Add & classify

Evidence enters SolveGRC through two doors. Documents is where files live: you upload them, the platform reads them, and they become searchable text the AI can cite. The Evidence Library is where proof lives: a registered evidence item with an integrity snapshot, a quality score, and links to the controls it supports. A file usually passes through the first door before it is registered at the second, and this page covers both.

Upload to Documents

Click Upload Document on the Documents page. The upload dialog classifies the file for you — general document, network diagram, or questionnaire — and routes it to the right ingestion pipeline. Confirm the detected content type (or pick one yourself if the classifier asks) and upload.

The Upload Document dialog: a file picker (PDF, Word, Excel, Text, Images, Visio up to 50MB), a title field, and the note that uploads run extract → chunk → embed automatically and become searchable, citable evidence. AI classifies the content type on upload.

For a general document you can also set a Document Type — Policy, Procedure, Guideline, Evidence, Report, Contract, and so on — which is how the Policies register later knows which uploads are policies.

Questionnaires take their own door

If the classifier detects a questionnaire, the file is routed to the Questionnaires module instead of the document library. That flow has its own guide: Upload and parse.

What processing does, in plain words

Every upload runs a three-step pipeline, shown per document in the Pipeline column:

1. Extract. The platform pulls the text out of the file — including OCR when the file needs it, and AI-assisted extraction for stubborn formats.
2. Chunk. The extracted text is cut into passages small enough to retrieve and cite individually.
3. Embed. Each passage is indexed for semantic search, so a question about "access reviews" finds the right paragraph even when the document says "entitlement recertification."

When all three finish, the document reaches Ready: it is searchable from the Search tab, citable by the AI, and eligible to become evidence. The status badge walks through Uploaded → Extracting → Extracted → Chunked → Ready, and the page refreshes itself every few seconds while work is in flight. If a stage fails, the row's action menu offers Retry Processing, or you can rerun a single stage with Re-extract Text, Re-chunk Document, or Re-generate Embeddings.

The Document Library: the Total / Ready / Processing / Failed counters over a table whose columns show each document's status, its Type & Evidence registration state, the four-stage Pipeline indicator, and an extraction-quality bar.

The Quality column shows an extraction quality score once processing completes — a read on how cleanly the text came out of the file, not a judgment of the content. A low score usually means a scanned or image-heavy original; re-extracting, or uploading a text-native version, improves it.

Register a document as evidence

Processing makes a file useful; registration makes it proof. In the document's Type & Evidence column, click Register. Already-registered documents show a Registered badge there instead, which links through to the evidence record, and the Evidence status filter (All / Registered / Not registered) surfaces the uploads still waiting.

You can also start from the other side: Register Evidence in the Evidence Library opens the same dialog and lets you pick the document from a search.

The Register Evidence dialog: pick a document (a hash snapshot is captured at registration), give it a title and description, choose the evidence type, and set a 1–10 strength score with its rationale.

The dialog asks for:

• Title and description — name the evidence for a reader who has not seen the file, and say what it demonstrates.
• Evidence type — Document, Scan Result, Attestation, Screenshot, Report, or ZK Proof. The type drives filtering and how the item is presented later.
• Strength score and rationale — your own 1–10 judgment of how convincing this artifact is, with a sentence explaining why. An auditor reading "screenshot of one console page" versus "full quarterly access-review export" will weigh them differently; the rationale is where you say so.

On registration, SolveGRC takes a cryptographic hash snapshot of the item. That is what lets you later prove the artifact has not changed since the day you registered it.

Classification pays off later

A minute spent on an accurate type, a real description, and an honest strength rationale is repaid every time this item is a candidate for a control link, a questionnaire citation, or an evidence pack. Vague titles like "scan.pdf" are the main reason good evidence goes unused.

Evidence that registers itself

Not everything arrives by upload. Evidence produced inside the platform — approved questionnaire answers, cloud posture findings, continuity artifacts — is registered at the moment it is created, quality score included. You do not file it; you find it already in the Library, filterable by type and status like everything else. Your job with automated evidence is curation, not data entry: check its quality and freshness and link it where it belongs.

---

Next: what the quality score on each item actually means, and how the platform tracks evidence going stale — Quality & freshness.