Control evidence

Security › Reports › Control evidence (/<org>/_admin/security/reports/control-evidence) shows what happened in your organisation in a period, mapped to SOC 2 Common Criteria and ISO 27001 Annex A controls. It reads the same hash-chained audit log; it is a view of it, not a separate record.

For documents about fremforge as your vendor (sub-processors, inherited certifications), see Vendor attestation.

What it shows

• The latest anchor of your audit hash chain, and how far the chain has been archived.
• Per framework, each control in scope with the number of events in the period and the first and latest.
• A drill-down per control, listing its events.

The default period is the last 90 days.

Signed bundle

Generate signed bundle downloads a zip for the period: a JSON manifest with the counts per control and the underlying audit rows, and a PDF. The same bundle is GET /_app/api/v1/orgs/{org}/compliance-evidence?from=YYYY-MM-DD&to=YYYY-MM-DD (scope audit:read), with a period of at most one year.

The manifest is signed with HMAC-SHA-256, using a key fremforge holds. An HMAC is a shared-key signature: it shows the bundle was not changed after fremforge made it, to someone who can check it with fremforge, but your auditor cannot verify it alone. For integrity your auditor can check independently, use the audit chain.