What is the difference between compliance evidence and a compliance certification?

A certification or attestation is issued by a party that is independent of the organization and qualified to assess it. The assessor defines a scope, tests controls against a standard over a period, and issues a report or certificate. Only that assessor can say the organization meets the standard, and only for that scope and period.

A tool vendor is not in that position. A monitoring product can produce excellent records, but it cannot certify its customers, and a vendor that claims to make customers compliant is overstating what it sells.

Evidence is useful to an auditor when it is complete, dated, attributable and tamper-evident. Complete means failures are recorded as clearly as successes. Dated means every record carries a trustworthy timestamp. Attributable means it is clear which system produced it. Tamper-evident means any later change can be detected.

A digital signature over a canonical form of each record is a practical way to meet the last requirement. Anyone holding the public key can check that the record is exactly what the system signed, without trusting the vendor's dashboard.

Evidence also has to exist when it is needed. An assessor usually reviews a period, not a single day, so records must be retained for at least that period and be retrievable without gaps. For Compliance Evidence Pro, retention of the evidence package is set by contract rather than by a fixed default.

An AI-assisted summary can save reviewers time by grouping incidents, describing trends and suggesting follow-ups. It becomes a risk when it produces numbers or states conclusions as facts. The safe rule is that every number comes from deterministic data, and every statement is labelled as a fact or as an inference.

Compliance Evidence Pro is an add-on to Monitor OTP/SMS and cannot be used alone. It packages the base product's runs into a signed evidence manifest (Ed25519 over canonical JSON, with a key ID), verifiable hashes, a monthly report, an incident summary, trends and exceptions. The report carries its signature and key ID and can be checked with the public verifier.

An AI-assisted executive summary classifies incidents and suggests recommendations, marking each statement as FACT or INFERENCE. The AI never invents metrics: every number comes from the base product's deterministic data, and a summary without that distinction is not published.

Compliance Evidence Pro does not replace legal advice or an independent assessment, and Witnio does not claim to make any customer compliant with any framework. It produces evidence that can support your own controls and your auditor's work.