Docs · Compliance evidence
Compliance evidence is an add-on that helps you keep the evidence an ISO 27001 audit asks for in one place. Each piece of evidence is dated, cannot be edited once it is created, is mapped to the controls it supports, and is signed off by a named person.
It does not certify you, and it does not decide what your controls should be. It records what you show and who approved it, and lets an auditor check that nothing has changed since.
Enable ISO/IEC 27001:2022 to load its 93 Annex A controls. The titles shown are Astrari's own short descriptions, not the text of the standard; use your licensed copy of the standard for its wording. A control that does not apply to you can be marked not applicable, with a reason.
You can also import your own checklist as a CSV with the columns ref,title,description,maps_to. A preview shows what will be created, updated and archived before anything changes. Re-importing updates rows by ref and archives rows that are no longer in the file; archived controls keep their evidence.
Each control shows one of four states:
An evidence record holds dated versions. A version has a title, a summary, the period it covers, the controls it supports and up to 20 files of up to 50 MB each: PDF, text, logs, CSV, JSON, images (PNG, JPEG), Word and Excel. HTML files are accepted but are only ever downloaded, never displayed in the browser.
When a version is created, its title, summary, period, files and controls are frozen under a SHA-256 manifest: a fingerprint of the version and of every file in it. The database refuses any later edit. A correction is a new version that supersedes the old one; both stay on the record.
Files are stored in a private, encrypted Backblaze B2 bucket for your organisation, with Object Lock retention, and are only ever downloaded through Astrari after a permission check.
Reviewers are assigned by the organisation owner, or by the client owner for a client's evidence. A client owner can choose from their own users and from the organisation's org-wide reviewers, who are shown by name only. A reviewer approves or rejects a version; a rejection needs a comment. A version is signed off when it has at least one approval and no rejection.
The person who created a version cannot sign it off. This is checked by the application and again by the database. The reviewer signs the manifest hash they were shown, so a sign-off always refers to exactly the content that was reviewed.
Shortly after 06:00 every Monday (UK time unless you change the timezone; the scheduler runs at ten past the hour), Astrari creates a new version of a weekly security posture record for the week just ended, with a PDF of what it observed. The first one appears within the hour of enabling ISO 27001 for a scope, covering the week just ended. A scope with no framework enabled gets no weekly record, even if its settings have been saved. Per server it covers:
Each record lists its own limits, such as servers that were offline during the week or weeks for which no record was made, and the time it was observed: figures reflect the state when the record was built, not at the end of the week. Astrari creates it, so any assigned reviewer can sign it off. Signing the latest one each month is enough for most audits. Snapshots can be turned off in the Compliance settings.
From Compliance → Auditor access, create a read-only link for an auditor, optionally limited to some controls or dates. Each link comes with a separate 8-digit passcode, shown once: send the passcode by a different route from the link. A link expires after 14 days by default, and at most after 30, and can be revoked at any time. Unless you choose otherwise, it shows signed-off evidence only.
Five incorrect passcodes pause the link for an hour and email the person who created it. A correct passcode opens a session of up to two hours. Every open, view and download is recorded, and you can see that log against the link.
Auditor links always use astrari.io. Some certification bodies prefer not to open external links, and use a screen-share or their own portal instead; the export pack covers that case.
An export pack is a ZIP prepared in the background: an index.pdf, one folder per control with its evidence, and a manifest.json that lists the SHA-256 of every file in the pack. You can prepare one from the dashboard, and an auditor can prepare one from their link. Packs are kept for 7 days.
To check a pack:
sha256sum over the files; each hash should match manifest.json.manifestCanonical; it should equal the version's manifestSha256, which is the hash its reviewers signed.Evidence is kept for 36 months after the end of its period by default, and can be set from 12 to 120 months. Organisation owners and admins can lengthen it (client owners for their client); only the organisation owner can shorten it. An increase applies at once; a reduction takes effect after 30 days, so a mistaken change can be undone before anything is removed. Evidence is removed only by the daily retention clean-up. Files are protected with B2 Object Lock in governance mode, so Incus Technologies can still honour a contractual request to delete an organisation's data.
With client sub-accounts, client users see only their own client's controls and evidence, and a client owner can add evidence, assign their own reviewers and create auditor links for their client. Organisation-level evidence stays with your staff.