Pricing
About UsContactPress
Start FreeLog in
Evidence & Documentation
6 min readUpdated 2026-02-15

Uploading & Organizing Evidence

Step-by-step guide to uploading evidence files, setting metadata, linking to AI systems and controls, and maintaining an organized evidence vault.

Uploading & Organizing Evidence

Getting evidence into Klarvo is straightforward. This guide covers the upload process, metadata best practices, and organizational strategies to keep your vault audit-ready.

How to Upload Evidence

Method 1: From the Evidence Vault

  • Navigate to Evidence in the sidebar
  • Click Upload Evidence
  • Drag and drop files or click to browse
  • Fill in metadata (see below)
  • Click Save

    • Method 2: From an AI System

  • Open the AI System detail page
  • Navigate to the Evidence tab
  • Click Add Evidence
  • Upload and the evidence is automatically linked to that system

    • Method 3: From a Control

  • Open Controls and find the relevant control
  • Click Add Evidence in the evidence section
  • Upload and the evidence is automatically linked to that control

    • Method 4: During the Wizard

    Several wizard steps accept file uploads inline — vendor contracts, oversight SOPs, training materials. Files uploaded during the wizard are automatically linked to the system being created.

    Supported File Types

    CategoryFormats
    DocumentsPDF, DOCX, DOC, TXT, MD
    SpreadsheetsXLSX, XLS, CSV
    ImagesPNG, JPG, JPEG, GIF, SVG
    PresentationsPPTX, PPT
    ArchivesZIP (for bundled evidence)

    Maximum file size: 50 MB per file.

    Setting Metadata

    When uploading, fill in these fields:

    FieldGuidance
    NameDescriptive name: "Vendor X SOC 2 Report 2025" not "doc1.pdf"
    DescriptionWhat this document proves: "Demonstrates vendor security controls meet SOC 2 Type II requirements"
    Evidence TypeSelect: Policy, Screenshot, Report, Attestation, Certificate, Training Record, Contract, Other
    Expiration DateWhen this evidence needs refresh — e.g., annual certifications expire in 12 months
    ConfidentialityInternal Only (default) or Shareable with Auditor
    TagsAdd relevant tags for filtering: "vendor-security", "soc2", "annual-renewal"

    Linking Evidence to Entities

    Evidence gains compliance value when linked:

  • Link to AI System: Shows up in that system's evidence tab and contributes to its completeness score
  • Link to Control: Proves the control is implemented — this is the most valuable linkage
  • Link to Vendor: Supports vendor due diligence
  • Link to Task: Proves a compliance task was completed

    • You can link a single piece of evidence to multiple entities. For example, a vendor's SOC 2 report might be linked to the vendor record, the AI system that uses it, and the VEN-03 control.

    Organizational Strategies

    By system: Create a mental model of "everything related to System X is linked to System X"

    By control family: Tag evidence by control family (GOV, DEP, TRN, VEN, etc.) for easy filtering

    By renewal cycle: Use expiration dates and tags like "annual-renewal" to batch renewal efforts

    Naming Conventions

    Adopt a consistent naming convention:

    [Type]_[Entity]_[Description]_[Date]

    Examples:

  • "Certificate_VendorX_SOC2_2025-12"
  • "Screenshot_Chatbot_DisclosureNotice_2026-01"
  • "Policy_Internal_AIAcceptableUse_v2"
  • "Training_AllStaff_AILiteracy_CompletionReport_Q1-2026"

    • Best Practices

    📋 Upload immediately: Don't let evidence accumulate — upload when you receive or create it
    🏷️ Metadata matters: Well-tagged, well-described evidence is 10x more useful during an audit
    🔗 Link aggressively: Every piece of evidence should be linked to at least one system or control
    📅 Set expirations: This prevents stale evidence from counting toward compliance
    📸 Screenshots are evidence: A screenshot of your transparency notice in production is valid evidence