Evidence investigations

Use evidence when a masked match is not enough to act, for example to confirm exactly what was pasted into an external tool or which customer records were copied. Evidence is available only for findings of rules with Seal evidence on the device enabled, while the device still keeps the item.

The process

1. Request. On a finding with sealed evidence available, choose Request evidence and write the reason (at least 10 characters). The request is audited. If enabled in Settings → Privacy, the employee's device shows a notice.
2. Upload. At its next check-in the device uploads the item, still sealed, and the request moves to Received. If the item has expired on the device or the device was revoked, it becomes Unavailable with the reason. Requests that are not answered within 14 days expire.
3. Open. Choose Open, enter the evidence passphrase and the purpose (for example the incident number). Sentinel shows the captured text with the matched spans highlighted. The opening, the purpose and the person are audited.
4. Cancel a pending request you no longer need.

Uploaded sealed evidence is deleted from Sentinel when the evidence retention in Settings → Retention ends (30 days by default); the request and its audit trail remain.

Protections

• The sealed item can only be decrypted with the organisation's evidence key, whose private half is encrypted with the evidence passphrase. Sentinel never stores the passphrase.
• Opened evidence is decrypted in memory for display only. It is never stored in readable form, the browser is told not to cache it, and it is cleared when the viewer closes. Each opening requires the passphrase again.
• Wrong passphrases are rate-limited and audited.
• Only owners, admins and analysts can request and open evidence. Auditors can see that requests and openings happened, but not the content.

TIP

Agree the evidence process with your data protection officer and employee representatives before rollout: who may request, which reasons are acceptable, and who holds the passphrase. The employee notice template describes the process for employees.