One-upload, grade-per-requirement
AEGIS scores each document against every requirement it touches.
Capture evidence once, credit every framework, auto-graded against each requirement.
EvidenceEdge is the evidence engine of the SecureEdge Advisory family. Upload a policy, report or configuration once. AEGIS grades it against each control requirement, and ControlRegistry reuses that approval across every framework the control maps to. One capture, many frameworks credited.
Built for cert-prep teams tired of re-collecting the same evidence for SOC 2, ISO 27001 and every regional framework.
The evidence, not the controls, is what runs a first audit late. This is where that work is done once rather than reassembled under time pressure.
The same document answers requirements in more than one standard. Approve it once and the credit follows the mapping.
Evidence gathered here persists with its date, its grade and its approval, so the second cycle starts from a position rather than from nothing.
AEGIS scores each document against every requirement it touches.
Approve once and the equivalent control is credited elsewhere, through ControlRegistry.
An external auditor asks; you answer in context, sealed and crypto-verifiable.
Extracted evidence text is encrypted at rest (AES-256-GCM).
A policy, report or configuration is attached where it is meant to answer something, rather than into a folder someone later has to interpret.
A document is not passed or failed as a whole. Every requirement it touches is assessed on its own, so a strong document with one gap reads as exactly that.
Once approved, the equivalent control in another framework is credited, with the mapping strength stated. Where no mapping exists, nothing is credited.
A request lands on the control it concerns. The response, and what was released, are recorded as they happen.
Stated deliberately. A product that only lists what it can do leaves the reader to discover the boundary themselves, usually at the worst moment.
It prepares the pack and facilitates the audit. The certificate is issued by a certification body, and the opinion by an auditor.
It grades evidence against what the control asks for and shows its reasoning. Sufficiency is the auditor's judgement.
Where nothing has been provided, it reports that. An empty control is shown as empty rather than inferred from a neighbouring one.
An auditor sees what has been deliberately released. Internal drafts, rejections and discussion stay internal.
The control library underneath. Cross-framework credit is only as good as the mapping, and the mapping lives there.
Upstream. A maturity position identifies where evidence will be needed before collection begins.
The other side of the same engagement. What is released here is what the auditor sees there.
Certification preparation reads the evidence position rather than tracking it separately.
| Feature | Milestone | Scope |
|---|---|---|
| One-upload → grade-per-requirement | v1.0 | In MVP v1.0 |
| Cross-framework credit (ControlRegistry) | v1.2 | Planned |
| Field-level encryption | v1.3 | Planned |
| Auditor request lane | v1.4 | Planned |
| Evidence freshness / expiring dashboard | v1.5 | Planned |
| Register-template gallery | v1.5 | Planned |
| Live pull-credit (regrade + four-eyes) | v1.6 | Planned |
Milestones are roadmap targets rather than shipped dates. Target for MVP v1.0: Q3 2026. Provisioning is white-glove, never self-serve.
Every SecureEdge Advisory product prepares you for a certification, an audit or an assessment. None of them awards one. A certificate is issued by an accredited certification body, an attestation opinion by an independent auditor, and a regulatory finding by a regulator. We prepare the position and facilitate the process; the affirmation is made by someone else, and we do not blur that line.
Everything a product reports is derived from information supplied by your organisation, or by the person representing it. Ratings, maturity levels, readiness figures, mappings between frameworks and any monetary exposure are calculated from those inputs. Where an input is incomplete, out of date or optimistic, the output carries that forward faithfully. A result is therefore a structured statement of the position you have described, not an independent verification that the position is true.
An assessment is a documented position at a point in time. It is useful precisely because it is explicit about what it rests on, and it should be read that way rather than as a proof. Nothing here is a substitute for an audit, and no output should be presented to a regulator, a customer or a board as one.
Part of a family of ten products sharing one governed control library. Provisioning is white-glove and scope follows a due diligence review.