Evidence

Ready for the audit, any day.

Evidence tests your controls around the clock, collects the proof, fixes what drifts, and hands your auditor everything they ask for.

100% free, open source alternative to Vanta, Drata and Secureframe

Run Evidence Try the demoRead the docs
CC6.1Logical access
CC7.2Monitoring
Exhibit AMFA enforced for all 42 users
OktaChecked 9:00 AM
SOC 2 Type II94% ready
Exhibit BS3 buckets encrypted
AWS12 of 12
Exhibit CLaptop disk encryption
1 failing → fixed, re-tested
  • Policies
  • Access reviews
  • Vendor risk
  • Trust center

Every claim has its proof.

OktaAWSGitHubGoogleJamf
  • AWSCloud infrastructure
  • GitHubDevelopment
  • Google WorkspaceProductivity
  • OktaIdentity
  • HR systemsPeople
  • Device systemsEndpoints

Your first SOC 2 · March to December

From first scan
to signed report.

Your first SOC 2 Type II, from the day a customer asks for it.

Observation window · Apr 1 – Sep 30 · every control tested daily
MarAprMayJunJulAugSepOctNovDec

Mar 3A bank asks for a SOC 2 report

Mar 4rer setup · first scan: 31 gaps

Mar 300 gaps open

Jul 141 drift, fixed by 11:40 AM

Sep 30 · window closes15,738 daily results kept

Nov 2Fieldwork · Harbor & Lane CPAs

Dec 9Report issued · no exceptions

  1. Mar 3A bank asks for a SOC 2 report

  2. Mar 4rer setup · first scan: 31 gaps

  3. Mar 300 gaps open

  4. Apr 1Window opens · every control tested daily

    Observation window · Apr 1 – Sep 30

  5. Jul 141 drift, fixed by 11:40 AM

  6. Sep 30Window closes · 15,738 daily results kept

  7. Nov 2Fieldwork · Harbor & Lane CPAs

  8. Dec 9Report issued · no exceptions

Mar 4 · Day one

Every gap, found on day one.

Connect your cloud, code, identity, HR and device systems once. The first scan tests every SOC 2 control and names what fails.

First scan · Mar 4, 10:12 AM

86 controls · 55 passing · 31 to fix

  • AWS9CloudTrail off in 2 regions
  • GitHub6No branch protection on 3 repos
  • Okta4MFA not enforced for 5 users
  • Jamf34 laptops unencrypted
  • Policies7Not yet written
  • Rippling23 leavers still active in Okta

Connected in 11 minutes: AWS, GitHub, Okta, Jamf, Rippling, Google Workspace

Mar 4 – Mar 30 · Fixing

Each fix gets tested again.

Each failing test becomes a task for the person who can fix it, in Slack or Jira. When the fix lands, Evidence runs the test again.

#security

Evidence

GitHub · branch protection off on 3 of 14 repos · CC8.1

Owner: Sam Patel · due Mar 12

Evidence

Re-tested Mar 11, 10:42 AM · 14 of 14 protected

Gaps

31 0

Mar 30

Mar 16 – Mar 25 · Policies and people

Signed by everyone.

Start from templates, approve each policy once, then every person signs and finishes training. New hires get the same list on day one.

Information Security Policy · v1

Approved Mar 16 by Dana Lee, CEO

  • JL
  • DL
  • SP
  • AK
  • MR
  • PS
  • TO
  • CB
  • EH
  • NG
  • BW
  • MS
  • KT
  • AR
  • DC
  • LH
  • JM
  • RS
  • TN
  • EK
  • GP
  • SW
  • AB
  • MC
  • HL
  • NP
  • JW
  • CR
  • DM
  • RV
  • KB
  • LT
  • AS
  • BH
  • MJ
  • EP
  • RG
  • SK
  • TW
  • CM
  • AL
  • JH

42 of 42 signed

  • DL
  • SP
  • AK
  • MR
  • PS
  • TO
  • +36

42 of 42 trained

  • Access Control
  • Incident Response
  • Change Management
  • Vendor Management
  • Business Continuity
  • Data Retention
  • Acceptable Use
  • Encryption
  • +14 more

18 policies

42 of 42 signed42 of 42 trained

  • RV · Riya Varmareminded Mar 19 · signed Mar 20

  • JL · Jenna Lopezjoined Mar 25 · signed and trained day one

Apr 1 – Sep 30 · Observation window

183 days, tested every day.

A Type II report covers months, not a moment. Evidence tests every control around the clock and keeps each day's result with its time and source.

  • oktaCC6.1 · Logical access
  • jamfCC6.7 · Laptop encryption
  • GitHubCC8.1 · Change management
  • A1.2 · Backups
  • CC7.2 · Monitoring

    Jul 14, 2:00 AM · CloudTrail off in us-west-2 → fixed 11:40 AM

86 controls · 15,738 daily results · 1 failure, fixed the same day · every result kept with its source

CC7.2 · Monitoring

183 of 183 days tested · Apr 1 – Sep 30

  • Apr
  • May
  • Jun
  • Jul

    Jul 14, 2:00 AM · CloudTrail off in us-west-2 → fixed 11:40 AM

  • Aug
  • Sep

CC6.1 · CC6.7 · CC8.1 · A1.2 · every day passing

Jul 14 · The Evidence agent

Drift at 2:00 AM,
proof by noon.

The agent traces a failed test to its cause, asks for one narrow fix and tests the real system again. The original failure stays on the record.

Investigation · CC7.2 Monitoring

  1. 2:00 AM · Observed

    CloudTrail off in us-west-2

  2. 2:06 AM · Traced

    region added in Terraform PR #482 without a trail

  3. 2:09 AM · Fix requested

    Sam Patel · add a trail to us-west-2 only

  4. 9:31 AM · PR #487 merged

  5. 11:40 AM · Re-tested

    4 of 4 regions logging

Failure E-2291 kept · linked to its fix and re-test

PR #487 · terraform/cloudtrail.tf · +6 −0

Exhibit D

CC7.2 Monitoring183 of 183 days testedE-2291 fixed Jul 14

SOC 2 Type II100% ready

Sep 30 · Window closed · Fieldwork Nov 2

Nov 2 · Fieldwork

121 requests,
answered from proof.

Your auditor gets a workspace for your audit period. Each request links to tested proof with its source and time.

Harbor & Lane CPAs · SOC 2 Type II · Apr 1 – Sep 30, 2026

121 of 121 provided

RequestProof attachedSourceProvided
PBC-003 Employee list at period endExport of 42 employees, Sep 30RipplingProvided Nov 2
PBC-014 User access list42 users with rolesOktaProvided Nov 2
PBC-021 Sample of 25 changes25 PRs, each reviewed and checkedGitHubProvided Nov 2
PBC-027 Laptop encryption183 daily test resultsJamfProvided Nov 2
PBC-033 Background checks, new hires6 of 6 clearedCheckrProvided Nov 2
PBC-041 CC7.2 drift, Jul 14Failure E-2291, fix and re-testGitHub PR #487Provided Nov 2
PBC-058 Board minutesUploaded by Dana LeePDFProvided Nov 4
PBC-064 Penetration testReport dated Aug 20PDFProvided Nov 2

Dec 9 · Trust center

Every answer cites its proof.

Publish your report in a trust center. Evidence answers security questionnaires from verified proof, and every answer cites its source.

Larkspur Trust Center · SOC 2 Type II

Bank vendor security review · 212 questions

  • Encrypt data at rest? · AES-256 on all 12 S3 buckets

    Exhibit B

  • MFA for all staff? · Enforced in Okta, 42 users

    Exhibit A

  • SOC 2 Type II report? · Issued Dec 9, no exceptions

    Report

  • Change review? · 25 of 25 sampled PRs reviewed

    PBC-021

209 answered from evidence · 3 sent to Dana Lee

Next year · ISO 27001

One more framework,
same tests.

SOC 2, ISO 27001 and HIPAA share controls, so one passing test counts everywhere it applies.

Add framework · ISO 27001:2022

71 of 93 controls already tested

  • A.5.15 Access controlCC6.1

  • A.8.24 CryptographyCC6.7

  • A.5.24 Incident management planning · new · owner Dana Lee

Coming from Vanta, Drata or Secureframe?

Import controls, policies, evidence and vendors, and check every count before you switch.

  • 86 controls
  • 18 policies
  • 1,412 evidence files
  • 37 vendors

Your auditor still signs.

Evidence is not an auditor. A licensed CPA firm still tests your controls and signs your report.

Read the limits

Walk into every audit calm.

Open source compliance for SOC 2, ISO 27001 and HIPAA.

Run Evidence Read the docs

Free and open source, MIT licensed.