Typed artifacts
Document, screenshot, export, attestation, log, or configuration — so the library is searchable, not a dump.
Platform · Evidence
File what you have. Keep the provenance.
Evidence is a record, not a vibe. Title, type, source, timestamp, optional hash, and a link to the control it supports. Connectors attach a snapshot. They do not mark the control passing.
Why it exists
Auditors ask for artifacts, not screenshots of a dashboard.
A passing pill in a SaaS UI is not evidence. ReadyComply stores the artifact metadata against the system and, when you have it, the control. You can point at a file, a date, a source, and a person.
In the workspace
What you can file today.
Bound to a system
Every item belongs to a system. Optionally link it to a control instance so the register stays joined.
Hash when you have one
Optional SHA-256 if the artifact is already stored. ReadyComply does not pretend it holds the blob forever.
Collected-at and source
When it was taken and where it came from. That is the minimum an examiner will ask.
Connectors
Collectors pull. They do not certify.
Authio, GitHub, Railway, AWS, GCP, and Azure attach a dated snapshot to a control. Status stays a human field. File by hand when a provider is not connected.
Also in ReadyComply
Evidence is useless without the rest of the register.
Controls
Scope SOC 2, ISO 27001, HIPAA, and GDPR families to each system. Track status, owner, and why something is out of scope.
Policies
Versioned drafts next to the controls they support. Know which text is current.
Remediation
Turn gaps into owned work with a due date. Who closed what is part of the record.
Start with what you can already prove. Date it.
Sign in. Pick a system. File the first export you already have.
Sign in