verified beats self-attested

Evidence that
proves itself

A screenshot in a folder is a claim. Evidence pulled from the system that enforces the control is proof. Connect your identity and productivity stack and Xee attaches verified evidence against the controls it satisfies — with an expiry date, so it can't quietly rot.

connect

The stack you already run

Connect once; evidence keeps arriving against the controls it belongs to.

  • Microsoft 365 — identity, mail, files, device state
  • Google Workspace — the same, for the other half of the market
  • Entra ID — MFA posture, privileged roles, access reviews
  • Plan limits are real — Growth connects one, Scale connects as many as you need
guarantee

Two things make it evidence

Integrity and freshness. Without both, an auditor is right to be sceptical.

  • SHA-256 on capture — every artefact hashed the moment it lands
  • 90-day expiry on verified evidence, so stale proof surfaces as a gap
  • Chain of custody visible in the auditor and forensics views
  • Audit trail — who attached what, when, and from where
the moment it clicks

Self-attested → independently verified

Connect Microsoft 365 during a demo and the verified-evidence count jumps from zero. It's a small number on a dashboard, and it's the difference between telling an auditor you enforce MFA and showing them the tenant that does.

  • Evidence tagged by source, so verified and self-attested never blur
  • Mapped to the Annex A controls it satisfies, automatically
  • Carried through the crosswalk into SOC 2, NIST, CIS, POPIA and GDPR
  • Feeds questionnaire auto-answer with a citation
evidence registersha-256
A.5.17MFA enrolment exportverified
A.8.13Backup job historyverified
A.5.18Quarterly access reviewexpires in 11d
A.8.7Endpoint protection reportself-attested
A.8.8Pen-test finding PT-014verified
beyond the connectors

Ways evidence gets in

Upload

Drag a file onto a control. It's hashed on capture and stamped with who attached it and when.

manual

Connected systems

Pulled from M365, Google Workspace or Entra ID and marked verified, with a 90-day life.

automatic

Your own pen tests

Every validated finding lands against the control it breaks — and a clean pass is evidence toward that control.

closed loop

Encrypted credentials

The keys behind a connection are held encrypted, so a connector stays connected without anyone re-authorising it every week.

settings

Expiry that nags you

Verified evidence carries a 90-day life. When it lapses it reappears on the compliance calendar and in the weekly digest instead of silently passing.

freshness

Exportable

Everything attached can leave with you — the auditor pack, the Statement of Applicability and the evidence register export.

no lock-in

Connect once. Stop screenshotting.