Skip to main content
Code auditCheck every pull request for privacy riskWebsite auditCatch scripts and vendors that appear in productionInth AgentAsk what changed and follow the answer to its sourceCookie consentFast consent that lives in your codebase
AboutHandbookBlogOSS
AI feature reviewsFundraising Due DiligencePrivacy impact reviewsEnterprise customer reviewsCookie and tracking audits
Pricing
Sign inRun a free scan
Run a free scan
Back to the blog
04 / Article/Assurance

Evidence should ship with the change

The cheapest evidence is created while the owner, source, review, and fix are already in the same workflow.

Published
June 12, 2026
Reading time
5 min read
Inth blog
04Assurance

On this page

Contents3 sections
  1. 01Reconstruction is expensive
  2. 02Keep the chain intact
  3. 03Evidence is an interface
  1. 01Reconstruction is expensive
  2. 02Keep the chain intact
  3. 03Evidence is an interface
Written by
Inth research

Continuous assurance

Compliance evidence is often treated as a separate reporting job. Product evidence is stronger when it is captured as a by-product of the work itself.

01 / Section

Reconstruction is expensive

When evidence is collected at the end of a quarter, teams have to reconstruct the story from tickets, chats, repository history, screenshots, and memory. The work is slow because the original context has already dispersed.

Capturing evidence during review turns the same activity into a durable record without creating a second process.

02 / Section

Keep the chain intact

The strongest record connects a detected change to its owner, review, decision, remediation, and final verification. Each part answers a different question, but together they explain why the product is under control.

01
Source
The commit, deployment, request, or runtime signal.
02
Decision
The owner, reviewer, rationale, and approval state.
03
Verification
The fix and evidence showing the issue is closed.

03 / Section

Evidence is an interface

Good evidence has more than one consumer. Engineers need the technical source. Privacy teams need the purpose and decision. Auditors and customers need a stable record that can be verified without replaying the entire workflow.

Practical outcome

Do the work once. Reuse the evidence everywhere.

A durable product record should support review, audit, customer assurance, and the next product decision.

Newer article · 03Your consent banner can be correct while your product driftsA configured banner describes intent. Runtime monitoring shows whether scripts, vendors, and domains actually respect it.Runtime/7 min readBlog indexBack to the blogReturn to the latest dispatch and the complete archive.Browse the archive

Turn the next privacy question into evidence

Connect the product record and give engineering, privacy, security, and legal the same source of truth.

Start for freeTalk to us
Inbox - Inth
Inbox

Open

9 items

Reviewing evidence
  • PII in request logs

    4m

    api-gateway forwards email addresses to the logging vendor.

    P0Code scan·Project finding
  • Script calls new domain

    22m

    cdn.thirdparty.io detected in production before consent.

    P1Website activity·Project finding
  • New tracker: pixel.js

    1h

    Marketing category script added without a vendor record.

    P1Website activity·Project finding
Inbox - Inth
INInthPro
Search⌘ K

Products

Inbox
OpenResolvedDismissedAccepted risk
Agent
Audit
Consent
Billing
Settings
Getting started
Help
AMAlex Morgan

Open

9 items

  • PII in request logs

    4m

    api-gateway forwards email addresses to the logging vendor.

    P0Code scan·Project finding
  • Script calls new domain

    22m

    cdn.thirdparty.io detected in production before consent.

    P1Website activity·Project finding
  • New tracker: pixel.js

    1h

    Marketing category script added without a vendor record.

    P1Website activity·Project finding
  • New SDK: analytics-node@4

    5h

    Adds a data flow to Segment. Policy v9 has no match.

    P2Code scan·Project finding
P0Code scan·Open

PII in request logs

Summary

The API gateway forwards email addresses to a logging vendor without an approved data flow.

Evidence

Open scan report →
src/logging/request.ts:42-44
42
43
44
logger.info({
  email: request.user.email,
});

Recommended action

Remove the email field or replace it with a non-identifying internal user ID.
Inbox item resolved

New agent

Privacy agent

Research privacy requirements and turn guidance into practical next steps.

Ask anything about privacy…
Research

Legal information grounded in curated guidance, not legal advice.

Notes from building privacy into the product

Notes from building Inth. Sent occasionally.

Inth connects what your company promised to what engineers just shipped.

Platform

  • Code audit
  • Website audit
  • Inth Agent
  • Consent banner
  • Pricing

Use Cases

  • Privacy Impact Review
  • AI Feature Reviews

Company

  • About
  • Blog
  • Open source
  • Contact

Resources

  • Documentation
  • GitHub
  • Cookiebench
  • Status

© 2026 Inth. All rights reserved.

  • Contact us
  • Privacy
  • Cookies
  • Terms