Compliance Tools

The Evidence Explorer lets you browse compliance evidence anchored to specific controls. Select a control from any framework and the explorer shows every piece of evidence that satisfies it, with a full chain-of-custody trace.

How it works

The explorer has two panes:

Left pane: Framework Tree

A collapsible tree of all 7 supported frameworks (SOC 2, ISO 27001:2022, GDPR, HIPAA, EU AI Act, ISO/IEC 42001:2023, NIST AI RMF 1.0). Expand a framework to see its controls. Each control shows:

• Status badge: green (evidenced), amber (partial), red (gap)
• Evidence count: how many items are linked to this control

Click a control to filter the right pane.

Right pane: Evidence Timeline

A chronological list of evidence items linked to the selected control. Each item shows:

• Protocol badge: AEE (envelope), AOCL (policy decision), VOLT (hash chain event)
• Timestamp: when the event occurred
• WARD badge: whether the event has been externally witnessed

Chain of custody

Click "chain" on any evidence item to expand the full provenance trail:

AEE Envelope → VOLT Hash Chain → WARD External Receipt
(abc123)        (run_847)          (tip_304)

This traces the evidence from its origin (the agent interaction recorded as an AEE envelope) through the cryptographic ledger (VOLT hash chain) to the external witness (WARD receipt with RFC 3161 timestamp) — what auditors can check for themselves at every step.

Filters

• Framework pills: show evidence from only one framework
• Date range: 7 days, 30 days, 90 days, or all time
• Evidence type: filter by protocol (AEE, AOCL, VOLT)

Deep links

Every view state is URL-encoded. You can share a link like /compliance?tab=evidence&fw=soc2&ctrl=CC6.1 and the recipient will see exactly the same control and evidence filter.

Frequently asked questions

Which frameworks can we browse evidence for?

Seven: SOC 2, ISO 27001:2022, GDPR, HIPAA, EU AI Act, ISO/IEC 42001:2023, and NIST AI RMF 1.0.

How do we trace where a piece of evidence actually came from?

Click "chain" on any evidence item to expand the full provenance trail: AEE Envelope, then VOLT Hash Chain, then WARD External Receipt.

Can we filter down to specific evidence?

Yes, by framework (single framework view), date range (7, 30, 90 days, or all time), and evidence type (protocol filtering).

Can we send an auditor straight to a specific control and filter, without them digging for it?

Yes. Every view state is URL-encoded, so you can share a link and the recipient will see exactly the same control and evidence filter.

Glossary