Security & Data

Designed for sensitive programme information.

The governing principle is data minimisation: capture what is necessary to support the assurance conclusion, not an unnecessary copy of the client's programme repository.

Data minimisationEvidentic does not require wholesale ingestion of client document repositories.
Engagement segregationClient and engagement information is intended to remain separated, with access limited to authorised users.
Controlled accessRole-based access, strong authentication and least-privilege administration are governing controls for production use.
Retention & deletionRetention is defined by engagement or contract, with explicit deletion expectations.
Transparent AI useThe core methodology is non-AI. Any optional AI-enabled processing should be disclosed, controlled and capable of being disabled.
Transparent supply chainHosting, subprocessors and applicable data-residency arrangements should be disclosed for production services.
Lower-data assurance

Evidence can remain where it already lives.

Where confidentiality requires it, the assessor can record the evidence source, relevant finding and confidence while the underlying document remains in the client's controlled repository.

Security and data protection illustration

Security claims should be evidenced too.

Evidentic does not claim certifications or controls that have not been implemented and demonstrated.