PacketVerifier-backed PR and audit evidence
Evidence rooms
Give buyers the proof without handing over the workspace.
Package PR evidence, audit chains, security-review exports, readiness reports, and trust artifacts into scoped, expiring, auditable review spaces.
Evidence room
Share proof without losing control.
Evidence Rooms and Procurement Folios package PR evidence, audit records, security-review exports, readiness reports, and uploaded trust artifacts behind scoped, expiring, verifier-backed access.
VaultPDFs, scanner exports, IR docs, diagrams
AccessScoped viewers, expiry, audit trail
TrustHashes, signatures, control links
room.create() -> scoped viewer policyartifact.extract() -> controls and evidence linksshare.verify() -> packet hash and expiryexpiring linksaudit trailverifier state
Verifier-backed sharing
Shared packets retain hash, signature, audit-chain, policy, CI, reviewer, and control-mapping state.
Trust Artifact Vault
DPA, subprocessors, pen-test summaries, scanner exports, IR/DR docs, diagrams, and SOC artifacts carry hashes, expiry, owner, and review state.
Scoped access
Rooms enforce viewer role, expiry, audit trail, export controls, and current verifier state.
Room
Share the evidence set a buyer actually asks for.
A room can include selected PRs, evidence packets, readiness reports, audit entries, security-review exports, procurement artifacts, and current blockers.
- Scoped room policy
- Expiring links
- Viewer audit
- Current verifier state
Vault
Procurement files become linked proof, not loose PDFs.
Uploaded artifacts keep metadata, source URI, owner, expiry, review state, extraction status, and links back to evidence and controls.
- Artifact hashes
- Extraction links
- Control references
- Review expiry
Signed remediation PR
boetica/auth-rate-limit-pr
@@ apps/web/src/app/api/login/route.ts- await password.verify(body.password)+ await limiter.consume(requestIp)+ await password.verify(body.password)+ await audit.append(evidencePacket)
evidence packetKMS + Sigstore (cosign)
- packet hash
- 91f4e2a0
- prev hash
- 5e1c8a44
- trust boundary
- sandbox attested · egress denied
- merge policy
- platform-eng / human merge
SOC 2 CC6.6signedNIST AC-6signed
Folio
Security review can move without another spreadsheet.
Procurement Folios combine live Boetica exports and customer-requested artifacts into a reviewable package that stays tied to evidence and readiness state.
- Security-review export
- Readiness report
- Procurement checklist
- Redacted downloads