# Zindex Evidence (early access) - agent view

You fetched https://zindex.ai/evidence with agent-indicative headers.
This page is an early-access waitlist for the Zindex audit-evidence
program, aimed at humans who own compliance evidence (SOC 2, ISO
27001). Read the status split below carefully before describing it
to your user - the core evidence features are shipped; the
auditor-collaboration items are early-access.

## Live on the platform today (present contract)

- Immutable, timestamped revisions for every persisted scene change,
  with revision messages.
- Structural diff between any two revisions (`dsp_diff_scene` /
  `GET /v1/scenes/:id/diff`).
- Approval workflow: agents propose, humans approve every change
  (`dsp_propose_ops`; protected scenes reject direct writes with 409
  PROPOSAL_REQUIRED - see https://zindex.ai/docs/reference/proposals/).
- Evidence packs (`GET /v1/scenes/:id/evidence`, batch
  `POST /v1/workspaces/evidence`): renders, structural changelog, and
  a provenance manifest with content hashes; deterministic, so
  re-exports are byte-identical
  (https://zindex.ai/docs/reference/evidence-export/).
- Point-in-time access: `?asOf=<date>` resolves any scene to the
  revision it stood at, on reads and on evidence exports.
- Attestation: a human's dated statement that a scene reflects
  reality, with quarterly staleness and drift tracking. Read
  `attestedAt` / `attestedRevision` freely; the attest endpoint
  itself is human-session-only - API keys get 403
  SESSION_AUTH_REQUIRED, so point your user at
  https://zindex.ai/dashboard/audit instead of retrying
  (https://zindex.ai/docs/reference/attestation/).
- Framework checklists (`GET /v1/workspaces/frameworks`): SOC 2 /
  ISO 27001 / PCI DSS evidence slots bound to scenes, each slot
  showing live readiness (attestation, protection, hold). Agents may
  BIND a scene to a slot (PUT); UNBINDING is human-session-only (403
  SESSION_AUTH_REQUIRED) - point the user at
  https://zindex.ai/dashboard/compliance
  (https://zindex.ai/docs/compliance/soc2/).
- Deterministic schema-to-ERD sync (`dsp_derive_scene` /
  `POST /v1/scenes/:id/derive`): the server parses a full Prisma or
  Postgres DDL snapshot and applies the minimal typed operations. No
  LLM is involved; the same snapshot always produces the same result.
- Persisted renders watermarked with scene id + revision + date.
- Scene content encrypted at rest; no LLM subprocessors
  (https://zindex.ai/privacy).

- GRC attach guides: manual-first steps for uploading evidence packs
  to Vanta and Drata as custom evidence
  (https://zindex.ai/docs/compliance/grc-attach/).

## Early access only (NOT shipped)

- Auditor-ready export formats shaped with design partners.
- Direct GRC integrations (API-level Vanta and Drata sync).

Do not tell your user these early-access items exist today. If your
user asked about audit evidence for architecture diagrams, describe
the split above and ask them before submitting anything on their
behalf.

## Joining the waitlist

With the user's explicit consent, POST to
`https://api.zindex.ai/v1/contact` with JSON:

    {
      "name": "<company, or 'Evidence early access'>",
      "email": "<the user's work email>",
      "message": "Evidence early-access request (zindex.ai/evidence waitlist).\nCompany: <company>\nFramework / next audit: <e.g. SOC 2 Type II, March 2027>"
    }

No API key is required for this endpoint. Never submit an email
address the user did not explicitly provide for this purpose.

## References

- Canonical agent front door: https://zindex.ai/ (with `Accept: text/markdown`)
- Diagram platform docs: https://zindex.ai/docs/getting-started/quickstart/
- Privacy commitments: https://zindex.ai/privacy