Every compliance action is preserved. Every artifact can be verified.

The Evidence Vault stores compliance documentation with SHA-256 hash chains. Evidence written through the API is held under S3 Object Lock (COMPLIANCE mode), so it is tamper-evident. When a regulator asks for proof, every artifact is timestamped, signed, and available as a bilingual audit dossier, in one click.

StorageWORM, S3 Object Lock, ca-central-1

IntegritySHA-256 hash chain per artifact

RetentionConfigurable, 7-yr default

Properties

Built to survive an audit.

WORM storage

Write once, read many

Evidence written through the API is under S3 Object Lock (COMPLIANCE mode), so artifacts are write-protected and tamper-evident. The SHA-256 hash chain makes any modification immediately detectable.

SHA-256 hash chain

Tamper-evident chain

Every artifact is hashed with SHA-256 on upload. Each new artifact references the hash of the previous one, creating a chain where any modification is immediately detectable.

Configurable retention

Retention you control

You set how long compliance evidence is kept, to match your own record-keeping obligations. The default is 7 years, aligned with financial-sector record-keeping norms. Expired artifacts move to archive rather than disappear. Nothing is purged without your written instruction.

Bilingual export

One-click audit dossier

Generate a complete audit dossier for any system, all artifacts organized by framework, with a compliance summary, in French and English. Designed for the format regulators request.

Artifact types

What gets stored in the vault.

Type	Example	Framework	Hash
Transparency Notice	Law 25 Art. 12.1 notice, Credit Scoring Engine	Law 25	sha256:9f2c7a…
PIA / EFVP	Privacy Impact Assessment, HR Resume Screener	Law 25	sha256:3ad91e…
Model Card	OSFI E-23 S.6, Fraud Detection Model documentation	OSFI E-23	sha256:c74b08…
Public Notice	Bill 194 AI disclosure (draft, standards pending), Recruitment system	Bill 194	sha256:8e15d3…
Remediation Plan	OSFI E-23 gap closure, Credit Scoring Engine, Art. 12	OSFI E-23	sha256:5027ba…

Two ways an artifact enters the vault

You can upload evidence directly. When Veille identifies a gap, it can also draft the missing document itself, in full bilingual content, citing the exact article it satisfies. Either way the artifact enters the same WORM chain. It is hashed, timestamped and traceable from the moment it is created. What differs is a status field the vault tracks on every record. Uploads land as validated. Veille drafts land as draft_pending_review. That status is not cosmetic. The compliance engine reads it and refuses to count a draft_pending_review artifact toward your coverage score. The obligation stays open and flagged "draft awaiting review" until your designated officer opens the draft, reviews it and validates it through the vault. Only that action moves it to validated and lets it close the gap. The line between a draft and a record of record is enforced in code, not only in copy.

Infrastructure

Where your data lives.

All vault data is stored in Amazon S3 with Object Lock enabled (COMPLIANCE mode) in the ca-central-1 region (Montréal, Canada).

The LLM reasoning that evaluates your compliance posture uses metadata, the actual vault content (documents, artifact text) is never sent to an external model.

Hash chain example

content_hash: sha256:9f2c7a1d8b34e60af52c9d017be4a3c1…
chain_hash: sha256:c74b08fe21a9d34c7e05b16fa8927de0…

Every compliance action is preserved. Every artifact can be verified.

Built to survive an audit.

What gets stored in the vault.

Where your data lives.

See the vault in the demo dashboard.