An auditor checks it without asking us
One request produces an evidence pack for your organisation. It is a readable report and a machine-readable file, and you prove the two match.
What the pack holds
Who has access and with which role. How long each kind of record is kept. The most recent audited actions. Who was on the premises in the period you choose.
The privacy protections in force, the last retention run, open data requests with their deadlines, and the providers who process your data, with the region of each.
The incident register with its notification clocks, and the date of your last tabletop exercise.
How it proves itself
Every audited action is linked to the one before it. The report checks the links and says whether the chain is intact.
The report prints a SHA-256 fingerprint of the exact file you download. Compare the two and any difference shows.
Who can produce it
Staff with the evidence permission, normally the owner and the compliance officer. Every pack produced or opened is itself recorded in the audit trail.
What it does not claim
The pack shows what the product did. It is not a certificate, and it does not state whether a law or a standard is met. An independent assessor decides.