The Evidence hub: sealed files, links, connectors and freshness

Evidence (under Do the work) is the cross-portfolio view of every record you hold as proof. Each row is one file, link or generated document, with its SHA-256 fingerprint, the obligations it satisfies across every framework, the system or organisation it belongs to, who filed it and when, and whether it is sealed.

Reading the hub

Four counts run along the top — Evidence files, Sealed, Pending seal and Lapsing ≤ 30 days — and the Seal state filter below them (Sealed · Pending · Lapsing) narrows the table to match. Two tabs keep the Library apart from the records set aside as Not applicable, which are retained but not counted. The columns are Evidence · Source · Review state · Version · Added by · Date, and each row's actions open its links: every obligation it proves, across every framework, and a way to reuse it elsewhere.

Three actions sit in the header:

• Upload evidence — a file (PDF, DOCX, XLSX, PNG or JPG, up to 10 MB) or a link the auditor can open, with a title, attached to an obligation (narrowed by system) or filed as an organisation-level record when it proves something across the whole workspace. Links are re-checked on a schedule: a broken link is flagged and drops back to pending, while a link that resolves is not thereby accepted — a person reviews the record.
• Generate document — produce a document from a template, composed from the obligation data you have already entered; it is filed here as generated evidence.
• Export manifest — the list of every record with its fingerprint, for an auditor to check nothing changed.

Fingerprints and seals

Every record is hashed with SHA-256 on arrival. Re-uploading the same document is recognised as the same evidence rather than a duplicate, and one data-governance policy can satisfy obligations on a dozen systems — the hub shows that read-across. A record is sealed once verified; a generated document is sealed with the hash of the exact bytes produced. The same fingerprint travels into the audit bundle's integrity manifest and onto the public verify page. Everything that renders a hash uses one primitive, middle-truncated on screen and copied in full.

Links point at a version

A link between evidence and an obligation records which version it was made against. Where a generated document has since been regenerated, the link reports superseded rather than quietly resolving to the newer text — and the version that was linked stays retrievable in the Issued archive on Documents. Links the composition engine made are marked derived and cannot be removed by hand, because deleting one would make a completion figure lie; links a person declared are theirs to remove.

OAuth connectors — bring evidence in automatically

Rather than upload by hand, connect the tools your proof already lives in. The Connectors panel offers Google Drive, SharePoint / OneDrive, GitHub and Jira as read-only OAuth connections. Connectors not yet available to your workspace are shown as planned, and connecting is an admin action. Once connected, Sync pulls the most recent items in as Connected evidence, pending review like any other record, deduplicated so a re-sync does not pile up copies; Disconnect at any time. See OAuth evidence connectors: Drive, SharePoint, GitHub, Jira.

Freshness, expiry and renewal

Proof goes stale — a certificate lapses, a signed policy ages out, a dated screenshot stops reflecting reality. Veritome tracks this:

• Give a record an expiry date or a review cadence. Records with no expiry are evergreen.
• Each record carries a freshness state — fresh, expiring (inside the 30-day window) or expired — shown as a badge once it needs attention.
• A daily job reminds owners and admins as evidence approaches or passes expiry, and expired proof stops counting as proof until it is renewed. It does not change the obligation's status — the obligation is flagged at risk, not failed.
• Renew a record to re-verify it and roll its clock forward one cadence.

The Dashboard's Recorded progress panel repeats this count — expiring within 30 days, already lapsed. Links and freshness together are what let you walk into an audit knowing which obligations are proven, which are stale, and which are still bare.