Compliance

The burden of proof has shifted.

Regulators no longer ask if you have a policy. They ask if you can prove the policy was in place, operating, and followed — at the time it needed to be. That is a different and much harder question.

The question every regulator now asks
"Can you prove this document existed, in this form, at this date — to a party that does not trust you?"

Every compliance framework now encodes this question. HMRC's AIF requires evidence of when R&D uncertainties were overcome. GDPR Article 5(2) requires you to demonstrate compliance. ISO 27001:2022 Annex A 8.15 requires logs that prove controls were operating. HIPAA's OCR has stated: "cannot produce = never existed."

Precedent

In every case, the document was the weak link.

Meta Platforms
Irish DPC · GDPR
€17M
Could not demonstrate security controls were operating at the time of 12 data breaches.
Boeing
US DOJ · AS9100
$487M
Inspection records for Dreamliner components could not be proven to exist at the point of manufacture.
Advanced Computer Software
UK ICO
£3.07M
Could not demonstrate its vulnerability scanning tool had actually been used before a breach.
National Grid Gas
UK HSE
£4M
769 buildings where safety inspections could not be evidenced at the required intervals.
Frameworks

Five frameworks. One question. One answer.

ISO 27001:2022
Annex A 8.15 · Clause 7.5

Prove logs and controls were operating at the time of the event, not just declared at audit.

GDPR / NIS2
Article 5(2) · Article 21

Demonstrate controls were in place and operating at the time of the incident or data processing.

HMRC R&D
AIF · Finance Act 2000

Contemporaneous evidence that the work happened when the claim says it did.

HIPAA / FDA
45 CFR 164.312 · 21 CFR Part 11

Risk analyses and records existing at the time they were required — OCR: 'cannot produce = never existed.'

SEC Rule 17a-4
Independent third-party attestation

Immutable records with a designated third-party attestation — provider's word alone is not trusted.

The gap

Vanta, Drata and WORM storage push the "when" problem back to you.

Compliance platforms solve collection. They do not solve authenticity. Every major platform's MSA contains language equivalent to: "Customer, not Vanta, shall have sole responsibility for the accuracy, quality, integrity... of all Customer Data." When the auditor asks when a document was created, the platform's answer is: "the customer typed that date in."

Vanta

"Effective Date" field — set by the customer, editable after upload. The auditor cannot verify it.

Drata

"Creation date" — typed manually at upload, remains editable. Drata's answer when challenged: 'the customer entered it.'

Secureframe

"Activity Completion Date" per record. ToS: 'Customer is solely responsible for the accuracy, integrity...' of all evidence dates.

AWS S3 / Azure WORM

Prevents your users from deleting. Does not prevent provider engineers or lawful government orders. Rule 17a-4 already knows this — requires independent third-party attestation.

Prove your first file in minutes.

Takes seconds. Works on any file type. No installation required.

Sign up for free