Kairnex Evidence — Unified Compliance

Meeting Brief

Live buyer readout

Demo workspace seeds a buyer-ready showcase. “Prepare buyer brief” refreshes the live readout. “One-click handoff” creates snapshot, report, and handoff artifacts.

Select an organization and engagement to build the live meeting brief.

This turns evaluation, trust-chain artifacts, and deployment profile into an executive summary.

Talk Track

Trust Signals

Meeting Notes

Quick Start

New environment? Use this to get to a first evaluation and an auditor-shareable snapshot fast.

1

Create Org + Engagement

Use the one-click demo path or create and select both below.

2

Seed baseline content

Idempotent. Safe for demos and fast starts.

3

Evaluate + handoff package

Run evaluation, create snapshot, generate PDF report, and queue audit ZIP.

Operations & Onboarding

This is the operator view for launch readiness: onboarding progress, connector health, workflow pressure, and pilot-proof artifacts.

Select an organization to load onboarding progress, automation health, and pilot-proof artifacts.

Onboarding Checklist

Operational Alerts

Pilot Outcome Readout

Your Engagement

Workspace access required

Engagement details appear after an authorized workspace credential is accepted.

Access

Protected

No customer workspace is visible without authorization.

Organization

Not loaded

Shown from the organization attached to your credential.

Review scope

Not loaded

Defined for the selected engagement.

Schedule

Not loaded

Start and target dates appear when assigned.

Current scope

No engagement is available without workspace access.

Included handoff

Organized evidence record

Reviewed findings and open-item summary

Sealed export package when approved

Next step

Your current action appears after the workspace loads.

Commercial terms remain in your signed agreement. This workspace reflects the scope, schedule, access, and deliverables assigned to your organization.

Organization

Org

New org

Engagement

New engagement

Framework view

Audit pack

Export Runs as a background job for reliability. If it takes a while, check Jobs.

Engagement Setup

One-click setup for demos: seed control libraries and PBC requests (idempotent).

Seed controls

More frameworks

Seed tests

Seed PBC

Imports (Connector-lite)

Upload a CSV/JSON export to create Evidence + Evidence Signals mapped to existing controls (by framework + control_code).

File

Template

Source App Evidence

Import sanitized Kairnex evidence packages from KeyControl, AgentBoundary, ExposureOps, ShieldDesk, TechStack, or custom systems. Raw secrets, credential values, session material, and sensitive prompts are rejected.

Package

Select an engagement to see imported source-app evidence.

Connectors (Evidence Sources)

Pull auditor-friendly evidence directly from common systems. Most connector pulls attach to the currently selected control and automatically record provenance + replay instructions. (Baseline pack imports attach to multiple controls.)

Target control

Select a control in Controls first.

Managed connectors

Save recurring connector definitions with encrypted secrets, run them on a schedule, and monitor whether automation is healthy enough for customer-facing use.

Health

Inventory

Selected connector

Name / Type

Engagement / Interval

Activation

Active

Choose a connector type to load a starter config template.

Config JSON Non-secret configuration such as targets, limits, and replay guardrails.

Secrets JSON Stored encrypted at rest. Leave blank during updates to preserve existing secrets. Use {} to clear.

Actions

GitHub — Audit log

GitHub org

Start / End

Filter / Token

Run Produces JSON evidence (audit log entries) + replay info.

Google Workspace — Admin audit log

Start / End

Max pages / Token

Run Requires start/end (Admin SDK Reports API).

Jira — Audit log

Base URL

From / To

Limit / Pages

Email / Token

Run Captures change-management / admin activity evidence.

Microsoft Entra — Security posture (Graph)

Graph base / Max

Token

Run Fetches Conditional Access policy metadata (starter posture).

AWS — IAM credential report (import)

Upload a credential report CSV and Kairnex Evidence will attach it to the selected control, compute a posture summary (MFA, active keys), and store replay instructions for auditors.

AWS account / CSV

Run Generates evidence + connector signal + provenance replay steps.

HTTP JSON — Fetch (bridge connector)

URL

Max bytes / Token

Run SSRF-hardened; intended for pre-authenticated JSON endpoints.

Cloud export — Ingest JSON (AWS/GCP/etc.)

For providers that require external tooling (AWS CLI / gcloud), export JSON locally and ingest it here. This attaches evidence to the selected control while recording provenance + optional replay instructions.

Connector / Source

JSON file

Replay (optional) Stored as provenance replay instructions for auditors/operators.

Baseline packs — Import ZIP (AWS / Entra / GCP)

Upload a ZIP created from a baseline export pack folder (must include manifest.json). The pack attaches evidence to multiple controls based on the manifest targets.

Seed frameworks Optional (idempotent). Leave blank to skip seeding.

Options

Skip missing controls

Skip duplicates

Pack ZIP

Controls

Filter

Import controls catalog (CSV/JSON)

File

Upsert

Attach missing objectives to existing controls

Template Columns: framework, control_code, title, description, required_frequency_days, objective_codes

New control

List

Selected

Select a control to show the live provenance story.

Raw control JSON

(none)

Add objective

Attached

ISO 27001 ISMS (Clauses 4–10)

These artifacts drive the computed ISO clause controls in /evaluate. Use “Approve + Save” to attach an approval decision id (auditor-friendly).

ISMS

Clause 4 — Scope

Scope statement

In scope

Boundaries

Approval

Clause 5 — Policy

Title / version

Policy text

Approval

Clause 6 — Risk Method + Risk Treatment Plan

Methodology

Scales

Scoring notes

Approval

RTP plan

Approval

Clause 7/8 — Competence + Operations

Competence

Evidence notes

Approval

Operations

Evidence notes

Approval

Clause 9 — Internal Audits + Management Reviews

Internal audits (9.2)

Date / auditor

Scope

Summary

Findings

Approval

(none)

Management reviews (9.3)

Date / facilitator

Attendees

Inputs

Outputs

Summary

Approval

(none)

Clause 10 — Corrective Actions

Title / status

Owner / due

Description

Root cause

Action plan

Verification

Closed at

Approval

List

Selected

(none)

Evidence Library

Select evidence to attach to exceptions and control tests.

Evidence

Filter

Selected

List

Selected

Select evidence to show provenance, replay, and scoring context.

Raw evidence / provenance JSON

(none)

Evidence Signals (integrity / relevance)

These scores are used by /evaluate (objective requirements gating and evidence confidence). Create multiple signals; the latest extracted_at wins.

Actions

Signal type

Scores

Data (JSON)

List

Selected

(none)

Evidence + Attestation

Attach evidence to a control, then create an engagement attestation (drives /evaluate).

Statement

Evidence (text)

Evidence Requests (PBC)

Track PBC items, statuses, and attach evidence (auditor workflow).

Title

Filter

Status

Owner / requester

Description

Selected

Selected owner / due

Selected requester / status

List

Selected

(none)

Exceptions (Findings)

Create findings/exceptions and attach evidence (SOC 2 Type II realism).

Filter

Title

Severity

Owner / due

Description

Remediation

Selected

Selected owner / due

Selected severity / status

Selected plan

List

Selected

(none)

Control Tests (Workpapers)

Create test results with Type II metadata (period, population, sampling) and evidence links.

Procedure

Result

Period

Sampling

Sample size

Exceptions

Evidence IDs

List

Selected

(none)

SoA (Statement of Applicability)

Applicable

Justification

Entries

Risk

Title

Likelihood

Impact

Treatment

Objective Requirements

Define objective-level evidence quality gates. When a requirement is present and not satisfied, an objective that would otherwise be PASS becomes INCONCLUSIVE.

Objective

Scope

Freshness / coverage

Signal mins

Sources Comma-separated evidence source types

Notes

Actions

List

Selected

(none)

Objective Graph (Prerequisites)

Define objective prerequisites (A → B). Evaluation gates objective PASS to INCONCLUSIVE when prerequisites aren’t satisfied.

Edges

Add prerequisite

List

Selected

(none)

Evaluation

Suggested workflow

Run evaluation to generate remediation actions.

Objective blockers

Run evaluation to see blocked objectives, next steps, and suggested owners.

Objectives

Select or click an objective to inspect requirement coverage, prerequisite gates, and trust signals.

Controls

Auditor Visuals (Graphs)

Visualize objective prerequisites and the merged engagement explanation graph. Click nodes to inspect details and “why” chains.

Crosswalk (SOC 2 + ISO → Canonical 10 frameworks)

This is a derived view computed from objective results (by default sources SOC2,ISO27001). It helps you reuse evidence across frameworks.

Targets

Summary

Selected

(none)

Actions

Objective prerequisite graph (DAG)

Selected node

(none)

Engagement explanation graph (merged)

Search

Matches

Neighborhood

Selected node

(none)

Audit Pack Snapshots

Create immutable audit pack snapshots, verify hash integrity, and diff changes over time.

New snapshot

Verify

Seal

Export snapshot

Runs as a background job for reliability. If it takes a while, check Jobs.

Diff

Auditor link

Current

List

Output

Jobs (Background work)

Queue long-running exports and track status (useful for enterprise-scale audits).

Jobs

List

Selected

(none)

Deployment (Scaling)

Scaling is controlled by your orchestrator (Docker Compose, Kubernetes, etc). These buttons copy reference Docker Compose commands for local scale testing.

Runtime readiness

Hardening checks

Enterprise posture

Key Vault, sealed export storage, SIEM export, request limits, security events, and sealed export verification.

Actions

SIEM destination

Security events

Sealed exports

Verification

(none)

Dev scale

Auth disabled. Uses jobs queue + workers.

Prod-like

Requires KAIRNEX_ADMIN_API_KEY.

Security & Exports

Admin tools for auditor-grade exports: signing keys, recipient registry, export policy, and encrypted export approvals.

Org Signing Keys (seal + bundle signatures)

Keys

List

Selected

(none)

Export Recipients (RSA public keys)

Recipients Required when export policy enforces registered recipients.

List

Selected

(none)

Export Policy (per engagement)

Policy

(none)

Encrypted Export (approval flow)

Requires a sealed snapshot + recipient RSA public key.

Snapshot

Requests

Selected

(none)

After downloading, run: backend/.venv/bin/python tools/verify_encrypted_bundle.py --bundle ... --recipient-private-key ... --keys-bundle ...

Reports (PDF)

Generate and download a PDF report for the selected engagement.

Actions

Selected

List

Selected

(none)

Audit Logs

Read-only log of audit-relevant actions (seeds, requests, exceptions, snapshots, etc.).

Logs

List

Selected

(none)