The Evidence tab gives you a clear view of how each automated test was run—what it checks, which resources it evaluated, and the data supporting the result. It helps you validate test outcomes, understand why a test passed or failed, and provide auditors with reliable, audit-ready evidence.
The Evidence tab was previously called Source Data. We’re gradually rolling out this updated experience to all customers. If your organization is currently in an active audit, you’ll still see the older Source Data tab for now.
Evidence Tab
The Evidence tab is the central place to review and understand the details for how a test was run and the evidence your auditors will be provided once shared.
To open the Evidence tab:
Go to Tests using the navigation menu in your account.
Click the relevant automated test to open the Results tab.
Click the Evidence tab and scroll through each section of the page.
Note: The sections available in the Evidence tab depend on the test.
Test Criteria
Test Criteria
The Test Criteria section explains what a test checks and the logic it uses to determine whether resources pass or fail. It gives you and your auditors a shared understanding of a test’s purpose, logic, and data inputs—reducing confusion and helping verify that automated evidence matches audit expectations.
To view the Test Criteria section:
Open the Evidence tab for the relevant automated test.
Under the Test Criteria section, click Show more to review key information about the test.
At the top of the section, toggle the view to Logic to see the test scope and evaluation logic.
Test Evidence
Test Evidence
The Test Evidence section (sometimes referred to as the Evidence Table) shows a detailed view of every resource evaluated by the test, its status, and the underlying data used to determine that status. This view increases transparency, helps you quickly identify and remediate issues, and provides auditors with reliable, itemized proof of your test results to help you demonstrate audit-readiness.
To view the Test Evidence section:
Open the Evidence tab for the relevant automated test.
Scroll to the Test Evidence section to review the evidence table.
Click a row in the table to open the side panel and review detailed information about the selected resource.
Review the table to see the status for each resource:
Ok: The resource meets the evaluation criteria for the test.
Not Ready: The resource doesn’t meet the evaluation criteria for the test.
N/A: The resource was evaluated but doesn’t affect the overall test status.
Each test has its own evaluation criteria. Not all tests require every in-scope resource to pass for the overall test to be marked as passing. If a result seems unexpected, check the Out-of-Scope section to confirm whether specific resources were excluded for the framework you’re viewing.
Out of Scope
Out of Scope
The Out of Scope section lists any resources that were removed from the frameworks relevant to the test. It improves transparency by showing exactly which resources were not evaluated and why—helping explain unexpected pass or fail outcomes and allowing auditors to confirm that the test scope is complete.
To view the Out of Scope section:
Open the Evidence tab for the relevant automated test.
Scroll to the Out of Scope section to review which resources were removed per framework.
API Requests
API Requests
The API Requests section shows when and how Vanta retrieved data from an integrated service. It provides visibility into the specific API calls made during the test run, helping you troubleshoot issues or confirm that data was fetched successfully.
To view the API Requests section:
Open the Evidence tab for the relevant automated test.
Scroll to the API Requests section to see a list of all API calls made, including the date, resource type, method, URL, and response status.
Click any request to view detailed information, including request headers and the response data.
When investigating a failed or unexpected test result, use this section to compare the request and response details within the Test Criteria or Test Data sections. This transparency helps confirm what data was retrieved and ensures confidence in how Vanta evaluates your connected resources.
Exports
Exports
The Exports section lets you download an immutable copy of the latest automated test run, complete with full metadata. Each export contains the most recent automated test run and is locked to preserve audit integrity. This export serves as audit-ready proof that meets auditor requirements and reduces the need for manual evidence compilation.
To export test evidence:
Open the Evidence tab for the relevant automated test.
Scroll to the Exports section.
Choose the Workpaper option to download an immutable export designed to meet auditor standards.
If you have the Source Data tab instead of the Evidence tab, exports are available under Full test results. Once migrated to the new Evidence tab, you’ll also be able to download the workpaper export.
We’re upgrading tests, so the sections you see in the Evidence tab may vary. Some tests don’t include Test Criteria or Test Evidence yet, but these sections will be added to more tests over time. In the meantime, you might see a Test Data section instead, which lists the input data used in the test and lets you click any row to view the JSON details for each input.
Source Data Tab
The Evidence tab was previously called Source Data. We’re gradually rolling out this updated experience to all customers. If your organization is currently in an active audit, you’ll still see the older Source Data view for now.
Accounts using the older view won’t yet have access to:
The Test Criteria or Test Evidence sections—you’ll see a Test Data section instead.
The Out of Scope section—you can view what resources are in scope or removed by going to Compliance > Frameworks using the navigation menu in your account, selecting the relevant framework, and clicking the Scope tab.
The new workpaper export—you’ll still be able to export test runs.
In the auditor view, Test Source Data is being updated to Test Evidence for consistent naming.
Auditor View
When you share automated tests with auditors, they’ll see the Test Evidence view (formerly Test Source Data), which has the same structure and sections as your Evidence tab.
This allows auditors to independently verify the completeness and accuracy of test results. However, some information—such as detailed API request and response data—remains visible only to you for security and privacy reasons. Read more about Auditor Visibility into Test Data.