Evidence workflow
Operational Evidence Vault
Some security controls cannot be proven by a repository or URL scan. The Operational Evidence Vault collects, reviews, and versions the proof for the seven evidence-required Vibe Security 50 controls.
Last reviewed:
How evidence becomes assurance
- 01
Submit
Attach an attestation and encrypted artifacts for a control.
- 02
Review
A reviewer accepts, rejects, or requests a revision.
- 03
Version
Every action creates a new version; the prior record stays frozen.
- 04
Snapshot
Accepted evidence is frozen into the private assurance report.
The seven evidence-required controls
These are the Vibe Security 50 controls a scanner cannot establish on its own. Each one becomes a card in the vault.
Missing audit trails
Missing monitoring and alerts
Missing backup and recovery proof
Missing agent sandbox and egress controls
AI-generated test fabrication and blind spots
Multi-agent propagation
No accountable human review or threat model
What stays private
- Encrypted artifacts
- Files are encrypted before they reach object storage. The API never returns a raw storage URI.
- Workspace isolation
- RLS policies enforce that evidence is visible only inside the workspace that owns it.
- Append-only versions
- Revisions and reviews create new versions instead of overwriting prior evidence.
- Immutable snapshots
- Private assurance reports freeze the current evidence state at creation time; public shared reports omit it entirely.
Questions
Why can't these controls be scanned?
Seven controls describe operational practice, not code: audit trails, monitoring, backup tests, sandboxing, test independence, multi-agent trust, and accountable review. A scanner can ask for evidence of these, but it cannot safely observe or prove them on its own.
What does the Operational Evidence Vault do?
It creates an append-only, workspace-scoped record for each evidence-required control. You submit an attestation and any supporting files; a reviewer accepts, rejects, or requests a revision; and every change creates a new immutable version rather than overwriting the last.
Are artifact files stored securely?
Artifacts are encrypted before storage and never returned with a raw storage URI. The dashboard and API expose only sanitized metadata — filename, media type, and byte length — inside the workspace RLS boundary.
Does accepted evidence mean the app is secure?
No. Accepted evidence means the submitted proof was reviewed and found adequate for that control. It is one input into an assurance report, not a guarantee that the app is secure, a formal attestation, or proof against every possible threat.
Does this make LyraShield SOC 2 compliant, certified, or adversarially robust?
No. LyraShield does not claim SOC 2 compliance, certification, security guarantees, AI safety testing (without a named framework), or adversarial robustness. Each of those requires external attestation, a reproducible evaluation corpus, a defined threat model, or a formal certificate. The evidence vault supports release assurance; it does not produce those claims.
Start with a free check
Run a passive Lite Check in 30 seconds, then create a workspace to collect evidence for the controls that matter most.
Target → review → evidence → retest
Create your first release record.
Create a workspace, add the target you are shipping, and choose the depth of review. Nothing auto-merges and missing evidence stays visible.
- Create workspace
- Add target
- Choose review