Evidence
Every document kept, every version accounted for.
Certificates, policies and reports arrive through the portal, are checked and scanned before anyone opens them, and are never overwritten.
Handled carefully from the moment it arrives
- Uploads land in a separate quarantine area. The file type is checked from its contents, not its name, and it is scanned for malware by a scanner with no internet access.
- Each file is fingerprinted with SHA-256 so you can tell if it ever changes. Files that fail are kept in quarantine and never served.
- PDF, Word, Excel, images, text and CSV are accepted, up to 50 MB each.
- Downloads use links that expire within five minutes, after a permission check, and every download is recorded.
Certificates, described properly
- Suppliers say which scheme a certificate belongs to, including Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance, ISO/IEC 27001, 27701, 22301, 9001, 14001, SOC 2 Type I and Type II, and PCI DSS attestations.
- They record the certificate number, issuer, scope and dates. The number is shown “as stated by the supplier”, because that is what it is until one of your people checks it.
- A fingerprint shows a file has not changed since upload. It does not show a document is genuine, so we never call a document verified on its own.
New versions never rewrite history
- When a supplier uploads a new version, you are told, but reviews and decisions keep pointing at the version they relied on.
- Expired evidence lowers confidence in a control. It does not claim the control has failed.
See it with your own suppliers.
We are looking for a small number of early customers to pilot it with. Tell us how you look after suppliers today and we will show you how it would work for you.