Evidence and audit

The record, and why it holds

Every deploy, decision, comment, exception and administrative change is appended to a hash chain. It is append-only at the database level rather than by convention:

• the application has insert and select rights only, and no delete on any table;
• database triggers reject updates, deletes and truncation for every role, the table owner included;
• events are chained with SHA-256, so altering who approved something, or when, breaks verification;
• the chain head is periodically anchored, because a hash chain alone cannot detect its own tail being truncated.

Each organization has its own chain starting at sequence 1, so your evidence neither contains nor depends on anybody else's events. Administration is in the same chain as the deploys, so "who made this person an approver" is evidence of the same quality as "who approved this deploy".

Giving an auditor something to check

The Evidence screen does three things, and an auditor with a token can do all three directly:

• Verify the chain. It either verifies or it names the event that broke and why — the answer to a failed verification is the finding itself, not an error about the request.
• Report when the head was last anchored.
• Download date-ranged exports, as CSV and as JSON.

Each deploy carries a separation-of-duties verdict — compliant, automated, non-compliant or undecided — and the same four appear in the export, on the badge and in Insights, so the three cannot disagree.

Insights

For one app or all of them over a chosen period: how often it ships, who is doing the work, how long a decision takes. Everything on the screen is one read of that slice, so the tiles, the charts and the tables cannot disagree with each other.

It deliberately does not keep score. Deploy activity plots what Bubble says shipped against what was approved here — where the first bar is taller, something shipped that nobody agreed to, and that gap is the point of the chart. Time to decide is a median and a 90th percentile rather than a mean, because one request that sat over a long weekend should not describe everyone's experience. Raising and deciding are counted in separate columns and never added together: the whole control is that one person does not do both to the same request.

For an auditor

The full control narrative — the control as designed, what to test, and the known limitations stated rather than hidden — is maintained alongside the code at docs/control-narrative.md.

It is deliberately candid about what a browser extension can and cannot guarantee. An organization that also runs Vanta can push its apps and approved deploys into its own Vanta tenant hourly, so the Bubble app stops being the one system in a compliance program Vanta cannot see.