---
title: "Keep evidence where nobody can change it · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/controls-and-evidence/evidence-store
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep evidence where nobody can change it

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Controls and evidence](https://agentwranglers.se/playbook/compliance/controls-and-evidence)
- Rule: Store evidence in write-once storage, in folders by date, and keep it for the audit period plus at least one year.
- How: Use object storage with a compliance-mode retention lock. A SOC 2 Type II audit looks at a period of 3 to 12 months, and the next auditor may ask about the last one. Give the collection jobs write access only, and auditors read access only.
- Check: A test tries to delete and to overwrite an evidence file and both fail. The bucket's lock period is at least the audit period plus 365 days.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/controls-and-evidence/evidence-store`.

- Previous: [Collect evidence automatically](https://agentwranglers.se/playbook/compliance/controls-and-evidence/automated-evidence)
- Next: [Prove every production change was reviewed](https://agentwranglers.se/playbook/compliance/controls-and-evidence/change-evidence)
- [Controls and evidence](https://agentwranglers.se/playbook/compliance/controls-and-evidence)