Evidence Room
The proof behind each “yes”
An answer of “yes” is a claim. The Evidence Room holds what backs it up: the policy, the signed clause, the screenshot of the setting, the access list. Each item is attached to the control it shows, with a date by which it should be reviewed.
| Ref | Evidence | Control | Kind | Review by | State |
|---|---|---|---|---|---|
| EV-001 | Privacy notice, version 3, published on the website | B-01 | Policy or procedure | 31 Aug 2027 | Evidence attached · self-assessed |
| EV-002 | Signed data terms with the courier partner | D-01 | Contract or clause | 30 Jun 2027 | Evidence attached · self-assessed |
| EV-003 | Screenshot of checkout showing the unticked marketing box | B-02 | Screenshot | 31 Mar 2027 | Evidence attached · self-assessed |
| EV-004 | User list showing individual logins to the order system | E-01 | Register or list | 30 Sep 2026 | Review due |
01How it works
- Attached to a control. Each item belongs to one control, and the control’s state follows: self-declared, evidenced, review due.
- Fingerprinted. Each file gets a SHA-256 fingerprint, listed in the evidence index, so a copy can be checked against the original.
- Dated. After its review date, an item stops counting as current evidence until it is replaced.
- Checked on upload. PDF, Word, Excel, CSV, text, PNG and JPG up to 10 MB, and the contents must match the file type.
- Private. Files are stored outside the public web folder and served only to members of your account, or to a reviewer during a review you requested. Every download is recorded.
- Withdrawn means deleted. Withdrawing an item deletes its file.
The Evidence Room is for evidence, not for customer data. Upload policies, clauses and screenshots of settings. Redact customers’ names and numbers from anything you upload.
Part of DPDP Remediation.