Retain the source
Keep the relevant policy, control statement, record or supporting material connected to the working item.
Pre-launch concept
Evidence in.Judgement stays human.
Proof GRC is being designed as an AI-assisted evidence workspace that helps teams organise material and surface possible gaps for accountable review - not replace an auditor or guarantee compliance.
Follow the evidence lineIllustrative product direction. The pictured workspace and examples are not released functionality or customer evidence.
Evidence line / 01
From source material to a reviewable decision.
The useful part of assistance is not simply producing a result. It is preserving enough of the path for an accountable person to challenge it.
Propose a relationship
Surface a candidate mapping, gap or question with enough context to inspect why it appeared.
Open a review gate
Let an authorised reviewer accept, reject, correct, request evidence or mark the item unresolved.
Record the decision
Retain the reviewer, rationale, status and evidence trail needed for the relevant workflow.
Not an auditor
Proof GRC is not represented as legal advice, an audit opinion, certification, accreditation or a guarantee of compliance.
Workspace / 02
Keep the source beside the suggestion.
Illustrative review state
Candidate relationship
A source passage, a proposed relationship and an unresolved question belong in the same review context. The final decision remains explicitly assigned to a person.
Fictional evidenceDesign intentions / 03
Selected frameworks.
One evidence view.
Evidence review
Highlight source material and candidate gaps for a person to assess.
Control selection
Support authorised users maintaining scope, rationale and review state.
Assessment prompts
Structure privacy-impact questions without replacing legal or privacy advice.
Risk context
Keep risks, candidate mappings, notes and decision status together.
Review history
Record what changed, who reviewed it and which questions remain open.
Prepared material
Prepare reviewable material without presenting a system-generated conclusion as an assurance opinion.
Service boundary / 04
Make the service boundary explicit.
A serious product conversation needs a product- and engagement-specific record.
| Topic | What should be documented | Current public position |
|---|---|---|
| Architecture | Systems, integrations, storage, processing, environments and material data flows. | Not asserted universally. |
| Providers | Provider identity, purpose, access, location, retention and training terms. | No common list published. |
| Identity | Roles, authentication, administration, support and access review. | To be defined for the service. |
| Evidence lifecycle | Collection, use, retention, export, correction and deletion responsibilities. | To be agreed for the use case. |
| Assurance | Testing, incident response, vulnerabilities and contractual commitments. | No certification or maturity claim. |
Trust centre
See the public trust position for group-level boundaries and the Essential Eight evidence register.
Prepare the evidence.
Keep judgement human.
Tell us about the evidence, framework and accountable reviewer in view.
Discuss Proof GRC