38,412 artifacts under chain of custody
PRODUCTEvidence is pulled directly from your systems of record signed, sha256-hashed, timestamped, and versioned the moment it lands. Auditors stop asking for what you already have; engineers stop being the screenshot department.
No upload forms. No screenshots. Every artifact arrives from the system that owns the truth, and carries a cryptographic record of exactly where it came from and when.
IAM policies, MDM posture, merged PRs, on-call rosters, vendor DPAs read through the same API the source exposes to its own console.
The artifact's bytes are hashed the instant they land. Any later mutation is detectable; the hash is the artifact's identity in the library.
Each artifact is signed with an org-scoped ed25519 key. Anyone including your auditor can verify it was collected by Uproot and not altered since.
Stored write-once with full version history and a retention clock that matches your framework. Nothing is overwritten; new state becomes a new version.
Every artifact is connected to the control it satisfies, the framework that references it, and the exact moment it was true. The library is the single source the audit reads from.
A screenshot proves someone saw a screen once. Uproot stores the API response itself the IAM policy JSON, the device record, the merge event with the request that produced it captured alongside.
Structured artifacts: JSON, config, logs queryable, diffable, exportable
The exact API call and parameters stored next to the result
Re-collected on a schedule, so the library never goes stale silently
Most tools treat evidence as a file you uploaded once. Uproot treats it as a measurement with a timestamp and a half-life when something ages past its window, it's flagged and re-pulled before an auditor notices.
Per-artifact freshness window, tuned to the control it backs
Stale evidence auto-queues for re-collection; you're never caught flat
Freshness rolls up per control, per framework, per audit period
Grant a scoped, read-only, time-boxed view. Auditors pull exactly the artifacts mapped to the criteria they’re testing hash and signature attached. No zip files, no shared drives, no "can you re-send that."
Scoped to a framework, a period, a set of controls revocable any time
Every artifact links to the live control it backs
Full access log: who viewed what, when part of the evidence itself
Each artifact type has a freshness window tuned to how fast the underlying truth can change. Fast-moving state is re-pulled in minutes; slow documents, daily.
IAM policies, security groups, KMS keys, CloudTrail settings the literal control-plane state, snapshotted and diffed.
MFA enrollment, SSO coverage, access grants and revocations captured as events, so the history is the evidence.
PR approvals, reviewer trails, CI gate results, signed commits the merge record that proves your SDLC controls held.
Disk encryption, OS version, EDR health, screen-lock policy pulled from MDM/EDR, not a self-attestation survey.
SOC 2 reports, DPAs, pentest letters, sub-processor lists attached to the vendor record and expiry-tracked.
Policies, risk assessments, incident timelines, training completion the human-process evidence, versioned like code.
Uproot PtaaS offers the perfect suite of features to ensure the highest security standards for our clients. We are impressed by their dedication to continuous testing. Their seamless integration combined with the hacker mindset and thorough manual pentesting approach, truly sets them apart.
Evidence integrity is the part auditors scrutinize hardest. Here's how the library holds up.
Each artifact's bytes are hashed with sha256 at write-time and signed with an org-scoped ed25519 key. The hash and signature travel with it, so anyone including your auditor can verify integrity offline.
Every artifact type has a freshness window. When one ages past it, the library flags it and auto-queues a re-pull from the source so you see staleness before an auditor does, and most gaps close themselves.
Yes the full library exports as a structured archive you own: artifacts, hashes, signatures, version history, and control mappings. No lock-in, and the evidence stays verifiable outside Uproot.
We store the minimum needed to prove the control: configuration state, event metadata, and document references. Where an artifact would contain secrets or PII, we capture the assertion (e.g. "encryption enabled, key rotated 14d ago") rather than the value.
Storage is write-once with full version history, retained for your framework's required period typically 7 years, configurable. New state becomes a new version; nothing is overwritten before its retention clock expires.
Connect a source and watch the library fill itself signed, hashed, and timestamped within minutes of the first sync.
No upload forms, ever
Evidence is pulled, not submitted.
Verifiable outside Uproot
Hashes and signatures your auditor can check independently.
Yours to export
Full archive on demand artifacts, history, and mappings.
Mapped to every framework
One artifact backs every criterion that references it.
