Prove it
The proof of what you do with AI, in one place and easy to find on the day someone asks for it.
Evidence scattered across emails and folders is useless in an inspection. Evidence brings together in a single repository your training records, contracts, provider documentation and the documents the platform itself generates, each with its category, its links and its retention date.
Alethexis does not produce the evidence: it organises and keeps it. You produce it, or other sections generate it. It does not assess whether a given set is enough for an obligation: that depends on your activity and your professional advice.
Evidence is included in every module. What changes from one to another is which categories you can upload, which records you can link each file to, and how much storage you have.
You drop in the file and fill in the title, category and retention date; optionally, a description and a link to a system, a control or a section. That link is what makes the evidence easy to find later.
In M1 you upload training records, policy acknowledgements, contracts, provider documentation and information to workers. M2 adds incident records and links to decisions, risks and incidents; M3 adds system logs, communications with authorities and links to the FRIA and the DPIA. What the module does not include is shown in the form, disabled, with the module in which it is available.
The PDFs of the AI use policy, the committee, the RACI matrix, the FRIA and the DPIA are filed under their category when generated, depending on your module. They cannot be deleted from Evidence: they are managed from their source section.
The screen tells you how many applicable controls labelled LM — legal obligation with an explicit mandate — still have no evidence at all, so you know where to continue. If there are no LM controls to document, it says so.
Each piece of evidence carries the retention date you set. Deletion is never automatic: it is always a human decision. With M3, the platform notifies you 30 days before the date. Every download goes through a temporary link and is logged.
Evidence index as a PDF
Lists each piece of evidence with its title, its category, what it is linked to, the upload date, the retention date and the size. It is generated in the account's legal language and recorded with a SHA-256 integrity hash.
The controls in the Alethexis catalogue that this feature helps to document, with their legal basis where they have one, and their nature.
Maintain a searchable inventory of evidence by type, system, date, author and sign-off status. How quickly evidence can be found determines the response time to a request from an authority or a client.
Configure access control by the product's canonical roles: Auditor (full read access to auditable evidence), AI Officer and DPO (read and write within their domain), Owner (full read plus administration), Contributor (limited read and write). The control is enforced through RLS in the database.
Legal basis
No direct basis in law.
Data from the controls catalogue. The labels show the regulatory nature of each control; they are not a statement of compliance.
Modules build on each other: M2 includes everything in M1, and M3 includes M1 and M2.