Evidence cards

The core review artifact for procurement, security, and legal.

Every vendor package becomes an evidence card — documents received, missing items, risk lane, owners, and recommended decision. Every AI conclusion links to source documents.

Evidence Card Field	Content
Vendor name	Legal entity and product name
Vendor category	SaaS · infrastructure · AI · financial · critical
Data classification	PII, PHI, financial, confidential, public
Documents received	SOC 2, ISO, DPA, pen test, insurance, questionnaires
Missing evidence	Gaps flagged before approval
Questionnaire status	SIG / CAIQ / custom responses reviewed
Risk lane	Low-risk SaaS through critical infrastructure
Recommended decision	Approve · conditional · reject · hold
Owner	Procurement, security, legal, or GRC reviewer
Audit trail	Upload, extraction, review, and approval events

Example evidence card — Lattice (SaaS · HR)

Field	Lattice example
Vendor	Lattice · lattice.com · HR performance management
Service type	SaaS · HRIS · employee performance management
Business owner	procurement@acme.io · People Ops
Data access level	Medium · employee PII · US + EU
PII processing	Yes · names, reviews, compensation bands
Security evidence	SOC 2 Type II (Oct 2025) · Lattice_SOC2_TypeII_2025.pdf p.4
Privacy evidence	DPA v3 · Lattice_DPA_v3.pdf §3.2
Contract evidence	MSA pending · DPA executed 2026-01-28
Insurance evidence	Not in package · flagged missing
Missing files	Pen test attestation · BCP summary
Expiration dates	SOC 2 expires 2026-10-31 · DPA no expiry
AI summary	Processes employee PII · sub-processor clause needs legal review · source: DPA §4.2
Human review status	Security review · pending pen test
Recommended decision	Conditional approve — pending pen test attestation
Owner	security@acme.io · backup: grc@acme.io
Last updated	2026-03-20 11:04 UTC

Upload real vendor packages and generate evidence cards.

Upload vendor docs
→ Extract fields with AI
→ Flag missing evidence
→ Route for review
→ Export audit-ready cards

Start vendor queue