Evidence Studio
Workflow guide
Local-first is a boundary, not a backup.
Keeping project content on the reviewer’s device reduces routine data movement. It does not remove the need for access control, recovery copies, retention rules or careful exports.
| Local-first helps with | It does not solve by itself |
|---|---|
| Keeping draft findings and screenshots out of a vendor database during normal use | A stolen, shared or unmanaged reviewer device |
| Making export an explicit reviewer action | What happens after an exported file is emailed or uploaded |
| Working without a hosted project account | Browser profile loss, disk failure or accidental deletion |
| Limiting the product operator's access to project content | The client's retention, legal or incident-response requirements |
A recoverable local-first workflow
- Agree the data boundary. Decide which client data may enter the project, which details must be anonymized, who may use the review profile and how long evidence is retained.
- Use a managed review environment. Apply device encryption, screen lock, browser profile separation and organization policy appropriate to the sensitivity of the audit.
- Capture only what is needed. Screenshots and page context can contain personal information far outside the finding. Crop or redact the shareable copy and keep the original only when it has a justified purpose.
- Name projects and exports safely. Filenames leak context. Use identifiers that work with the client’s classification and ticketing policy.
- Create explicit recovery copies. Browser storage can disappear. Export a project backup to an approved encrypted location at defined milestones, then test that it can be restored.
- Review every report before release. Treat export as a publication boundary. Check sensitive text, images, hidden content, metadata, scope statements and report accessibility.
- Close the project deliberately. Confirm delivery, archive the approved artifacts, delete working copies according to policy and record what was retained.
Questions for an agency workflow review
- Where do findings, screenshots, scanner results and retest decisions live today?
- Which copy is the source of truth when evidence conflicts?
- Who reviews redaction and report accessibility before release?
- Can a second specialist reproduce a finding without asking the original tester?
- Can the team recover a project after loss of the browser profile?
Evidence Studio's designed boundary: project content remains in Chrome during the normal workflow; reports and backups leave only when the reviewer exports them. Licence validation does not include project content. The full, specific behavior is documented in the privacy notice.
Pilot the workflow on one anonymized audit.
The fixed-scope agency pilot maps one current workflow, configures a sample project and delivers written notes without requiring a sales call.
See the €750 pilot