NebulaProof Documentation

Browser Extension

The NebulaProof browser extension is the primary evidence capture tool. It captures screenshots with cryptographic signatures, URL metadata, and timestamps — all in one click.

What Gets Captured

Each evidence capture creates a court-ready proof bundle containing:

• Screenshot — Full-page or visible area capture
• URL & Domain — Verified source location
• Timestamp — ISO 8601 capture time with timezone
• Ed25519 Signature — Tamper-evident digital signature
• Content Hash — SHA-256 fingerprint of the evidence
• Chain Entry — Hash-linked to previous evidence (Merkle tree)

Evidence Collection Methods

How Proof Chains Work

Every piece of evidence is cryptographically linked into an immutable proof chain. Unlike traditional compliance tools that ask you to "trust us," NebulaProof provides mathematical proof that your evidence is authentic and untampered.

7-Stage Chain of Custody

NebulaProof tracks evidence through seven verified stages, each producing its own attestation:

Proof Types

Auditor Portal

Share evidence with external auditors through a secure, read-only verification portal. Auditors can independently verify proof chains without accessing your internal systems.

1. 1
   Create a Sharing Package

   Select evidence items and controls, then generate a shareable link or export bundle.
2. 2
   Invite Your Auditor

   Send the secure link to your auditor. They can view evidence without creating an account.
3. 3
   Auditor Verifies Independently

   Auditors verify cryptographic signatures, check timestamps, and validate proof chains using open-source tools.
4. 4
   Track Audit Progress

   See which evidence items your auditor has reviewed, with real-time status in your dashboard.

Framework Mapping

Map evidence to specific framework controls. NebulaProof auto-suggests mappings and tracks coverage gaps.

Evidence Sharing Options

Organization Setup

Create your organization, invite team members, and assign roles. Each organization gets its own isolated workspace with separate evidence, controls, and audit history.

Roles & Permissions

How does NebulaProof differ from traditional GRC tools?

Traditional GRC tools rely on manual uploads and self-reported compliance. NebulaProof captures evidence with cryptographic signatures at the moment of observation, creating proof chains that auditors can independently verify. Evidence is mathematically tamper-evident, not just 'trusted.'

Can auditors verify proofs without our help?

Yes. Download the proof bundle from the dashboard and share with auditors. They can independently verify Ed25519 signatures, validate Merkle tree roots, and check hash chains using open-source cryptographic tools. No NebulaProof account needed.

What makes captured evidence court-ready?

Each evidence item includes a cryptographic signature (Ed25519), content hash (SHA-256), verified timestamp, URL and domain metadata, and a position in an immutable hash chain. This creates a verifiable chain of custody from capture to presentation.

How do I map evidence to multiple frameworks?

A single evidence item can be mapped to controls in multiple frameworks simultaneously. For example, one screenshot proving encryption-at-rest can satisfy SOC 2 CC6.1, HIPAA 164.312(a)(2)(iv), and ISO 27001 A.10.1.1.

What happens if evidence becomes stale?

NebulaProof tracks evidence freshness. When evidence ages past its framework-specific threshold (e.g., 90 days for SOC 2 continuous controls), it's flagged as stale in the coverage dashboard with a prompt to recapture.

How do I rotate my API key?

Go to Dashboard > Settings > API Keys > Generate New Key. Update your applications with the new key, then revoke the old one. We recommend rotating every 90 days.

Does the browser extension work offline?

Yes. Evidence captures are queued locally and synced automatically when the connection is restored. Signatures are applied at capture time, so the timestamp reflects when the evidence was actually observed.

Can I use NebulaProof with custom or internal frameworks?

Yes. Create custom frameworks with your own controls, evidence requirements, and mapping rules. Custom frameworks support the same proof chain and auditor sharing features as built-in frameworks.