Answers are claims
Anyone can tick YES. Auditors know that, so they ask for the policy, the screenshot or the export behind each answer. A report that shows which answers are backed by a document is worth far more than a questionnaire.
What happens when you attach a file
We compute the file's SHA-256 fingerprint, a 64-character code that changes completely if even one byte of the file changes. We keep the fingerprint, the file name and its size, and we discard the file itself. Evidence files in Offboarding, Vendor Risk, HIPAA and Standards, and every file checked on /verify, are fingerprinted in memory and never written to disk or logs. AI Agent Trust keeps the contracts you upload, encrypted (AES-256-GCM), and deletes them after 30 days by default.
The signed report lists every fingerprint. Months later, an auditor can fingerprint your copy of the file and see that it matches the one recorded on the day of the assessment.
The assurance rating
Each report is rated Evidence-backed, Partly evidenced or Self-assessed, and names the critical controls you claimed without proof. The rating never changes your readiness score. It tells the reader how much of the score is proven.