Evidence packs
Each eligible Starter+ run produces a checksum-verified evidence pack with a manifest, SARIF, CSV, JSON, and run summary. LLM runs with eligible findings can also include conversation transcripts and a remediation playbook.
An evidence pack is the portable record of an eligible run: a manifest with checksums, machine-readable findings, transcripts where applicable, and a summary a third party can verify without platform access.
Packs exist because security claims travel — to auditors, customers, and leadership — and a claim without reproducible evidence is marketing.
Key points
- Verified with SHA-256 checksums recorded in the pack manifest.
- Scoped to the run that produced it; never aggregated across tenants.
- Exportable as a ZIP or through a signed download URL valid for 10 minutes.
- Retention follows the tenant data-retention contract (default: while the account is active).
What is inside
- Manifest, SARIF, CSV, JSON, and a run summary.
- Run configuration (target, profile, scenario catalogue version).
- For eligible LLM findings: conversation transcripts and a remediation playbook.
The manifest is the contract: it lists every artifact with its checksum, so a recipient can detect truncation or tampering. LLM runs with eligible findings can also carry conversation transcripts and a remediation playbook, scoped to what the findings actually exercised.
How to use it
- Download from the run detail page or via GET /v1/runs/{id}/evidence-pack.
- Recalculate and compare the SHA-256 checksums in the manifest before treating the files as authoritative.
- Hand to an auditor along with the methodology link (/docs/technical-foundations).
Use packs where trust must be portable: attaching one to a release ticket, answering a customer questionnaire, or handing an auditor the methodology alongside the data. A pack is isolated to the tenant and the run it describes.
Related resources