Evidence Management Software for compliance and audits

Don’t just document compliance. Prove it.

With Complaica you manage compliance evidence — for ISO 27001 and BSI IT-Grundschutz, for example — together with the requirements, risks and measures it belongs to. Relevant changes are captured automatically; registered evidence stays traceable over time and can be verified independently. A cryptographically linked evidence chain and qualified eIDAS time stamps secure selected states — from the first scope to the audit.

01One continuous evidence chain across the whole compliance life cycle
02Evidence created automatically from scope, protection needs, risks and measures
03Configurable event rules and qualified eIDAS time stamps
04Cryptographically verifiable integrity and a complete history
05Independent verification and exportable audit evidence

Request a trial account Request price list

Evidence Chain

Evidence Chain Compliance concept ISMS 2026

#1288 Audit completed Internal audit ISMS 2026 b5a7b218…a964 eIDAS
#1287 Finding closed F-07 Patch management 7cc5e4d5…cd40
#1283 Residual risk accepted R-12 Unauthorised access 1b17a798…bf7f eIDAS
#1280 Terraform configuration registered fw-dmz.tf 3a1424f5…d73a
#1279 Measure completed M-114 DMZ network segmentation 32bf5712…c47c

Chain verified 1,288 events Last checkpoint 10/12/2026

EVIDENCE 01

One evidence chain for every compliance concept

When a compliance concept is created in Complaica, its evidence chain begins too.

The chain records relevant states, decisions and changes over the whole life cycle. Every registered event references the objects it concerns and is linked cryptographically to the history before it.

The chain becomes the verifiable chronology of the compliance concept — from its initial structure through risk assessment and the implementation of measures to the audit.

Your organisation decides which events are registered automatically and when qualified electronic time stamps are created.

EVIDENCE 02

Compliance evidence for ISO 27001 and BSI IT-Grundschutz

Standards such as ISO 27001 and the BSI’s IT-Grundschutz require documented evidence: of risk treatment, of measures, of internal audits and of the management review. An example from an ISMS concept shows how a risk decision becomes evidence an auditor can check.

Example from an ISMS concept

01 Approve the risk treatment R-12 Unauthorised access Management approves the treatment of the risk. Complaica registers the decision, the actor and the time as an evidence event.
02 Implement the measure M-114 DMZ network segmentation IT operations implements the measure. Status changes and the Terraform commit from the pipeline land in the same chain.
03 Register technical evidence Pentest-Bericht_DMZ_2026-Q3.pdf The external tester’s report is registered with its hash and linked to the measure, the risk and A.8.20.
04 Anchor the state in time Checkpoint · eIDAS A qualified time stamp confirms the state of the chain at that moment. Only the hash value goes to the trust service provider.
05 Export a verification package verification-package_ISMS-2026_1288.zip For the audit, the CISO exports a package with event data, hash values, chain proofs and the time stamp.

What the people responsible see

For every requirement, its current state and the evidence it rests on
Who made a decision or completed a measure — and when
Where evidence is missing or older than intended

What the auditor receives

The history behind the requirement: assessment, risk decision, measure, evidence
A verification package whose integrity and time stamp can be checked without access to Complaica
The basis for their judgement — whether evidence is sufficient in substance is still theirs to decide

More examples: from the requirement to the audit

ISO 27001 · 8.3 Information security risk treatment
1. Risk treatment plan
2. Approval of residual risks
3. Measures with owners
4. History of decisions
5. Checked in the audit
ISO 27001 · 9.3 Management review
1. Inputs to the review
2. Minutes and decisions
3. Resulting measures
4. Checkpoint with eIDAS time stamp
5. Checked in the audit
IT-Grundschutz · Protection needs assessment (BSI Standard 200-2)
1. Protection needs of business processes
2. Inheritance to applications and IT systems
3. Approval of the assessment
4. History of changes
5. Checked in the audit
IT-Grundschutz · NET.1.1 Network architecture and design
1. Modelling of the network
2. IT-Grundschutz check of the requirements
3. Firewall configuration from Terraform
4. Penetration test report
5. Checked in the audit

Complaica records what was decided, implemented and evidenced, and makes that history verifiable. That alone does not make an organisation compliant.

Request price list

… or just ask on WhatsApp.

EVIDENCE 03

Managing compliance evidence across the whole life cycle

Six phases, one chain. In each phase Complaica registers the events that later show what applied at which point in time and who decided it.

01
01 · Scope management

The scope becomes traceable.
Complaica documents the scope of a compliance concept, including its organisational and technical structures.
Relevant changes are registered in the evidence chain and stay traceable over time.

What it proves

You can trace which organisational units, processes and assets belonged to the scope at any given point in time.
Typical evidence events
- e428690 Compliance concept created Qualified electronic time stamp (eIDAS)
- 82069a0 Scope defined or changed
- af5cdda Organisational unit added or removed
- fe96c5f Business process assigned to the scope
- 8009ee1 Asset added or changed
- 221a257 Structure version approved
02
02 · Protection needs and classification

Assessments with a traceable basis.
Protection needs assessments and classifications are linked to the objects they concern and documented over time.

What it proves

Not only the current result is visible, but also how the assessments developed and when.
Typical evidence events
- 7b56aef Protection need of an asset assessed
- 2fd5ca4 Assessment changed
- 0da7c18 Inherited protection need updated
- 5591da7 Criticality of a business process adjusted
- 90b0551 Assessment confirmed or approved Qualified electronic time stamp (eIDAS)
03
03 · Requirements and compliance assessments

Every assessment in the context of its requirements.
Complaica links requirements from different standards with controls, measures and their assessments.

What it proves

For every requirement you can trace which assessment applied at which time and which evidence it rested on.
Typical evidence events
- 3d397df Requirement assessed
- 25e20e2 Compliance status changed
- 4391a42 Justification updated
- 206115a Evidence assigned
- 159098b Deviation identified
- 34c0416 Assessment approved
04
04 · Risk management

From identifying a risk to a verifiable decision.
Risks, assessments and treatment decisions are documented together with the assets, processes and requirements they affect.

What it proves

Risk decisions can be traced over their whole life cycle.
Typical evidence events
- 6ec6b44 Risk identified
- 7fb0e35 Likelihood or impact assessed
- 068095c Risk assessment changed
- 95da879 Risk treatment decided
- 572681e Residual risk accepted Qualified electronic time stamp (eIDAS)
- 19b8fcc Risk reassessed
05
05 · Measures and technical implementation

From the decision to the actual implementation.
Complaica links measures with requirements, risks and the evidence of their implementation.
The evidence chain records relevant changes and approvals. Through integrations, external technical artefacts and events can be captured as well.

What it proves

The link between the business requirement, the organisational decision and the technical implementation becomes visible.
Typical evidence events
- ecf3934 Measure created or changed
- e4ebdce Owner assigned
- f85c5f2 Implementation status updated
- ff4cad8 Measure completed
- f3e74e3 Implementation evidence added
- bb6522c Terraform configuration registered
- 5019ad1 Deployment result captured
- e08c42f Technical configuration verified
Example of a connected chain of evidence
1. Security requirement
2. Measure
3. Change request
4. Terraform commit
5. Firewall configuration
6. Verification
06
06 · Audits and continual improvement

Audit-ready — with a verifiable history.
Audits draw on the current state of the compliance data and on the recorded history of relevant events.

What it proves

Auditors can trace which assessments, measures and evidence were registered at a given point in time.
Typical evidence events
- 53fe039 Audit started
- 980f257 Audit scope defined
- 2bb0a72 Evidence reviewed
- 185949e Finding registered
- d06539c Corrective action defined
- 6e11303 Finding closed
- 561fbb7 Audit completed Qualified electronic time stamp (eIDAS)
- d19f1a9 Qualified evidence checkpoint created Qualified electronic time stamp (eIDAS)

EVIDENCE 04

Capturing evidence automatically as you work

The evidence chain is not assembled by hand after the fact. Complaica registers relevant events at the moment they happen.

Configurable rules define:

01Which object types are monitored.
02Which changes count as an evidence event.
03Which state changes are ignored.
04Which metadata and object states are captured.
05Which events trigger a qualified time stamp automatically.

Request a trial account

Event rules

Compliance concept ISMS 2026

Add rule

Object	Event	Evidence Chain	Qualified time stamp
Compliance concept	Created	Automatic	Yes
Scope	Changed	Automatic	No
Asset	Protection need approved	Automatic	Yes
Risk	Assessment changed	Automatic	No
Risk	Residual risk accepted	Automatic	Yes
Measure	Completed	Automatic	No
Audit	Closed	Automatic	Yes

EVIDENCE 05

Registering external documents and technical evidence

Not all relevant evidence comes into being inside Complaica. Users can register additional objects, documents or technical artefacts in the evidence chain at any time.

Registration captures the cryptographic hash, the object’s identity, the source, the time and the related metadata. The registration can be linked to requirements, risks, measures, assets or audits.

Examples

Information security policy as a PDF
Approved security concept
External audit report
Penetration test result
Firewall configuration file
Terraform manifest
SIEM incident report
Supplier certificate

File

Pentest-report_DMZ_2026-Q3.pdf PDF · 2.4 MB · SHA-256 71f7e18e…ceec

Link to

M-114 DMZ network segmentation

R-12 Unauthorised accessA.8.20 Networks security

Source

External testing provider

Description

Penetration test of the DMZ after the network segmentation was completed, final report.

Create qualified time stamp Only the hash value is sent to the trust service provider.

Cancel Register

EVIDENCE 06

An evidence chain with qualified eIDAS time stamps

Every evidence event is linked cryptographically to the history before it, so later changes become detectable.

For selected states, qualified electronic time stamps under eIDAS can be created. They confirm the cryptographic state of the chain at a given point in time and allow its anchoring in time to be checked independently.

Evidence hash

Identifies the registered content or state.

Evidence chain

Links the registered events to each other cryptographically.

Qualified time stamp

Confirms independently that a given state of the chain existed no later than the time stated.

A checkpoint covers the whole history registered up to that point.

Event 001 d56bc121 eIDAS
Event 002 dfe4f0b6
Event 003 c256f59f eIDAS
Event 004 e6e64286
Event 005 e9a8facd eIDAS

Checkpoint at event 001

Checkpoint at event 003 · covers events 001⁠–⁠003

Checkpoint at event 005 · covers events 001⁠–⁠005

The time stamps are issued by a qualified trust service provider. The data and documents themselves do not have to be sent to the provider.

Get an account

… or just ask on WhatsApp.

EVIDENCE 07

Tracing audit evidence in the Evidence Chain Explorer

Complaica offers a navigable view of the evidence chain.

Users can

01Browse events chronologically.
02Open individual blocks.
03See hash values and links.
04Navigate to the original Complaica objects.
05Open external documents and technical artefacts, where available and permitted.
06Check qualified time stamps and verification status.
07Trace historical states.
08Examine related events and evidence.

Evidence Chain Explorer

Evidence Chain Explorer Search hash, object or actor

Block #1279

Measure completed

Hash: 32bf57129b9e9c283bcfcb8f0fc16ed23d168283af8bd558a3c6f33d7abfc47c
Previous hash: 241fabff52eff6ea9854e96fda0f0fc912f2684bf7ccde289a7ccc042eb39a99
Source object: M-114 DMZ network segmentation
Actor: T. Yilmaz
Time: 10/08/2026, 02:02 PM UTC
Verification: Integrity verified
Qualified time stamp: None — covered by the next checkpoint