Compliance Evidence

Compliance evidence is the retained set of facts, timestamps and artefacts that proves a specific compliance condition was reached on a specific basis, at a specific moment, for a specific registered identity.

It is produced as a byproduct of evaluation, not manufactured separately after the fact. When a condition is composed (Route 03), the same process that assembles the result also fixes the basis it rested on — and that basis, once fixed, becomes evidence the moment it is retained.

Evidence exists to answer one question honestly, indefinitely: on what grounds was this finding made? If that question cannot be answered from the retained record, the condition — however correct it may have been — is not evidenced, and an unevidenced condition cannot survive a dispute, an audit, or a certification decision built on top of it.

Not everything touched during evaluation qualifies. Evidence is the subset of material that is retained, time-stamped, and sufficient on its own to reconstruct why a condition came out the way it did.

• Basis records — the specific record facts (registration state, certification state, jurisdiction assignment, flags) that were compared against applicable requirements.
• Timestamps — the exact moment evaluation occurred, since a condition's validity is time-bound and evidence must fix that moment precisely.
• Retained conditions — the composed finding itself, kept as a historical artefact rather than overwritten by the next evaluation.
• Verification artefacts — proof that a scan, check or lookup actually took place: which mechanism ran, against which source, with what result.
• Applicable requirement references — which governed rules were in scope at that moment, so the comparison can be reconstructed later even after amendment.

A screenshot of a status label, a verbal assurance, or a re-derived guess about what the record probably said at the time are not evidence. Evidence is retained at the moment it is created; it cannot be reconstructed convincingly after the fact from memory or inference.

The most common confusion is treating the condition and its evidence as the same thing. They are produced together but serve different purposes and answer different questions.

A condition can be correct without being evidenced — briefly, before retention completes. It cannot be defensible without being evidenced. Defensibility is the whole point of keeping evidence at all.

This route deliberately stops short of the audit trail. Category 07 routes — event history, status change history, verification and certification evidence, evidence preservation and evidence retrieval among them — govern the deeper mechanics of how evidentiary material accumulates into a queryable history over the life of an identity. This route describes what qualifies as evidence and the obligations around it at the point of creation; it does not restate that machinery.

Evidence is only useful if the right parties can reach it and the wrong parties cannot. Retrieval is governed, not open by default.

1. 1Identify the requesting party's authorizationA request to retrieve evidence is evaluated against the requester's role and standing before any material is returned.
2. 2Match the request to the identity and windowEvidence retrieval is scoped to a specific registered identity and, typically, a specific time window or event.
3. 3Return the basis, not a reinterpretationWhat is returned is the original retained material — basis, timestamp, artefacts — not a fresh summary or a newly computed opinion about what it means.
4. 4Log the retrieval itselfThe act of retrieving evidence is itself recorded, so that access to sensitive proof is traceable in turn.

Typical authorized parties include the issuer or company the identity is associated with, operators with a recognised compliance role, regulatory or audit parties acting under recognised authority, and governance itself where a rule's application is in question. A member of the public presented with a scan result does not automatically gain the right to pull the evidence behind it — the published status and the underlying evidence sit at different access levels for a reason discussed further in the privacy and authorized-access category.

Evidence that can be quietly altered or lost defeats its own purpose. Preservation is the set of obligations that keep retained evidence trustworthy for as long as it might be needed.

• ✓Evidence is retained in a form that cannot be silently edited after the fact.
• ✓Evidence is not deleted because the underlying condition later changed or was superseded.
• ✓Evidence tied to an active dispute, investigation or certification decision is held beyond any ordinary retention window until that matter resolves.
• ✓Evidence retention periods are set by governed policy, not left to case-by-case discretion.
• ✓Where evidence must eventually be purged, the fact that it existed and was purged under policy is itself recorded.

Preservation does not mean every piece of evidence is kept forever without limit — that is a retention-policy question outside this route's scope. It means that whatever the policy sets, evidence cannot be overwritten, contradicted or quietly discarded outside that policy simply because it becomes inconvenient later.

Compliance evidence is what lets every other layer trust a condition without re-deriving it from scratch each time.

Where retained evidence appears to conflict with QRCodex.us history, Codex governs and the discrepancy is investigated, not resolved by preferring one record silently.