Skip to main content
Evidence is the proof that your controls are implemented and operating effectively. Auditors do not take your word for it — they want screenshots, logs, configuration exports, and reports. Regentra streamlines evidence collection with both automated and manual workflows.

​
Automated Evidence via Integrations

When you connect a cloud or identity integration, Regentra pulls evidence automatically and attaches it to the relevant controls.
  • MFA enrollment status for all users
  • Conditional access policy configurations
  • Privileged role assignments (standing and PIM-eligible)
  • Sign-in and directory audit logs
  • Device compliance and security defaults
Level.io is integrated for PSA-side asset and ticket sync, not compliance evidence collection. Connecting Level.io populates your Configurations module — it does not currently feed automated evidence to compliance controls.
Automated evidence is refreshed on a schedule. Regentra pulls fresh data from connected integrations so your evidence stays current without manual effort.

​
Manual Evidence Upload

Not everything can be automated. For controls that require human-generated evidence, you can upload files or add links directly.
1

Open the control

Navigate to the control that needs evidence and open its detail page.
2

Go to the Evidence section

Scroll to the Evidence tab on the control detail page.
3

Upload or link

Click Add Evidence and choose:
  • Upload file — PDFs, screenshots, spreadsheets, configuration exports, or any relevant document
  • Add link — URL to an external dashboard, monitoring tool, or shared document
4

Add context

Provide a description of what the evidence demonstrates and how it relates to the control.
Common types of manual evidence:
  • Signed policy acknowledgment records
  • Meeting minutes from security reviews
  • Vendor assessment questionnaires
  • Physical security photos
  • Training completion certificates

​
Evidence Attached to Controls

Every piece of evidence in Regentra is attached to one or more controls. This creates a direct audit trail: Framework requirement → Control → Evidence When an auditor asks “How do you satisfy HIPAA § 164.312(a)(1)?”, you can show them the control, its implementation notes, and every piece of evidence supporting it — all in one place. Because controls map across frameworks through the CCF, evidence attached to a shared control counts toward every mapped framework. Upload once, satisfy many.

​
Cross-Framework Evidence Map

Compliance → Evidence Map shows the Cross-Framework Evidence Map — a dedicated view for seeing where evidence has and hasn’t been collected across every framework you’ve adopted. For each framework, the map shows an evidence collection coverage percentage — the share of that framework’s mapped controls that have at least one piece of evidence attached. This measures evidence presence, not requirement coverage: a control with evidence attached isn’t automatically “satisfied” for gap-analysis purposes, and a control can be Implemented with strong evidence but still map only PARTIAL-strength to a given requirement (see Gap Analysis). Each control’s row shows its implementation-status badge next to its evidence count so you can see both signals together. Because controls are shared across frameworks through the CCF, the map’s language is deliberately “reused across” frameworks, not “satisfies” — evidence uploaded once for a shared control is reusable everywhere that control is mapped, but reuse and requirement satisfaction are two different questions.

​
Monitoring Signals and Compliance Status

Some evidence is not a static document but a live signal — an ongoing check that something is still true. Regentra’s monitoring signals track:
  • MFA enforcement — is MFA still enabled for all users?
  • Encryption status — are storage resources still encrypted?
  • Logging configuration — are audit logs still being captured?
  • Patch compliance — are devices still up to date?
When a monitoring signal detects a change (e.g., MFA was disabled for a user), the associated control’s status can change automatically — see Automatic status changes for exactly how the demote/restore cycle works and what triggers it.
A control marked as Implemented can be automatically flagged as Needs Review if a monitoring signal detects drift. This ensures your compliance posture reflects reality, not just a point-in-time snapshot. It is also automatically restored once fresh evidence shows a full pass again.
If your organization runs both Compliance and PSA, failing monitoring findings flow into PSA as tickets by default. To avoid flooding the ticket queue, an initial wave of findings — or any later burst of five or more within an hour, such as after reconnecting an integration — is folded into a single “Compliance baseline” ticket rather than filed one ticket per finding.

​
Evidence Expiration and Refresh Cycles

Evidence does not last forever. Auditors expect to see current proof, not year-old screenshots. Regentra manages evidence freshness through:
  • Expiration dates — set an expiration on any piece of evidence. When it expires, the associated control is flagged for review.
  • Automated refresh — evidence from connected integrations is refreshed automatically on a fixed schedule (currently every 6 hours; not user-configurable).
  • Review reminders — the dashboard highlights controls with stale or expired evidence so your team knows where to focus.
Set evidence refresh cycles to match your audit cadence. If you undergo annual SOC 2 audits, ensure all evidence has been refreshed within the audit period. For HIPAA, keep evidence current year-round since OCR investigations can happen at any time.