Security Overview

Customers trust Evident with their most sensitive security questionnaire content, and we take that responsibility seriously. This page summarizes the technical and organizational measures Evident uses to protect Customer data. It is the "Security Policy" referenced in our Terms of Service, Privacy Policy, and Data Processing Agreement.

For detailed policies or audit reports (available under NDA), please contact security@evident.security.

Compliance and Certifications

SOC 2: Our SOC 2 Type 1 report is complete. Our SOC 2 Type 2 audit is in progress, and we expect the report in mid-2027.

GDPR and UK GDPR: Evident offers a public Data Processing Agreement incorporating the EEA Standard Contractual Clauses and the UK International Data Transfer Addendum for customers requiring one.

CCPA: Evident acts as a "service provider" under the California Consumer Privacy Act (as amended by the CPRA), does not sell or share Personal Data, and uses Customer data only to provide the Service.

Data Protection

Encryption in Transit. All data transmitted over public networks is encrypted using TLS 1.2 or higher with modern, non-deprecated cipher suites. We monitor industry guidance and update protocols and ciphers as standards evolve.

Encryption at Rest. All Customer data is encrypted at rest in our production environment, including databases, object storage, and backups. Encryption keys are managed through AWS KMS with access limited to a minimal set of authorized systems and personnel.

Data Classification. Customer data is classified as Confidential under our internal Data Classification and Handling Policy, which is our highest protection tier. Customer data is stored only on secure production-managed systems and is not stored on employee workstations.

Data Minimization. We collect only the Personal Data necessary to provide the Service. Evident does not require, and does not intend to process, Special Category Data as defined by GDPR Article 9.

No Model Training on Customer Data. As stated in our Terms of Service and Privacy Policy, Evident does not use Questionnaire Content, prompts, or generated outputs to train, fine-tune, validate, update, improve, or modify any AI or machine learning model, including any third-party large language model.

Access Control

Identity and Authentication. Evident uses Google Workspace as its identity provider. Third-party services are authenticated via SSO where supported. Passwords (where still required) are stored in 1Password with complexity requirements enforced at the identity provider.

Multi-Factor Authentication. MFA is required for all personnel accessing production systems and business-critical services. We prefer phishing-resistant factors (passkeys and WebAuthn) and avoid SMS where any alternative exists.

Least Privilege. Access to systems and data is granted based on job function and the principle of least privilege. Access is logged for audit purposes.

Access Reviews. User access and privileges are reviewed at least annually. Accounts are deactivated within 24 hours of a team member departing or no longer requiring access.

Secure Development

Evident follows a lightweight, automation-first Secure Software Development Lifecycle (SSDLC) designed to embed security continuously into development workflows rather than through infrequent phase-gated reviews.

Automated Code Review. All code changes pass through automated review before merge, covering logic errors, security issues, and style violations. Pull requests additionally pass required CI checks including linting, tests, Static Application Security Testing (SAST), and custom architectural rules. CI is a required status check in the source control platform.

Continuous Security Scanning. Automated security scans run on a recurring basis (at least daily) to catch drift, new vulnerability patterns, and issues not caught during pull request review.

Secure-by-Default Architecture. Evident relies on managed cloud services and established frameworks to reduce implementation risk. Architecture emphasizes least-privilege access, isolation between components, secure communication, and avoidance of custom security-critical implementations where managed alternatives exist.

Change Management. All code and infrastructure changes are tracked in version control, reviewed through the automated pipeline above, and deployed through continuous integration. Higher-risk changes receive additional human review when practical.

Vulnerability Management

Remediation Timelines. Exploitable Critical vulnerabilities in software under our control are patched within 7 days of identification; High severity vulnerabilities within 14 days. Where a patch is not immediately available, compensating mitigations are put in place to reduce risk.

Patching Cycles. In addition to vulnerability-driven patching, all components are brought fully up to date at least twice a year during designated patching cycles in January and June. We maintain a preference for staying no more than one major version behind on direct dependencies.

Dependency Monitoring. Direct dependencies, Docker base images, and operating system versions are continuously monitored for security advisories.

Logging and Monitoring

Critical systems and applications generate structured logs capturing at minimum timestamp, source, event type, and the user or system initiating the event. Logs are retained for at least 90 days, stored in a tamper-resistant manner, and accessible on demand for investigation of suspected incidents or system anomalies.

Incident Response

Evident maintains a documented Security Incident Response Process that classifies incidents into three severity levels (Critical, High, Low) with defined response procedures for each.

Critical Incidents — confirmed or strongly-suspected unauthorized access to Customer data, active data exfiltration, or complete service outage — trigger immediate response regardless of time of day and activate Customer notification procedures.

Customer Notification. In accordance with our Data Processing Agreement, Evident will notify affected Customers of any confirmed Security Incident affecting their data without undue delay, and in any case no later than 48 hours after becoming aware of the incident.

Response Team and Process. Incidents are coordinated by a designated incident response team, with response activities documented in a timeline from first detection through containment, eradication, recovery, and post-incident analysis. We maintain relationships with established third-party incident response firms for situations that warrant external forensics or specialized assistance.

Business Continuity and Disaster Recovery

Recovery Objectives. Evident targets a 6-hour Recovery Time Objective (RTO) and a 24-hour Recovery Point Objective (RPO) for the platform as a whole.

Backups. Primary databases are configured with automated, point-in-time backups. Object storage uses bucket versioning and built-in cloud durability guarantees. At least two independent backups are maintained for each data store. Backup restoration is tested at least annually, and results are documented and reviewed.

Resilient Architecture. The platform is designed cloud-natively to expect infrastructure failure and to recreate services quickly when failures occur. Services are loosely coupled, state is maintained externally where possible, and the system can fail over to additional availability zones within region.

Infrastructure as Code. Infrastructure is managed via Terraform in version control, enabling rapid, reproducible recovery of environments.

Vendor and Subprocessor Management

Vendor Standards. Evident requires that any vendor with access to Customer data maintain SOC 2 or an equivalent certification (e.g., ISO 27001). Vendors are evaluated during selection and reviewed at least annually thereafter.

Data Processing Agreements. A written data processing agreement is required with any vendor that accesses Customer Personal Data. For international transfers, we rely on the EEA Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent transfer mechanisms.

AI Model Providers. Our agreements with AI model providers (including Anthropic, OpenAI, Google, and OpenRouter) prohibit the use of Customer data to train their models, prohibit secondary use, and limit retention to what is necessary to provide the Service.

Subprocessor Transparency. Our current list of Subprocessors is maintained on the DPA page and in our Privacy Policy. We provide at least 30 days' advance notice before engaging any new Subprocessor, giving Customers the opportunity to object.

Physical Security

Evident does not operate its own data centers. Customer data is hosted exclusively in the facilities of Evident's cloud subprocessors (Amazon Web Services, Google, and Cloudflare), each of which maintains its own SOC 2 and ISO 27001 certifications and publishes detailed physical security controls. Customer data is not stored on employee workstations.

Workforce Security

Code of Conduct and Acceptable Use. All Evident personnel are bound by a written Code of Conduct and Acceptable Use Policy and receive security awareness training on an ongoing basis.

Workstation Security. Employee workstations are configured to our Workstation Security Policy, including disk encryption, screen lock requirements, and endpoint management. Customer data is not stored locally on workstations.

Policy Governance

Evident maintains a documented information security program with written policies covering encryption, access control, data classification and handling, change management, secure development, vulnerability management, log management, patch management, incident response, business continuity and disaster recovery, vendor and partner management, asset management, risk management, and workstation security. Policies are reviewed at least annually and updated in response to changes in the threat landscape, regulatory environment, or business practice. Copies of detailed policies are available under NDA upon request.

Reporting a Security Concern

If you believe you have discovered a security vulnerability in Evident, please see our Responsible Disclosure Policy for scope, reporting guidance, safe harbor terms, and what to expect from us. Reports can be sent to security@evident.security. Evident also publishes a security.txt file (RFC 9116) for automated discovery of our disclosure contact. While we do not currently offer a paid bug bounty, we welcome and appreciate responsible submissions and are happy to publicly acknowledge researchers who report valid issues.