​

Evidence Collection

Evidence proves a control is implemented and working. In Matproof, every control has an evidence panel that pulls from four different sources: This page covers how each source works and when to use which.

​

Automated: integrations

Connect tools you already use and Matproof scans them on a schedule, populating evidence on every control they cover.

​

Connecting an integration

Each integration is OAuth-scoped to the minimum read-only permissions needed. Matproof never writes to integrated systems unless you explicitly enable a write feature.

​

Automated: Device Agent

The Matproof Device Agent runs on each team member’s macOS or Windows machine and reports endpoint compliance signals every hour: disk encryption, screen lock, OS patch level, antivirus, firewall, MDM enrollment, plus a 6-hourly software inventory that’s matched against the NVD CVE database for vulnerable installed apps. Device-agent evidence flows to controls like:

• ISO 27001 A.8.1 (User endpoint devices), A.8.7 (Protection against malware), A.8.8 (Management of technical vulnerabilities)
• SOC 2 CC6.1, CC6.6, CC7.1
• HIPAA 164.308, 164.310, 164.312
• NIS2 Article 21(2)(d), 21(2)(g)
• DORA Article 9
• PCI DSS 6.3.1, 8.6.3

Roll out the agent to your team via People → [Member] → Devices → Send install link.

​

Automated: Cloud Tests

Cloud Tests run continuous configuration checks against your AWS / Azure / GCP environments — separate from the integration scan, focused on misconfigurations rather than identity. Failed checks produce findings; passing checks produce evidence.

​

Automated: Penetration Tests

Penetration Tests generates an AI-powered external pen-test report against a target URL on demand. The resulting findings flow into the Findings module; the report itself can be attached as evidence on annual-pen-test controls. For third-party penetration tests (when an external firm runs the test), upload the report manually as evidence on the relevant control.

​

Manual evidence upload

For controls that can’t be covered by an integration — internal procedures, BCP test results, board minutes, awareness-training screenshots, vendor SOC 2 reports — upload manually:

​

Bulk upload

For initial setup or annual refreshes, upload many files at once:

1. Go to Evidence → Bulk upload
2. Download the evidence-mapping template (CSV)
3. Fill in: filename, control IDs, description, expiry date
4. Upload the ZIP containing both the template and the files

Matproof maps each file to its declared control(s) automatically.

​

Evidence expiry

Every piece of evidence has an expiry date. Matproof emails the evidence owner 30 days before expiry so there’s time to collect a refresh. Sensible defaults by evidence type: You can override per control. Audit framework requirements often dictate the expiry — Matproof picks the strictest default.

​

Evidence Review

Evidence isn’t useful unless someone checks it. The Evidence Review module gives compliance leads a workflow to approve, reject, or request more from each piece of evidence as it arrives. Auditors typically expect this review trail.