Proof you can hand to an assessor — with the history intact.
Every control result in AssurIQ rests on evidence: a collector observation, a connector read, an uploaded artifact or a recorded attestation. The Evidence Vault keeps that evidence with its provenance, its integrity hash and its full history, and maps it to every control and framework it supports.
- Aug 04Evidence GapNo evidence on fileControl created from HIPAA pack mapping
- Aug 06PartialCollector · endpoint census3 of 41 workstations still on unsupported OS
- Aug 19PartialManual upload · lifecycle planReplacement schedule attached, exception requested
- Aug 27PassCollector · endpoint censusAll endpoints on supported OS · confidence 94
Every record says where it came from and how much to trust it.
Collector evidence
Connector evidence
Manual & attested evidence
Integrity
Append-only history
Scoped auditor access
A control that went Partial and came back tells a better story than one that was always green.
Assessors are rarely impressed by a perfect record. They are reassured by an honest one: the gap was seen, the fix was made, the control was re-verified, and the evidence for every step is here.
- Per-control timeline of state changes and the evidence behind each
- Evidence quality drives assurance confidence, not just presence
- Expiring manual evidence lowers confidence before it lowers the state
- Aug 04Evidence GapNo evidence on fileControl created from HIPAA pack mapping
- Aug 06PartialCollector · endpoint census3 of 41 workstations still on unsupported OS
- Aug 19PartialManual upload · lifecycle planReplacement schedule attached, exception requested
- Aug 27PassCollector · endpoint censusAll endpoints on supported OS · confidence 94
Collect once. Prove everywhere.
Because evidence attaches to universal controls rather than to framework line items, the same tested-restore record satisfies HIPAA contingency planning, the insurance baseline and the NIST CSF recovery function in one step.
- One artifact supports one control, mapped to every framework requirement it satisfies
- Evidence gaps listed per framework so collection is targeted
- Bulk requests to customers for the manual pieces that remain
| Control | State | Confidence | Latest evidence |
|---|---|---|---|
AIQ-IAM-002 MFA enforced for privileged cloud identities | Fail | 96 | Identity connector · 2h ago |
AIQ-NET-011 Internet-facing services free of known-exploited CVEs | Fail | 98 | Collector scan · 40m ago |
AIQ-END-004 Endpoints run supported operating systems | Partial | 88 | Asset inventory · 1h ago |
AIQ-BCK-001 Backups tested for restore within policy window | Evidence Gap | — | No evidence attached |
AIQ-NET-003 Guest / IoT traffic segmented from corporate VLANs | Pass | 92 | Topology snapshot · 40m ago |
Snapshots with evidence attached, not just percentages.
Report Studio builds assessor packs directly from the vault, so what leadership approved and what the assessor receives are the same evidence set.
- Point-in-time freeze of controls, states, confidence and artifacts
- Shareable with expiring auditor access instead of email attachments
- What changed since the previous snapshot, in plain language
- Evidence gaps reduced 14 → 6; backup restore proof still open
- Privileged MFA moved PARTIAL → PASS and held for 61 days
- 1 approved exception expires in 41 days
- Collector coverage 97% of known subnets
Evidence of controls, not copies of customer data.
AssurIQ collects configuration state, metadata and proof of safeguards. It is not designed to ingest customer documents, patient records or deal files. Where documentation credentials must be stored, values are encrypted and only decrypted server-side, with every reveal logged.
- Metadata, configuration and security state over content
- Row-level tenant isolation on every evidence record
- Encrypted secret values, server-side reveal, audit log
- Retention policies per tenant
AssurIQ provides continuous assurance, readiness, evidence, risk and remediation support. It does not certify an organization as compliant, a passing dashboard is not a legal determination, and AssurIQ does not make breach-notification decisions. Framework mappings use original AssurIQ summaries, not reproduced standard text.
Manage the endpoint. Understand the infrastructure. Prove the controls.
Explore the connected platform, or talk with the AssurIQ team about a controlled Windows RMM pilot. No production data is required to explore the fictional sandbox.