Proof attached to the control it answers.
Attach proof to the control it answers. Every file is encrypted under a key only your organisation holds.
- AES-256-GCM
- Authenticated encryption at rest
- 50 MB
- Per evidence file
- Per tenant
- Data key, wrapped by AWS KMS
Captured where the answer is given
Evidence isn't a folder you reconcile afterwards. It's attached to the question at the moment the auditor answers it, so the link between claim and proof survives.
- 1Photos, video and documents up to 50 MB per file
- 2Each file belongs to one specific control, not to the audit in general
- 3Mark controls as requiring evidence, so they can't be answered without it
- 4Captions and upload attribution recorded on every item
What happens to a file after you upload it.
Envelope encryption: your organisation gets its own data key, and that key is protected by a master key in AWS KMS.
- 1
Upload
A photo, video or document is attached to a specific audit question.
- 2
Encrypt
The file is encrypted with AES-256-GCM using your organisation's own data key.
- 3
Wrap
That data key is itself encrypted by a master key held in AWS KMS. It's never stored in plaintext.
- 4
Unwrap on read
Only the application role can ask KMS to unwrap the key, and only to serve your organisation.
- 5
Log
Every unwrap is written to AWS CloudTrail, so key use is auditable later.
Implemented today.
Per-tenant data encryption keys
Each organisation gets its own data encryption key. It never leaves the service in plaintext.
AES-256-GCM at rest
Authenticated encryption, so tampering is detected rather than silently accepted.
Keys wrapped by AWS KMS
Data keys are wrapped by a master key in AWS KMS. Only the application role can unwrap them.
CloudTrail on every key access
Each unwrap call is recorded, so key use is auditable after the fact.
Tenant-isolated data access
Every query is scoped to the requesting organisation. Cross-tenant reads are not expressible.
Role-based access control
3 roles, from view-only through to organisation administrator.
How to check it
Every control above is implemented in the platform today, and each one leaves a trail you can inspect: the KMS key policy, the CloudTrail record of every unwrap, and the role matrix governing who reads what. Bring your security questionnaire to the call and we will work through it line by line.
The full list.
- Photos, video and documents up to 50 MB per file
- Every file attaches to the specific question it evidences
- AES-256-GCM encryption with a per-tenant data key
- Data keys wrapped by AWS KMS; every key access logged in CloudTrail
- Captions and upload attribution on every item
See it against your own sites
Thirty minutes with the people who build it, walked through the modules that matter to your programme rather than a scripted tour.