[
  {
    "evidence_id": "EVD-001",
    "filename": "EVD-001_security_overview.md",
    "title": "Cinderline Security Overview",
    "document_date": "2026-06-20",
    "fictional_owner": "Ilya North",
    "scope": "DocWeave AI hosted production scope",
    "evidence_role": "Program, governance, security ownership, monitoring, and high-level control summary",
    "synthetic_content_marker": "SYNTHETIC DEMONSTRATION — NOT CUSTOMER EVIDENCE",
    "referenced_questionnaire_ids": [
      "Q001",
      "Q002",
      "Q003",
      "Q004",
      "Q005",
      "Q013",
      "Q014",
      "Q020",
      "Q028",
      "Q029",
      "Q030",
      "Q034",
      "Q039",
      "Q049",
      "Q050"
    ]
  },
  {
    "evidence_id": "EVD-002",
    "filename": "EVD-002_access_control_procedure.md",
    "title": "Access Control Procedure",
    "document_date": "2026-06-18",
    "fictional_owner": "Ilya North",
    "scope": "Workforce, administrative, and production access for DocWeave AI",
    "evidence_role": "Unique identity, MFA, role assignment, review, revocation, and access logging",
    "synthetic_content_marker": "SYNTHETIC DEMONSTRATION — NOT CUSTOMER EVIDENCE",
    "referenced_questionnaire_ids": [
      "Q006",
      "Q007",
      "Q008",
      "Q009",
      "Q010",
      "Q011"
    ]
  },
  {
    "evidence_id": "EVD-003",
    "filename": "EVD-003_secure_development_summary.md",
    "title": "Secure Development Summary",
    "document_date": "2026-06-19",
    "fictional_owner": "Ren Okafor",
    "scope": "DocWeave AI application repositories and release workflow",
    "evidence_role": "Development lifecycle, review, scanning, remediation, change control, and rollback",
    "synthetic_content_marker": "SYNTHETIC DEMONSTRATION — NOT CUSTOMER EVIDENCE",
    "referenced_questionnaire_ids": [
      "Q020",
      "Q021",
      "Q022",
      "Q023",
      "Q024",
      "Q025",
      "Q026",
      "Q027"
    ]
  },
  {
    "evidence_id": "EVD-004",
    "filename": "EVD-004_incident_response_procedure.md",
    "title": "Incident Response Procedure",
    "document_date": "2026-06-17",
    "fictional_owner": "Ilya North",
    "scope": "Security incidents affecting the DocWeave AI hosted production scope",
    "evidence_role": "Incident classification, escalation, notification, exercises, and log preservation",
    "synthetic_content_marker": "SYNTHETIC DEMONSTRATION — NOT CUSTOMER EVIDENCE",
    "referenced_questionnaire_ids": [
      "Q034",
      "Q035",
      "Q036",
      "Q037",
      "Q038",
      "Q042"
    ]
  },
  {
    "evidence_id": "EVD-005",
    "filename": "EVD-005_backup_continuity_summary.md",
    "title": "Backup and Continuity Summary",
    "document_date": "2026-06-16",
    "fictional_owner": "Theo Vale",
    "scope": "DocWeave AI production data and essential service recovery",
    "evidence_role": "Backups, restoration, continuity targets, and communication arrangements",
    "synthetic_content_marker": "SYNTHETIC DEMONSTRATION — NOT CUSTOMER EVIDENCE",
    "referenced_questionnaire_ids": [
      "Q031",
      "Q032",
      "Q039",
      "Q040",
      "Q041",
      "Q042"
    ]
  },
  {
    "evidence_id": "EVD-006",
    "filename": "EVD-006_vendor_register.md",
    "title": "Critical Vendor Register",
    "document_date": "2026-06-15",
    "fictional_owner": "Theo Vale",
    "scope": "Vendors supporting the DocWeave AI hosted production scope",
    "evidence_role": "Vendor inventory, service purpose, review tier, and subprocessor mapping",
    "synthetic_content_marker": "SYNTHETIC DEMONSTRATION — NOT CUSTOMER EVIDENCE",
    "referenced_questionnaire_ids": [
      "Q015",
      "Q028",
      "Q030",
      "Q043",
      "Q044",
      "Q045"
    ]
  },
  {
    "evidence_id": "EVD-007",
    "filename": "EVD-007_data_flow_description.md",
    "title": "DocWeave AI Data Flow Description",
    "document_date": "2026-06-21",
    "fictional_owner": "Ren Okafor",
    "scope": "Customer document ingestion, processing, storage, export, and deletion",
    "evidence_role": "Encryption, retention, deletion, segregation, non-production use, and model-data boundary",
    "synthetic_content_marker": "SYNTHETIC DEMONSTRATION — NOT CUSTOMER EVIDENCE",
    "referenced_questionnaire_ids": [
      "Q013",
      "Q014",
      "Q015",
      "Q016",
      "Q017",
      "Q018",
      "Q019",
      "Q049"
    ]
  },
  {
    "evidence_id": "EVD-008",
    "filename": "EVD-008_training_personnel_record.md",
    "title": "Personnel and Security Training Record",
    "document_date": "2026-06-24",
    "fictional_owner": "Elin Park",
    "scope": "All 35 fictional Cinderline personnel",
    "evidence_role": "Background screening assertion, confidentiality obligations, and security training completion",
    "synthetic_content_marker": "SYNTHETIC DEMONSTRATION — NOT CUSTOMER EVIDENCE",
    "referenced_questionnaire_ids": [
      "Q046",
      "Q047",
      "Q048"
    ]
  },
  {
    "evidence_id": "EVD-009",
    "filename": "EVD-009_test_review_record.md",
    "title": "Control Test and Review Record",
    "document_date": "2026-06-25",
    "fictional_owner": "Ilya North",
    "scope": "Selected control checks for the DocWeave AI hosted production scope",
    "evidence_role": "Risk review, access review, code review sampling, restore test, and planned exercises",
    "synthetic_content_marker": "SYNTHETIC DEMONSTRATION — NOT CUSTOMER EVIDENCE",
    "referenced_questionnaire_ids": [
      "Q004",
      "Q009",
      "Q021",
      "Q022",
      "Q023",
      "Q024",
      "Q025",
      "Q032",
      "Q037",
      "Q041"
    ]
  }
]