Evidence that
proves itself
A screenshot in a folder is a claim. Evidence read from the system that enforces the control is proof. Connect Microsoft 365 and Entra ID and Xee records what it actually observes against the controls it satisfies — with an expiry date, so it can't quietly rot.
The stack you already run
Connect once through a read-only app registration; evidence keeps arriving against the controls it belongs to.
- Microsoft 365 & Entra ID — MFA registration, conditional access, audit logging, device compliance, privileged role membership
- Google Workspace — in development
- Read-only, always — the connector holds no write permission on your tenant
- Plan limits are real — Growth connects one, Scale connects as many as you need
Three things make it evidence
Integrity, freshness, and not lying about the third one. Without all three, an auditor is right to be sceptical.
- SHA-256 on capture — every uploaded artefact hashed the moment it lands
- 90-day expiry on connector evidence, re-collected daily, so stale proof surfaces as a gap
- "Verified" is earned — only a live check that ran and passed gets the label
- Audit trail — who attached what, when, and from where
Self-attested → independently verified
Connect Microsoft 365 during a demo and the verified-evidence count jumps from zero. It's a small number on a dashboard, and it's the difference between telling an auditor you enforce MFA and showing them the tenant that does.
- Evidence tagged by source, so verified and self-attested never blur
- Mapped to the Annex A controls it satisfies, automatically
- Carried through the crosswalk into SOC 2, NIST, CIS, POPIA and GDPR
- Feeds questionnaire auto-answer with a citation
Ways evidence gets in
Upload
Drag a file onto a control. It's hashed on capture and stamped with who attached it and when.
manualConnected systems
Pulled from M365, Google Workspace or Entra ID and marked verified, with a 90-day life.
automaticYour own pen tests
Every validated finding lands against the control it breaks — and a clean pass is evidence toward that control.
closed loopA failed check is a gap
When a connector looks and finds the control isn't met, that's recorded against the control as a gap — never quietly filed as proof that it is.
honestEncrypted credentials
The keys behind a connection are held encrypted, so a connector stays connected without anyone re-authorising it every week.
settingsExpiry that nags you
Verified evidence carries a 90-day life. When it lapses it reappears on the compliance calendar and in the weekly digest instead of silently passing.
freshnessExportable
Everything attached can leave with you — the auditor pack, the Statement of Applicability and the evidence register export.
no lock-in