Attaching evidence to GRC platforms

GRC platforms track which controls need evidence and when it expires; Zindex produces the architecture evidence itself. Until direct integrations ship, the attach path is manual and takes about a minute per control: export the pack, upload it to the control, set the renewal to match your attestation cadence.

What to upload

Export an evidence pack for each bound scene - from the audit view (Download pack), or GET /v1/scenes/:id/evidence. The zip contains the rendered diagram, the canonical scene, the changelog, and the provenance manifest with content hashes.

Upload the whole zip when the platform accepts arbitrary files: the pack is self-verifying, and an auditor who opens it gets the render plus the provenance chain. Where a reviewer only previews images, attach render.svg or render.png (the watermark carries scene id, revision, and date) and add the zip alongside it.

If the audit period matters, export with ?asOf= pinned to the period end. The export is deterministic, so re-exporting the same date later reproduces byte-identical files - the evidence you uploaded stays re-verifiable.

Drata

Drata’s architecture-evidence controls are DCF-21 (architectural diagram) and DCF-22 (network diagram); both accept uploaded evidence with a renewal date.

  1. Open the control and add evidence via upload (Drata calls this external or manually-uploaded evidence).
  2. Attach the pack for the scene bound to that slot in your compliance checklist.
  3. Set the renewal cadence to match your attestation cycle - quarterly attestation comfortably beats the within-the-past-year review the controls ask about. Drata’s guidance names confirmation from responsible personnel as acceptable review evidence; the pack’s provenance records exactly that, dated and identity-bound.
  4. When the renewal comes due: re-attest the scene, export a fresh pack, replace the upload.

Vanta

  1. On the relevant control or document request, upload the pack as custom evidence (Vanta’s manual-evidence flow).
  2. Set the expiration or renewal window to your attestation cadence.
  3. On renewal, re-attest and re-export - the new pack’s changelog shows the auditor precisely what changed since the last upload, which is a stronger renewal story than a re-dated screenshot.

Keeping uploads honest

The compliance checklist is the freshness dashboard for this loop: each slot shows whether its scene has a current attestation and whether it changed since a human last vouched for it. An upload is only as good as the scene behind it - if the slot shows drift or a stale attestation, fix that before re-exporting.

The pack documents that the evidence was controlled, reviewed, and reconstructable (how, mechanism by mechanism). Your auditor still corroborates the diagram against the environment and samples your underlying change records for change-management testing - the pack links them there; it does not stand in for them.