Add & classify

Evidence enters SolveGRC through two doors. Documents is where files live: you upload them, the platform reads them, and they become searchable text the AI can cite. The Evidence Library is where proof lives: a registered evidence item with an integrity snapshot, a quality score, and links to the controls it supports. A file usually passes through the first door before it is registered at the second, and this page covers both.

Upload to Documents

Click Upload Document on the Documents page. Each upload takes one file. The dialog suggests a Content type — Document, Questionnaire, Network Diagram, or Evidence — marked "AI suggested", and routes the file to the right ingestion pipeline. Check the suggestion, change it if it is wrong, and upload.

The Upload Document dialog: a file picker (PDF, Word, Excel, Text, Images, Visio up to 50MB), a title field, and the note that uploads run extract → chunk → embed automatically and become searchable, citable evidence. AI classifies the content type on upload.

A general document also needs a Document Type — Policy, Procedure, Guideline, Evidence, Report, Contract, Training Material, or Other — which is how the Policies register later knows which uploads are policies.

Questionnaires take their own door

If the classifier detects a questionnaire, the file is routed to the Questionnaires module instead of the document library. That flow has its own guide: Upload and parse.

What processing does, in plain words

Every upload runs a three-step pipeline, shown per document in the Pipeline column:

1. Extract. The platform pulls the text out of the file — including OCR when the file needs it, and AI-assisted extraction for stubborn formats.
2. Chunk. The extracted text is cut into passages small enough to retrieve and cite individually.
3. Embed. Each passage is indexed for semantic search, so a question about "access reviews" finds the right paragraph even when the document says "entitlement recertification."

When all three finish, the document reaches Ready: it is searchable from the Search tab, citable by the AI, and registered as evidence automatically. The status badge walks through Uploaded → Extracting → Extracted → Chunked → Ready, and the page refreshes itself every few seconds while work is in flight. If a stage fails, the row's action menu offers Retry Processing, or you can rerun a single stage with Re-extract Text, Re-chunk Document, or Re-generate Embeddings.

The Document Library: the Total / Ready / Processing / Failed counters over a table whose columns show each document's status, its Type & Evidence registration state, the four-stage Pipeline indicator, and an extraction-quality bar.

The Quality column shows an extraction quality score once processing completes — a read on how cleanly the text came out of the file, not a judgment of the content. A low score usually means a scanned or image-heavy original; re-extracting, or uploading a text-native version, improves it.

Register a document as evidence

Processing makes a file useful; registration makes it proof. When a document reaches Ready, SolveGRC registers it in the Evidence Library on its own, and its Type & Evidence column shows Registered, which opens the Evidence Library. A file whose content is already registered is not registered twice.

Register appears only on a document with no evidence record yet: one still processing, one that failed, or a duplicate of a file already registered. The Evidence status filter (All / Registered / Not registered) finds them. You can also start from the other side: Register Evidence in the Evidence Library opens the same dialog and lets you pick the document from a search of your 100 most recent uploads.

Registered documents keep their first record

If you pick a document that is already registered, SolveGRC keeps the existing evidence item and ignores the title, description, type, and strength you entered, even though the dialog reports success. Evidence items cannot be edited after registration, so describe a file well the first time.

The Register Evidence dialog: pick a document (a hash snapshot is captured at registration), give it a title and description, choose the evidence type, and set a 1–10 strength score with its rationale.

The dialog asks for:

• Title and description — name the evidence for a reader who has not seen the file, and say what it demonstrates.
• Evidence type — Document, Scan Result, Attestation, Screenshot, Report, or ZK Proof. The type drives filtering and how the item is presented later.
• Strength score and rationale — your own 1–10 judgment of how convincing this artifact is, with a sentence explaining why. It is stored with the item (under Additional Metadata on its Details tab) and does not feed the quality score.

On registration, SolveGRC takes a cryptographic hash snapshot of the item. That is what lets you later prove the artifact has not changed since the day you registered it.

Classification pays off later

A minute spent on an accurate type, a real description, and an honest strength rationale is repaid every time this item is a candidate for a control link, a questionnaire citation, or an evidence pack. Vague titles like "scan.pdf" are the main reason good evidence goes unused.

Evidence that registers itself

Besides your own uploads, three kinds of evidence register themselves: approved questionnaire answers (when they are approved), files a vendor uploads in the vendor portal, and files uploaded against an audit request (which are also sealed for you). You do not file them; you find them already in the Library. Your job with automated evidence is curation, not data entry: link it to the controls it supports from Assessments, and watch its quality and freshness.

---

Next: what the quality score on each item actually means, and how the platform tracks evidence going stale — Quality & freshness.