Evidence

Evidence library in Keel

Evidence is what an auditor actually reviews: the artifacts that prove a control is really happening. Keel keeps evidence organized, connected to the controls it supports, and fresh enough to stand up at audit time.

Uploading evidence

On the Upload tab of Evidence, add a screenshot, configuration export, report, or document, give it an optional title, and pick how often it should be re-collected. Each artifact lives in your workspace’s evidence library on the Files tab, where you can find it later and reuse it. Because one artifact often proves several things at once, evidence isn’t locked to a single control. The Upload tab also shows how much of your plan’s storage is in use.

You can also paste a Source URL: the page a screenshot shows, or the report an export came from. Keel records who uploaded each item, and the evidence record shows both under Captured by and Source, next to the collection time and the file’s SHA-256 hash. Items filed by a connector or an automated check name that instead. Items uploaded before this was recorded show no name.

Linking evidence to controls

On the Files tab, attach an artifact to the control (or controls) it supports by typing the control key in its row. Thanks to the framework crosswalk, a control can satisfy requirements in several frameworks, so a single, well-chosen piece of evidence can improve your coverage across multiple standards at the same time. This is the practical payoff of collect once, comply everywhere: gather the proof once, and it counts everywhere the control applies.

The shape of that is easier to see than to read. Take a real case from Keel’s starter control set: the MFA enforcement setting exported from your identity provider, attached to the multi-factor authentication control. These are the frameworks in Keel’s catalog where that one control scores a requirement:

One evidence artifact, attached to one control, counted against the requirements each of those frameworks states for it, then collected, labelled, and reviewed a single time.

Only the frameworks you have applied count toward your readiness, so how much of this a given workspace sees depends on your program. One thing to know when you map a clause to a control yourself: the clause picker lists the section and theme headings a framework uses to organize its requirements alongside the requirements themselves. Keel keeps a mapping you make to a heading, but scores nothing for it, because readiness is measured against the requirements underneath a heading rather than the heading itself. Map to the requirement if you want it to move your number. Your workspace is the source of truth for the actual mappings.

Environment and population

Each evidence item can carry two labels, set on its page under Owner, labels and review date. Environment says which system the proof came from: production, staging or other. Population says whose accounts it covers: employees, contractors, former staff or service accounts. An auditor sampling user access wants to know both before trusting a list.

A control can say which environment its evidence must come from. Open the control and pick one under Evidence from. Evidence from a different environment, or with no environment label, shows a “Not from” warning on the control so you can replace it.

On the access review controls (user lifecycle and access control policy) the requirement is a hard stop instead of a warning. Keel refuses to link evidence from the wrong environment, and refuses to relabel linked evidence away from the required one. Records Keel files on its own, such as a completed access review, are saved but not linked to such a control until you label them to match and link them. Clear the requirement on the control to lift the stop.

Keeping evidence fresh

Auditors want current proof, not a screenshot from two years ago. Keel tracks a review date on evidence so you can see at a glance what’s current, what’s expiring, and what’s already expired. The Files tab opens sorted stalest first, and its freshness filter narrows the list to the items that need re-collecting. Refresh aging artifacts before they lapse to keep your program audit-ready between formal reviews rather than scrambling right before one.

Each weekday, Keel also emails a reminder about evidence that expires within 30 days or expired in the last 30. The reminder goes to the item’s owner. When an item has no owner, it goes to every owner and admin. Each person gets one email per workspace that lists every item, and an item is reminded at most once a week. Setting a new review date makes it eligible for a fresh reminder. Evidence an automated check produces is left out, because the check renews it.

Deleted evidence

Deleting evidence doesn’t destroy it. The item moves to the Deleted tab along with its control links, the evidence requests it was attached to, and every auditor review written on it. The file stays in storage. Restore puts all of that back under the same record, so links that point at the item still work. A request or control that was itself removed in the meantime isn’t recreated.

Deleted files still count toward your plan’s storage. To free the space, an owner or admin can choose Delete permanently. That’s the only delete that can’t be undone, and the activity log records who did it.

If a connector or automated check filed a new item for the same check after the delete, the old one can’t be restored. The new item replaces it.

Know what to collect

Not sure what an auditor expects for a given framework? The To collect tab lists, for each framework you have applied, the controls that need evidence and the kinds of artifacts typically accepted for each one. Controls that already have evidence linked are marked, so the list doubles as a gap checklist. With no framework applied yet, it shows the guidance for every starter control.

AI evidence summaries

From an item’s menu on the Files tab, Summarize writes a short summary of what the item likely shows, the controls it supports, and what’s still missing. It works from the item’s metadata and its linked controls, not from the file’s contents. Saved summaries are on the AI summaries tab. Each run uses AI credits.

AI: Review evidence for sufficiency

On a control’s page, Keel’s AI evidence sufficiency review looks at the evidence linked to that control and gives a hedged verdict on whether it is likely sufficient, plus what’s missing or weak. Like summaries, it works from evidence metadata rather than file contents. It’s an optional, credit-metered sanity check that catches gaps before an auditor does. Learn how credits work in AI tools & credits.

Next steps

Evidence-readiness meter: see how audit-ready your evidence is at a glance.
Frameworks & crosswalks: why one artifact can cover several frameworks.
Trust Center: turn your posture into something prospects can see.