Skip to main content

​
Overview

The Evidence Review workflow ensures that every piece of compliance evidence is validated before it counts toward your control status. Team members submit evidence, reviewers approve or reject it with comments, and every action is recorded in an immutable activity log that auditors can inspect.
Evidence Review is enabled by default. To configure who can approve evidence, go to Settings - Roles and Permissions.

​
How it works

​
Activity audit log

Every evidence action is recorded in the activity log with: The activity log is immutable - entries cannot be edited or deleted. This provides a complete chain of custody that auditors require. To view the log:
  1. Open any evidence item
  2. Click the Activity tab
  3. The full history is displayed in chronological order
During audits, export the activity log for specific controls by going to Controls - Export and selecting Include evidence activity log. This gives auditors the evidence chain without needing platform access.

​
Review queue

The review queue aggregates all pending evidence across your organization:
  • Access it from Evidence - Review queue in the sidebar
  • Filter by framework, control, submitter, or date
  • Sort by submission date to process oldest items first
  • Bulk approve multiple items if they share the same review criteria

​
Configuring reviewers

By default, the Owner and Admin built-in roles can approve evidence. Auditor, Employee, and Contractor can submit but not approve. To grant approval rights to additional people without elevating them to Admin, define a custom role with the evidence-approval permission:
  1. Go to Settings → Roles & Permissions
  2. Click New role and grant the Evidence module’s Approve permission (alongside any other permissions the role needs — usually View on Controls and Frameworks)
  3. Assign that custom role to the people you want as reviewers
  4. Optionally, configure per-framework reviewers so that DORA evidence is reviewed by one team and ISO 27001 evidence by another
See Roles & Permissions for the full role model and how custom roles work.
Segregation of duties matters for audits. The person who submits evidence should not be the same person who approves it. Configure your roles to enforce this separation.

​
Automatic evidence review

For evidence collected automatically from integrations (GitHub, AWS, Google Workspace, etc.), you can configure auto-approval rules:
  1. Go to Settings - Evidence - Auto-approval
  2. Define rules based on evidence source and type
  3. Automated evidence that matches a rule is approved automatically
  4. A log entry records the auto-approval with the rule that triggered it
Auto-approval is useful for recurring, well-understood evidence (like MFA status checks or access logs) where manual review adds no value.
Auto-approved evidence is still visible in the activity log and can be manually revoked if needed.