freshness & lifecycle

Evidence can carry a review date and an expiry date. The library flags items that are Review due, Expired, or Review soon, and a scheduled reminder notifies the uploader (or an admin) ~30 days before either date — so a vendor's year-old assurance report doesn't quietly go stale.

When an item is Expired or Review due, a one-click Refresh button appears next to it. Refresh opens the upload form already pointed at that evidence: you just pick the new file, and on upload it inherits the old item's links and review/expiry schedule, bumps the version, and marks the old row superseded — so the freshness panel clears, the attachment stays in place, and the full history is preserved rather than lost.

Watney intake (when AI is enabled)

In the evidence library, Summarize asks Watney to read a file and describe what it is — and to suggest which assessment questions it supports. Each suggestion appears as a one-click link button: confirm it and the file is attached to that question's answer in your most recently updated open program assessment of a family that asks it (never a system assessment). You always confirm each link; nothing is attached automatically. Suggest links for the unlinked files on this page does the same for every file on the page that is not linked to anything yet, one after another (up to ten a run, after you confirm), skips a file it cannot read, and stops if Watney is refused (its daily limit, for example). Summarizing sends the file's contents to the model provider, and those contents are treated as untrusted data. Watney's card page names the model provider and the models in use; its system card, which will describe how the provider handles what is sent, is not published yet.