Evidence you already have, in the shape an auditor asks for.

Frameworks and how they are named

Every control maps to all three frameworks. Choose the ones you follow under Frameworks you follow on the page, or with tilldev shield compliance frameworks set; that only changes which criteria are listed and exported.

Criteria are given by their identifiers, and the descriptions are TillDev’s own words. Frameworks whose licence does not allow use in a paid product are not included.

The controls

Each control states its objective, the facts it was judged on, and where they came from. A criterion takes the worst status among the controls that support it.

The period

Controls are judged over a period: the last 90 days unless you pick dates, and at most 366 days. The end date is included and is never later than now. Counts such as vulnerabilities fixed on time, restores tested and production deploys approved cover the period; settings such as whether two-factor sign-in is required are read as they are now.

Attestations and exclusions

Some evidence lives outside TillDev: a policy the board approved, a risk assessment, training records, supplier reviews. A member attests to it with a statement, an optional reference to where it is kept, and how long it stays valid (default 365 days, at most 731). Governance controls pass on a valid attestation; a product control can be attested only where the product holds no record either way, and an attestation never turns a failing control into a pass. An attestation lapses at the end of its validity and can be revoked, never edited; revoked ones stay on record.

A control that does not apply to you can be excluded with a reason (10 to 500 characters). It shows as excluded, and its facts and your reason go into every snapshot, so the auditor sees both.

Snapshots an auditor can check

A snapshot freezes every control, its facts, attestation and exclusion over a period. One is taken each month over the default period the first time anyone opens the page that month, and you can take one for any period. Snapshots cannot be changed or deleted from the dashboard, the CLI or the API, and the database lets the application only add them. The digest chain below makes any change detectable regardless.

Each snapshot is numbered, and its digest is the SHA-256 of its canonical JSON: the body without digest, keys sorted, no whitespace. Each records the digest of the one before it, so changing or removing one breaks every link after it. The page and tilldev shield compliance snapshots recompute the whole chain each time. The JSON export says tilldev.compliance.snapshot/1, and anyone can check it without TillDev:

// Node 20 or later, no dependencies
import { createHash } from 'node:crypto'
import { readFileSync } from 'node:fs'

const canonical = (v) =>
  v === null || typeof v !== 'object'
    ? JSON.stringify(v ?? null)
    : Array.isArray(v)
      ? `[${v.map(canonical).join(',')}]`
      : `{${Object.keys(v).filter((k) => v[k] !== undefined).sort().map((k) => `${JSON.stringify(k)}:${canonical(v[k])}`).join(',')}}`

const { digest, ...body } = JSON.parse(readFileSync(process.argv[2], 'utf8'))
console.log(createHash('sha256').update(canonical(body)).digest('hex') === digest ? 'digest holds' : 'digest does not match')

The Markdown export is the same snapshot laid out for a reader: the period, a summary, each control with its facts and criteria, and the digest.

From the CLI and the API

Shield → Compliance shows all of this. Owners and admins only.

tilldev shield compliance                          # every control over the last 90 days
tilldev shield compliance --from 2026-01-01 --to 2026-06-30
tilldev shield compliance show access-mfa          # facts, criteria and attestations for one control
tilldev shield compliance criteria soc2            # each criterion with the worst status of its controls
tilldev shield compliance frameworks set soc2,iso27001

tilldev shield compliance attest governance-policy \
  --statement "Information security policy v4, approved by the board on 2026-03-12" \
  --reference POL-004 --days 365
tilldev shield compliance exclude data-endpoints --reason "No staff devices: managed cloud desktops only"

tilldev shield compliance snapshot --from 2026-01-01 --to 2026-06-30
tilldev shield compliance snapshots                # newest first, and whether the chain holds
tilldev shield compliance export 4 --format md --out q2-evidence.md
tilldev shield compliance export 4 --out q2-evidence.json
tilldev shield compliance verify q2-evidence.json  # recomputes the digest offline

The API is GET /api/v1/shield/compliance with from and to, plus /shield/compliance/attestations, /exclusions, /snapshots and /settings. See the API reference.