Evidence that
proves itself
A screenshot in a folder is a claim. Evidence pulled from the system that enforces the control is proof. Connect your identity and productivity stack and Xee attaches verified evidence against the controls it satisfies — with an expiry date, so it can't quietly rot.
The stack you already run
Connect once; evidence keeps arriving against the controls it belongs to.
- Microsoft 365 — identity, mail, files, device state
- Google Workspace — the same, for the other half of the market
- Entra ID — MFA posture, privileged roles, access reviews
- Plan limits are real — Growth connects one, Scale connects as many as you need
Two things make it evidence
Integrity and freshness. Without both, an auditor is right to be sceptical.
- SHA-256 on capture — every artefact hashed the moment it lands
- 90-day expiry on verified evidence, so stale proof surfaces as a gap
- Chain of custody visible in the auditor and forensics views
- Audit trail — who attached what, when, and from where
Self-attested → independently verified
Connect Microsoft 365 during a demo and the verified-evidence count jumps from zero. It's a small number on a dashboard, and it's the difference between telling an auditor you enforce MFA and showing them the tenant that does.
- Evidence tagged by source, so verified and self-attested never blur
- Mapped to the Annex A controls it satisfies, automatically
- Carried through the crosswalk into SOC 2, NIST, CIS, POPIA and GDPR
- Feeds questionnaire auto-answer with a citation
Ways evidence gets in
Upload
Drag a file onto a control. It's hashed on capture and stamped with who attached it and when.
manualConnected systems
Pulled from M365, Google Workspace or Entra ID and marked verified, with a 90-day life.
automaticYour own pen tests
Every validated finding lands against the control it breaks — and a clean pass is evidence toward that control.
closed loopEncrypted credentials
The keys behind a connection are held encrypted, so a connector stays connected without anyone re-authorising it every week.
settingsExpiry that nags you
Verified evidence carries a 90-day life. When it lapses it reappears on the compliance calendar and in the weekly digest instead of silently passing.
freshnessExportable
Everything attached can leave with you — the auditor pack, the Statement of Applicability and the evidence register export.
no lock-in