SECURITY — EVIDENCE FIRST
SOC 2 TYPE II
ISO 27001
EU HOSTED
PEN TESTED 2026
01 — CONTROLS
Not assertions on a marketing page. Each item links to the test, the timestamp and the owner.
Access control
SSO, SCIM and hardware keys for every employee. Privileged access is reviewed monthly and expires by default.
SSO · SCIM · MONTHLY REVIEW
Encryption
TLS 1.3 in transit, AES-256 at rest, per-tenant keys. Customer-managed keys available on Enterprise.
TLS 1.3 · AES-256 · BYOK
Residency
EU hosting by default in Frankfurt and Dublin, with regional pinning and no cross-region replication.
FRANKFURT · DUBLIN
Availability
99.95% measured uptime over the last twelve months. Status history is public and incident post-mortems are published.
99.95% · TWELVE MONTHS
Change management
Every deploy is peer reviewed, tested and recorded. Production access is time-bound and logged.
PEER REVIEW · TIME-BOUND
Vendor review
Subprocessors are reviewed annually against the same control library we sell. The list is public.
ANNUAL · PUBLIC LIST
MEASURED OVER THE LAST TWELVE MONTHS
AS OF Q1 2026
99.95%
uptime, measured externally and published without adjustments
0
critical findings open at the close of the last audit
24h
first response on any coordinated disclosure
02 — HOW WE OPERATE
A trust page ages badly. These are the routines that keep ours true.
01
Evidence collects on a schedule, not before an audit
Controls pull from source systems continuously. When an auditor asks for a quarter, we export a quarter — not a scramble of screenshots.
CONTINUOUS · SOURCE-LINKED
02
Access expires unless someone renews it
Guest access for auditors and buyers carries an expiry date. Every read is logged and attributable to a named person.
GUEST EXPIRY · ACCESS LOG
03
Disclosure runs on a clock
Report a vulnerability to security@evident.systems. We acknowledge within 24 hours, triage within three days and publish a summary when fixed.
24H ACK · 3D TRIAGE
03 — QUESTIONS FROM REVIEWERS
Where is our data hosted?
In the EU by default: Frankfurt primary, Dublin failover, no replication outside the region. Enterprise deployments can be pinned to a single region or run in your VPC.
Do you train models on customer data?
No. Evident does not train foundation models on customer content. Retrieval for the questionnaire assistant is scoped to your tenant and logged.
Can we use our own keys?
Yes, on Enterprise. Customer-managed keys are supported for evidence storage, with rotation handled by your KMS and no plaintext retention on our side.
How are subprocessors handled?
Every subprocessor is listed publicly, reviewed annually and bound by the same DPA terms. We notify customers thirty days before adding a new one.