Evidence Vault Overview
The Evidence Vault is Klarvo's secure repository for all compliance documentation. It stores, organizes, and manages every artifact needed for EU AI Act compliance — from vendor DPAs to transparency notice screenshots.
What Goes in the Evidence Vault?
| Evidence Type | Examples | Typical Source |
| Vendor documentation | DPAs, security whitepapers, model cards, SOC 2 reports | Vendor / procurement |
| Internal policies | AI acceptable use policy, oversight procedures, incident response plan | Compliance / legal |
| Training materials | Course content, completion certificates, quiz results | HR / training |
| Risk assessments | FRIA reports, DPIAs, internal risk reviews | Compliance |
| Monitoring reports | Performance metrics, bias test results, drift analysis | Engineering / data science |
| Incident documentation | Incident logs, postmortem reports, corrective actions | Operations / security |
| Transparency notices | Disclosure screenshots, notification copy, accessibility statements | Product / UX |
| Oversight documentation | SOPs, authority delegation, training records | Compliance / HR |
Evidence Organization
Evidence can be attached to multiple entities:
Evidence Metadata
Every file in the vault carries metadata:
Evidence Completeness Score
Each AI system shows an Evidence Completeness percentage:
Security & Access
Best Practices
📁 Link evidence to controls: Don't just upload files — connect them to the specific control they support
📅 Set expiration dates: Vendor certifications, training records, and risk assessments all have limited validity
✅ Use approval workflows: For audit-critical documents, require formal approval before they count toward compliance
🏷️ Tag consistently: Develop a taxonomy (e.g., "vendor-security", "training-completion", "transparency-notice") and use it
🔄 Quarterly review: Schedule a quarterly evidence hygiene review to catch expired or outdated documents