diff --git a/apps/api/package.json b/apps/api/package.json
index 3f92db055..ada1af49e 100644
--- a/apps/api/package.json
+++ b/apps/api/package.json
@@ -1,134 +1,131 @@
 {
-  "name": "@comp/api",
-  "description": "",
-  "version": "0.0.1",
-  "author": "",
-  "dependencies": {
-    "@ai-sdk/anthropic": "^2.0.53",
-    "@ai-sdk/groq": "^2.0.32",
-    "@ai-sdk/openai": "^2.0.65",
-    "@aws-sdk/client-s3": "^3.859.0",
-    "@aws-sdk/client-securityhub": "^3.948.0",
-    "@aws-sdk/client-sts": "^3.948.0",
-    "@aws-sdk/s3-request-presigner": "^3.859.0",
-    "@browserbasehq/sdk": "^2.6.0",
-    "@browserbasehq/stagehand": "^3.0.5",
-    "@comp/integration-platform": "workspace:*",
-    "@mendable/firecrawl-js": "^4.9.3",
-    "@nestjs/common": "^11.0.1",
-    "@nestjs/config": "^4.0.2",
-    "@nestjs/core": "^11.0.1",
-    "@nestjs/platform-express": "^11.1.5",
-    "@nestjs/swagger": "^11.2.0",
-    "@nestjs/throttler": "^6.5.0",
-    "@prisma/client": "6.18.0",
-    "@prisma/instrumentation": "^6.13.0",
-    "@react-email/components": "^0.0.41",
-    "@trigger.dev/build": "4.0.6",
-    "@trigger.dev/sdk": "4.0.6",
-    "@trycompai/db": "1.3.22",
-    "@trycompai/email": "workspace:*",
-    "@upstash/redis": "^1.34.2",
-    "@upstash/vector": "^1.2.2",
-    "adm-zip": "^0.5.16",
-    "ai": "^5.0.60",
-    "archiver": "^7.0.1",
-    "axios": "^1.12.2",
-    "better-auth": "^1.3.27",
-    "class-transformer": "^0.5.1",
-    "class-validator": "^0.14.2",
-    "dotenv": "^17.2.3",
-    "esbuild": "^0.27.1",
-    "exceljs": "^4.4.0",
-    "express": "^4.21.2",
-    "helmet": "^8.1.0",
-    "jose": "^6.0.12",
-    "jspdf": "^3.0.3",
-    "mammoth": "^1.8.0",
-    "nanoid": "^5.1.6",
-    "pdf-lib": "^1.17.1",
-    "playwright-core": "^1.57.0",
-    "prisma": "6.18.0",
-    "react": "^19.1.1",
-    "react-dom": "^19.1.0",
-    "reflect-metadata": "^0.2.2",
-    "resend": "^6.4.2",
-    "rxjs": "^7.8.1",
-    "safe-stable-stringify": "^2.5.0",
-    "swagger-ui-express": "^5.0.1",
-    "xlsx": "^0.18.5",
-    "zod": "^4.0.14"
-  },
-  "devDependencies": {
-    "@eslint/eslintrc": "^3.2.0",
-    "@eslint/js": "^9.18.0",
-    "@nestjs/cli": "^11.0.0",
-    "@nestjs/schematics": "^11.0.0",
-    "@nestjs/testing": "^11.0.1",
-    "@types/adm-zip": "^0.5.7",
-    "@types/archiver": "^6.0.3",
-    "@types/express": "^5.0.0",
-    "@types/jest": "^30.0.0",
-    "@types/multer": "^1.4.12",
-    "@types/node": "^24.0.3",
-    "@types/supertest": "^6.0.2",
-    "@types/swagger-ui-express": "^4.1.8",
-    "eslint": "^9.18.0",
-    "eslint-config-prettier": "^10.0.1",
-    "eslint-plugin-prettier": "^5.2.2",
-    "globals": "^16.0.0",
-    "jest": "^30.0.0",
-    "prettier": "^3.5.3",
-    "source-map-support": "^0.5.21",
-    "supertest": "^7.0.0",
-    "ts-jest": "^29.2.5",
-    "ts-loader": "^9.5.2",
-    "ts-node": "^10.9.2",
-    "tsconfig-paths": "^4.2.0",
-    "typescript": "^5.8.3",
-    "typescript-eslint": "^8.20.0"
-  },
-  "jest": {
-    "moduleFileExtensions": [
-      "js",
-      "json",
-      "ts"
-    ],
-    "rootDir": "src",
-    "testRegex": ".*\\.spec\\.ts$",
-    "transform": {
-      "^.+\\.(t|j)s$": "ts-jest"
+    "name": "@comp/api",
+    "description": "",
+    "version": "0.0.1",
+    "author": "",
+    "dependencies": {
+        "@ai-sdk/anthropic": "^2.0.53",
+        "@ai-sdk/groq": "^2.0.32",
+        "@ai-sdk/openai": "^2.0.65",
+        "@aws-sdk/client-s3": "^3.859.0",
+        "@aws-sdk/client-securityhub": "^3.948.0",
+        "@aws-sdk/client-sts": "^3.948.0",
+        "@aws-sdk/s3-request-presigner": "^3.859.0",
+        "@browserbasehq/sdk": "^2.6.0",
+        "@browserbasehq/stagehand": "^3.0.5",
+        "@comp/company": "workspace:*",
+        "@comp/integration-platform": "workspace:*",
+        "@mendable/firecrawl-js": "^4.9.3",
+        "@nestjs/common": "^11.0.1",
+        "@nestjs/config": "^4.0.2",
+        "@nestjs/core": "^11.0.1",
+        "@nestjs/platform-express": "^11.1.5",
+        "@nestjs/swagger": "^11.2.0",
+        "@nestjs/throttler": "^6.5.0",
+        "@prisma/client": "6.18.0",
+        "@prisma/instrumentation": "^6.13.0",
+        "@react-email/components": "^0.0.41",
+        "@trigger.dev/build": "4.0.6",
+        "@trigger.dev/sdk": "4.0.6",
+        "@trycompai/db": "1.3.22",
+        "@trycompai/email": "workspace:*",
+        "@upstash/redis": "^1.34.2",
+        "@upstash/vector": "^1.2.2",
+        "adm-zip": "^0.5.16",
+        "ai": "^5.0.60",
+        "archiver": "^7.0.1",
+        "axios": "^1.12.2",
+        "better-auth": "^1.3.27",
+        "class-transformer": "^0.5.1",
+        "class-validator": "^0.14.2",
+        "dotenv": "^17.2.3",
+        "esbuild": "^0.27.1",
+        "exceljs": "^4.4.0",
+        "express": "^4.21.2",
+        "helmet": "^8.1.0",
+        "jose": "^6.0.12",
+        "jspdf": "^3.0.3",
+        "mammoth": "^1.8.0",
+        "nanoid": "^5.1.6",
+        "pdf-lib": "^1.17.1",
+        "playwright-core": "^1.57.0",
+        "prisma": "6.18.0",
+        "react": "^19.1.1",
+        "react-dom": "^19.1.0",
+        "reflect-metadata": "^0.2.2",
+        "resend": "^6.4.2",
+        "rxjs": "^7.8.1",
+        "safe-stable-stringify": "^2.5.0",
+        "swagger-ui-express": "^5.0.1",
+        "xlsx": "^0.18.5",
+        "zod": "^4.0.14"
     },
-    "collectCoverageFrom": [
-      "**/*.(t|j)s"
-    ],
-    "coverageDirectory": "../coverage",
-    "testEnvironment": "node"
-  },
-  "license": "UNLICENSED",
-  "private": true,
-  "scripts": {
-    "build": "nest build",
-    "build:docker": "bunx prisma generate && nest build",
-    "db:generate": "bun run db:getschema && bunx prisma generate",
-    "db:getschema": "node ../../packages/db/scripts/combine-schemas.js && cp ../../packages/db/dist/schema.prisma prisma/schema.prisma",
-    "db:migrate": "cd ../../packages/db && bunx prisma migrate dev && cd ../../apps/api",
-    "deploy:trigger-prod": "npx trigger.dev@4.0.6 deploy",
-    "dev": "bunx concurrently --kill-others --names \"nest,trigger\" --prefix-colors \"green,blue\" \"nest start --watch\" \"bunx trigger.dev@4.0.6 dev\"",
-    "dev:nest": "nest start --watch",
-    "dev:trigger": "bunx trigger.dev@4.0.6 dev",
-    "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
-    "lint": "eslint \"{src,apps,libs,test}/**/*.ts\" --fix",
-    "prebuild": "bun run db:generate",
-    "start": "nest start",
-    "start:debug": "nest start --debug --watch",
-    "start:dev": "nest start --watch",
-    "start:prod": "node dist/main",
-    "test": "jest",
-    "test:cov": "jest --coverage",
-    "test:debug": "node --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand",
-    "test:e2e": "jest --config ./test/jest-e2e.json",
-    "test:watch": "jest --watch",
-    "typecheck": "tsc --noEmit"
-  }
+    "devDependencies": {
+        "@eslint/eslintrc": "^3.2.0",
+        "@eslint/js": "^9.18.0",
+        "@nestjs/cli": "^11.0.0",
+        "@nestjs/schematics": "^11.0.0",
+        "@nestjs/testing": "^11.0.1",
+        "@types/adm-zip": "^0.5.7",
+        "@types/archiver": "^6.0.3",
+        "@types/express": "^5.0.0",
+        "@types/jest": "^30.0.0",
+        "@types/multer": "^1.4.12",
+        "@types/node": "^24.0.3",
+        "@types/supertest": "^6.0.2",
+        "@types/swagger-ui-express": "^4.1.8",
+        "eslint": "^9.18.0",
+        "eslint-config-prettier": "^10.0.1",
+        "eslint-plugin-prettier": "^5.2.2",
+        "globals": "^16.0.0",
+        "jest": "^30.0.0",
+        "prettier": "^3.5.3",
+        "source-map-support": "^0.5.21",
+        "supertest": "^7.0.0",
+        "ts-jest": "^29.2.5",
+        "ts-loader": "^9.5.2",
+        "ts-node": "^10.9.2",
+        "tsconfig-paths": "^4.2.0",
+        "typescript": "^5.8.3",
+        "typescript-eslint": "^8.20.0"
+    },
+    "jest": {
+        "moduleFileExtensions": [
+            "js", "json", "ts"
+        ],
+        "rootDir": "src",
+        "testRegex": ".*\\.spec\\.ts$",
+        "transform": {
+            "^.+\\.(t|j)s$": "ts-jest"
+        },
+        "collectCoverageFrom": ["**/*.(t|j)s"],
+        "coverageDirectory": "../coverage",
+        "testEnvironment": "node"
+    },
+    "license": "UNLICENSED",
+    "private": true,
+    "scripts": {
+        "build": "nest build",
+        "build:docker": "bunx prisma generate && nest build",
+        "db:generate": "bun run db:getschema && bunx prisma generate",
+        "db:getschema": "node ../../packages/db/scripts/combine-schemas.js && cp ../../packages/db/dist/schema.prisma prisma/schema.prisma",
+        "db:migrate": "cd ../../packages/db && bunx prisma migrate dev && cd ../../apps/api",
+        "deploy:trigger-prod": "npx trigger.dev@4.0.6 deploy",
+        "dev": "bunx concurrently --kill-others --names \"nest,trigger\" --prefix-colors \"green,blue\" \"nest start --watch\" \"bunx trigger.dev@4.0.6 dev\"",
+        "dev:nest": "nest start --watch",
+        "dev:trigger": "bunx trigger.dev@4.0.6 dev",
+        "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
+        "lint": "eslint \"{src,apps,libs,test}/**/*.ts\" --fix",
+        "prebuild": "bun run db:generate",
+        "start": "nest start",
+        "start:debug": "nest start --debug --watch",
+        "start:dev": "nest start --watch",
+        "start:prod": "node dist/main",
+        "test": "jest",
+        "test:cov": "jest --coverage",
+        "test:debug": "node --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand",
+        "test:e2e": "jest --config ./test/jest-e2e.json",
+        "test:watch": "jest --watch",
+        "typecheck": "tsc --noEmit"
+    }
 }
diff --git a/apps/api/src/app.module.ts b/apps/api/src/app.module.ts
index 2645cb341..012a3c550 100644
--- a/apps/api/src/app.module.ts
+++ b/apps/api/src/app.module.ts
@@ -35,6 +35,7 @@ import { TaskManagementModule } from './task-management/task-management.module';
 import { AssistantChatModule } from './assistant-chat/assistant-chat.module';
 import { OrgChartModule } from './org-chart/org-chart.module';
 import { TrainingModule } from './training/training.module';
+import { EvidenceFormsModule } from './evidence-forms/evidence-forms.module';
 
 @Module({
   imports: [
@@ -82,6 +83,7 @@ import { TrainingModule } from './training/training.module';
     AssistantChatModule,
     TrainingModule,
     OrgChartModule,
+    EvidenceFormsModule,
   ],
   controllers: [AppController],
   providers: [
diff --git a/apps/api/src/evidence-forms/evidence-forms.controller.ts b/apps/api/src/evidence-forms/evidence-forms.controller.ts
new file mode 100644
index 000000000..c478dfb58
--- /dev/null
+++ b/apps/api/src/evidence-forms/evidence-forms.controller.ts
@@ -0,0 +1,212 @@
+import { AuthContext, OrganizationId } from '@/auth/auth-context.decorator';
+import { HybridAuthGuard } from '@/auth/hybrid-auth.guard';
+import type { AuthContext as AuthContextType } from '@/auth/types';
+import {
+  Body,
+  Controller,
+  Get,
+  Header,
+  Param,
+  Patch,
+  Post,
+  Query,
+  Res,
+  UseGuards,
+} from '@nestjs/common';
+import { ApiHeader, ApiOperation, ApiSecurity, ApiTags } from '@nestjs/swagger';
+import type { Response } from 'express';
+import { EvidenceFormsService } from './evidence-forms.service';
+
+@ApiTags('Evidence Forms')
+@Controller({ path: 'evidence-forms', version: '1' })
+@UseGuards(HybridAuthGuard)
+@ApiSecurity('apikey')
+@ApiHeader({
+  name: 'X-Organization-Id',
+  description:
+    'Organization ID (required for session auth, optional for API key auth)',
+  required: false,
+})
+export class EvidenceFormsController {
+  constructor(private readonly evidenceFormsService: EvidenceFormsService) {}
+
+  @Get()
+  @ApiOperation({
+    summary: 'List evidence forms',
+    description: 'List all available pre-built evidence forms',
+  })
+  listForms() {
+    return this.evidenceFormsService.listForms();
+  }
+
+  @Get('statuses')
+  @ApiOperation({
+    summary: 'Get submission statuses for all forms',
+    description:
+      'Returns the latest submission date per form type for the active organization',
+  })
+  async getFormStatuses(@OrganizationId() organizationId: string) {
+    return this.evidenceFormsService.getFormStatuses(organizationId);
+  }
+
+  @Get('my-submissions')
+  @ApiOperation({
+    summary: 'Get current user submissions',
+    description:
+      'Returns all evidence form submissions by the authenticated user for the active organization',
+  })
+  async getMySubmissions(
+    @OrganizationId() organizationId: string,
+    @AuthContext() authContext: AuthContextType,
+    @Query('formType') formType?: string,
+  ) {
+    return this.evidenceFormsService.getMySubmissions({
+      organizationId,
+      authContext,
+      formType,
+    });
+  }
+
+  @Get('my-submissions/pending-count')
+  @ApiOperation({
+    summary: 'Get pending submission count for current user',
+    description:
+      'Returns the count of pending evidence submissions for the authenticated user',
+  })
+  async getPendingSubmissionCount(
+    @OrganizationId() organizationId: string,
+    @AuthContext() authContext: AuthContextType,
+  ) {
+    return this.evidenceFormsService.getPendingSubmissionCount({
+      organizationId,
+      authContext,
+    });
+  }
+
+  @Get(':formType')
+  @ApiOperation({
+    summary: 'Get form definition and submissions',
+    description:
+      'Fetch a specific form definition with submissions for the active organization',
+  })
+  async getFormWithSubmissions(
+    @OrganizationId() organizationId: string,
+    @AuthContext() authContext: AuthContextType,
+    @Param('formType') formType: string,
+    @Query('search') search?: string,
+    @Query('limit') limit?: string,
+    @Query('offset') offset?: string,
+  ) {
+    return this.evidenceFormsService.getFormWithSubmissions({
+      organizationId,
+      authContext,
+      formType,
+      search,
+      limit,
+      offset,
+    });
+  }
+
+  @Get(':formType/submissions/:submissionId')
+  @ApiOperation({
+    summary: 'Get a single submission',
+    description:
+      'Fetch one evidence form submission for the active organization',
+  })
+  async getSubmission(
+    @OrganizationId() organizationId: string,
+    @AuthContext() authContext: AuthContextType,
+    @Param('formType') formType: string,
+    @Param('submissionId') submissionId: string,
+  ) {
+    return this.evidenceFormsService.getSubmission({
+      organizationId,
+      authContext,
+      formType,
+      submissionId,
+    });
+  }
+
+  @Post(':formType/submissions')
+  @ApiOperation({
+    summary: 'Submit evidence form entry',
+    description:
+      'Create a new organization-scoped evidence form submission using Zod-validated payloads',
+  })
+  async submitForm(
+    @OrganizationId() organizationId: string,
+    @AuthContext() authContext: AuthContextType,
+    @Param('formType') formType: string,
+    @Body() body: unknown,
+  ) {
+    return this.evidenceFormsService.submitForm({
+      organizationId,
+      formType,
+      payload: body,
+      authContext,
+    });
+  }
+
+  @Patch(':formType/submissions/:submissionId/review')
+  @ApiOperation({
+    summary: 'Review a submission',
+    description:
+      'Approve or reject an evidence form submission with an optional reason',
+  })
+  async reviewSubmission(
+    @OrganizationId() organizationId: string,
+    @AuthContext() authContext: AuthContextType,
+    @Param('formType') formType: string,
+    @Param('submissionId') submissionId: string,
+    @Body() body: unknown,
+  ) {
+    return this.evidenceFormsService.reviewSubmission({
+      organizationId,
+      formType,
+      submissionId,
+      payload: body,
+      authContext,
+    });
+  }
+
+  @Post('uploads')
+  @ApiOperation({
+    summary: 'Upload evidence form file',
+    description:
+      'Upload a file for evidence form fields and return file metadata for submission payload',
+  })
+  async uploadFile(
+    @OrganizationId() organizationId: string,
+    @AuthContext() authContext: AuthContextType,
+    @Body() body: unknown,
+  ) {
+    return this.evidenceFormsService.uploadFile({
+      organizationId,
+      authContext,
+      payload: body,
+    });
+  }
+
+  @Get(':formType/export.csv')
+  @ApiOperation({
+    summary: 'Export form submissions to CSV',
+    description: 'Export all form submissions for an organization as CSV',
+  })
+  @Header('Content-Type', 'text/csv')
+  async exportCsv(
+    @OrganizationId() organizationId: string,
+    @AuthContext() authContext: AuthContextType,
+    @Param('formType') formType: string,
+    @Res() res: Response,
+  ) {
+    const csv = await this.evidenceFormsService.exportCsv({
+      organizationId,
+      authContext,
+      formType,
+    });
+
+    const filename = `${formType}-submissions-${new Date().toISOString().slice(0, 10)}.csv`;
+    res.setHeader('Content-Disposition', `attachment; filename="${filename}"`);
+    res.send(csv);
+  }
+}
diff --git a/apps/api/src/evidence-forms/evidence-forms.definitions.ts b/apps/api/src/evidence-forms/evidence-forms.definitions.ts
new file mode 100644
index 000000000..2b94ea7b2
--- /dev/null
+++ b/apps/api/src/evidence-forms/evidence-forms.definitions.ts
@@ -0,0 +1,11 @@
+// Single source of truth: re-export from shared @comp/company package
+export {
+  evidenceFormTypeSchema,
+  evidenceFormFileSchema,
+  evidenceFormSubmissionSchemaMap,
+  evidenceFormDefinitions,
+  evidenceFormDefinitionList,
+  type EvidenceFormType,
+  type EvidenceFormFieldDefinition,
+  type EvidenceFormDefinition,
+} from '@comp/company';
diff --git a/apps/api/src/evidence-forms/evidence-forms.module.ts b/apps/api/src/evidence-forms/evidence-forms.module.ts
new file mode 100644
index 000000000..333ffaa5d
--- /dev/null
+++ b/apps/api/src/evidence-forms/evidence-forms.module.ts
@@ -0,0 +1,13 @@
+import { Module } from '@nestjs/common';
+import { AttachmentsModule } from '@/attachments/attachments.module';
+import { AuthModule } from '@/auth/auth.module';
+import { EvidenceFormsController } from './evidence-forms.controller';
+import { EvidenceFormsService } from './evidence-forms.service';
+
+@Module({
+  imports: [AuthModule, AttachmentsModule],
+  controllers: [EvidenceFormsController],
+  providers: [EvidenceFormsService],
+  exports: [EvidenceFormsService],
+})
+export class EvidenceFormsModule {}
diff --git a/apps/api/src/evidence-forms/evidence-forms.service.ts b/apps/api/src/evidence-forms/evidence-forms.service.ts
new file mode 100644
index 000000000..0e63d7467
--- /dev/null
+++ b/apps/api/src/evidence-forms/evidence-forms.service.ts
@@ -0,0 +1,619 @@
+import { AttachmentsService } from '@/attachments/attachments.service';
+import type { AuthContext } from '@/auth/types';
+import { db } from '@trycompai/db';
+import {
+  BadRequestException,
+  Injectable,
+  NotFoundException,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { z } from 'zod';
+import {
+  evidenceFormDefinitionList,
+  evidenceFormDefinitions,
+  evidenceFormSubmissionSchemaMap,
+  evidenceFormTypeSchema,
+  type EvidenceFormFieldDefinition,
+  type EvidenceFormType,
+} from './evidence-forms.definitions';
+
+const listQuerySchema = z.object({
+  search: z.string().trim().optional(),
+  limit: z.coerce.number().int().min(1).max(200).optional().default(50),
+  offset: z.coerce.number().int().min(0).optional().default(0),
+});
+
+const uploadSchema = z.object({
+  formType: evidenceFormTypeSchema,
+  fileName: z.string().min(1),
+  fileType: z.string().min(1),
+  fileData: z.string().min(1),
+});
+
+const reviewSchema = z.object({
+  action: z.enum(['approved', 'rejected']),
+  reason: z.string().trim().optional(),
+});
+
+const EVIDENCE_FORM_REVIEWER_ROLES = ['owner', 'admin', 'auditor'] as const;
+const MAX_UPLOAD_FILE_SIZE_BYTES = 100 * 1024 * 1024;
+const MAX_UPLOAD_BASE64_LENGTH = Math.ceil(MAX_UPLOAD_FILE_SIZE_BYTES / 3) * 4;
+
+function toCsvRow(values: string[]): string {
+  return values.map((value) => `"${value.replace(/"/g, '""')}"`).join(',');
+}
+
+function flattenValue(value: unknown): string {
+  if (value === null || value === undefined) {
+    return '';
+  }
+
+  if (typeof value === 'object') {
+    if (
+      'fileName' in value &&
+      typeof value.fileName === 'string' &&
+      'downloadUrl' in value &&
+      typeof value.downloadUrl === 'string'
+    ) {
+      return value.downloadUrl;
+    }
+    return JSON.stringify(value);
+  }
+
+  if (typeof value === 'string') {
+    return value;
+  }
+  if (
+    typeof value === 'number' ||
+    typeof value === 'boolean' ||
+    typeof value === 'bigint'
+  ) {
+    return value.toString();
+  }
+  if (typeof value === 'symbol') {
+    return value.description ?? '';
+  }
+
+  return '';
+}
+
+function flattenMatrixRows(
+  value: unknown,
+  field: EvidenceFormFieldDefinition,
+): string {
+  if (!Array.isArray(value)) {
+    return '';
+  }
+
+  const columns = Array.isArray(field.columns) ? field.columns : [];
+  if (columns.length === 0) {
+    return JSON.stringify(value);
+  }
+
+  return value
+    .filter((row) => row && typeof row === 'object')
+    .map((row) => {
+      const rowRecord = row as Record<string, unknown>;
+      return columns
+        .map((column) => {
+          const cellValue = rowRecord[column.key];
+          const normalizedValue =
+            typeof cellValue === 'string' ? cellValue : '';
+          return `${column.label}: ${normalizedValue}`;
+        })
+        .join(' | ');
+    })
+    .join(' || ');
+}
+
+@Injectable()
+export class EvidenceFormsService {
+  constructor(private readonly attachmentsService: AttachmentsService) {}
+
+  private requireJwtUser(authContext: AuthContext): string {
+    if (authContext.isApiKey || authContext.authType === 'api-key') {
+      throw new UnauthorizedException(
+        'This endpoint requires JWT authentication and does not support API key authentication',
+      );
+    }
+
+    if (!authContext.userId) {
+      throw new UnauthorizedException('Authenticated user session is required');
+    }
+
+    return authContext.userId;
+  }
+
+  private requirePrivilegedEvidenceAccess(authContext: AuthContext): string {
+    const userId = this.requireJwtUser(authContext);
+    const roles = authContext.userRoles ?? [];
+    const hasRequiredRole = EVIDENCE_FORM_REVIEWER_ROLES.some((role) =>
+      roles.includes(role),
+    );
+
+    if (!hasRequiredRole) {
+      throw new UnauthorizedException(
+        `Access denied. Required one of roles: ${EVIDENCE_FORM_REVIEWER_ROLES.join(', ')}`,
+      );
+    }
+
+    return userId;
+  }
+
+  private decodeBase64File(fileData: string): Buffer {
+    const normalized = fileData.trim();
+    if (normalized.length === 0 || normalized.length % 4 !== 0) {
+      throw new BadRequestException(
+        'Invalid file data. Expected base64 string.',
+      );
+    }
+
+    const base64Pattern = /^[A-Za-z0-9+/]+={0,2}$/;
+    if (!base64Pattern.test(normalized)) {
+      throw new BadRequestException(
+        'Invalid file data. Expected base64 string.',
+      );
+    }
+
+    const fileBuffer = Buffer.from(normalized, 'base64');
+    if (!fileBuffer.length) {
+      throw new BadRequestException('File cannot be empty');
+    }
+
+    return fileBuffer;
+  }
+
+  listForms() {
+    return evidenceFormDefinitionList;
+  }
+
+  async getFormStatuses(organizationId: string) {
+    const results = await db.evidenceSubmission.groupBy({
+      by: ['formType'],
+      where: { organizationId },
+      _max: { submittedAt: true },
+    });
+
+    const statuses: Record<string, { lastSubmittedAt: string | null }> = {};
+
+    for (const form of evidenceFormDefinitionList) {
+      const match = results.find((r) => r.formType === form.type);
+      statuses[form.type] = {
+        lastSubmittedAt: match?._max.submittedAt?.toISOString() ?? null,
+      };
+    }
+
+    return statuses;
+  }
+
+  async getFormWithSubmissions(params: {
+    organizationId: string;
+    authContext: AuthContext;
+    formType: string;
+    search?: string;
+    limit?: string;
+    offset?: string;
+  }) {
+    const { organizationId, formType } = params;
+    this.requirePrivilegedEvidenceAccess(params.authContext);
+
+    const parsedType = evidenceFormTypeSchema.safeParse(formType);
+    if (!parsedType.success) {
+      throw new BadRequestException('Unsupported form type');
+    }
+
+    const parsedQuery = listQuerySchema.safeParse({
+      search: params.search,
+      limit: params.limit,
+      offset: params.offset,
+    });
+    if (!parsedQuery.success) {
+      throw new BadRequestException(parsedQuery.error.flatten());
+    }
+    const query = parsedQuery.data;
+
+    const submissions = await db.evidenceSubmission.findMany({
+      where: {
+        organizationId,
+        formType: parsedType.data,
+      },
+      include: {
+        submittedBy: {
+          select: {
+            id: true,
+            name: true,
+            email: true,
+          },
+        },
+      },
+      orderBy: {
+        submittedAt: 'desc',
+      },
+    });
+
+    const filtered = query.search
+      ? submissions.filter((submission) => {
+          const searchTarget = JSON.stringify(submission.data).toLowerCase();
+          return searchTarget.includes(query.search!.toLowerCase());
+        })
+      : submissions;
+
+    const paginated = filtered.slice(query.offset, query.offset + query.limit);
+
+    return {
+      form: evidenceFormDefinitions[parsedType.data],
+      submissions: paginated,
+      total: filtered.length,
+    };
+  }
+
+  async getSubmission(params: {
+    organizationId: string;
+    authContext: AuthContext;
+    formType: string;
+    submissionId: string;
+  }) {
+    this.requirePrivilegedEvidenceAccess(params.authContext);
+
+    const parsedType = evidenceFormTypeSchema.safeParse(params.formType);
+    if (!parsedType.success) {
+      throw new BadRequestException('Unsupported form type');
+    }
+
+    const submission = await db.evidenceSubmission.findFirst({
+      where: {
+        id: params.submissionId,
+        organizationId: params.organizationId,
+        formType: parsedType.data,
+      },
+      include: {
+        submittedBy: {
+          select: {
+            id: true,
+            name: true,
+            email: true,
+          },
+        },
+        reviewedBy: {
+          select: {
+            id: true,
+            name: true,
+            email: true,
+          },
+        },
+      },
+    });
+
+    if (!submission) {
+      throw new NotFoundException('Submission not found');
+    }
+
+    return {
+      form: evidenceFormDefinitions[parsedType.data],
+      submission,
+    };
+  }
+
+  async submitForm(params: {
+    organizationId: string;
+    formType: string;
+    payload: unknown;
+    authContext: AuthContext;
+  }) {
+    const parsedType = evidenceFormTypeSchema.safeParse(params.formType);
+    if (!parsedType.success) {
+      throw new BadRequestException('Unsupported form type');
+    }
+
+    if (!params.authContext.userId) {
+      throw new BadRequestException(
+        'Authenticated user session is required to submit evidence forms',
+      );
+    }
+
+    const formDefinition = evidenceFormDefinitions[parsedType.data];
+    const nowIso = new Date().toISOString();
+
+    if (!params.payload || typeof params.payload !== 'object') {
+      throw new BadRequestException('Submission payload must be an object');
+    }
+
+    const payloadObject: Record<string, unknown> = {
+      ...(params.payload as Record<string, unknown>),
+    };
+
+    if (formDefinition.submissionDateMode === 'auto') {
+      payloadObject.submissionDate = nowIso;
+    }
+
+    const schema = evidenceFormSubmissionSchemaMap[parsedType.data];
+    const parsedPayload = schema.safeParse(payloadObject);
+    if (!parsedPayload.success) {
+      throw new BadRequestException(parsedPayload.error.flatten());
+    }
+
+    return await db.evidenceSubmission.create({
+      data: {
+        organizationId: params.organizationId,
+        formType: parsedType.data,
+        submittedById: params.authContext.userId,
+        data: parsedPayload.data,
+      },
+      include: {
+        submittedBy: {
+          select: {
+            id: true,
+            name: true,
+            email: true,
+          },
+        },
+      },
+    });
+  }
+
+  async uploadFile(params: {
+    organizationId: string;
+    authContext: AuthContext;
+    payload: unknown;
+  }) {
+    if (!params.authContext.userId) {
+      throw new BadRequestException(
+        'Authenticated user session is required to upload evidence files',
+      );
+    }
+
+    const parsed = uploadSchema.safeParse(params.payload);
+    if (!parsed.success) {
+      throw new BadRequestException(parsed.error.flatten());
+    }
+
+    if (parsed.data.fileData.length > MAX_UPLOAD_BASE64_LENGTH) {
+      throw new BadRequestException(
+        `File exceeds the ${MAX_UPLOAD_FILE_SIZE_BYTES / (1024 * 1024)}MB limit`,
+      );
+    }
+
+    const fileBuffer = this.decodeBase64File(parsed.data.fileData);
+    if (fileBuffer.length > MAX_UPLOAD_FILE_SIZE_BYTES) {
+      throw new BadRequestException(
+        `File exceeds the ${MAX_UPLOAD_FILE_SIZE_BYTES / (1024 * 1024)}MB limit`,
+      );
+    }
+
+    const fileKey = await this.attachmentsService.uploadToS3(
+      fileBuffer,
+      parsed.data.fileName,
+      parsed.data.fileType,
+      params.organizationId,
+      'evidence-forms',
+      parsed.data.formType,
+    );
+
+    const downloadUrl =
+      await this.attachmentsService.getPresignedDownloadUrl(fileKey);
+
+    return {
+      fileName: parsed.data.fileName,
+      fileKey,
+      downloadUrl,
+    };
+  }
+
+  async exportCsv(params: {
+    organizationId: string;
+    formType: string;
+    authContext: AuthContext;
+  }) {
+    this.requirePrivilegedEvidenceAccess(params.authContext);
+
+    const parsedType = evidenceFormTypeSchema.safeParse(params.formType);
+    if (!parsedType.success) {
+      throw new BadRequestException('Unsupported form type');
+    }
+
+    const formType: EvidenceFormType = parsedType.data;
+    const form = evidenceFormDefinitions[formType];
+
+    const submissions = await db.evidenceSubmission.findMany({
+      where: {
+        organizationId: params.organizationId,
+        formType,
+      },
+      include: {
+        submittedBy: {
+          select: {
+            name: true,
+            email: true,
+          },
+        },
+      },
+      orderBy: {
+        submittedAt: 'desc',
+      },
+    });
+
+    if (submissions.length === 0) {
+      throw new BadRequestException(
+        'No submissions available for export for this form',
+      );
+    }
+
+    const headers = [
+      'submissionId',
+      'submissionDate',
+      'submittedByName',
+      'submittedByEmail',
+      ...form.fields
+        .filter((field) => field.key !== 'submissionDate')
+        .map((field) => field.key),
+    ];
+
+    const rows = await Promise.all(
+      submissions.map(async (submission) => {
+        const data = submission.data as Record<string, unknown>;
+        const fieldValues = await Promise.all(
+          form.fields
+            .filter((field) => field.key !== 'submissionDate')
+            .map(async (field) => {
+              const rawValue = data[field.key];
+              if (
+                rawValue &&
+                typeof rawValue === 'object' &&
+                'fileKey' in rawValue &&
+                typeof rawValue.fileKey === 'string'
+              ) {
+                const signedUrl =
+                  await this.attachmentsService.getPresignedDownloadUrl(
+                    rawValue.fileKey,
+                  );
+                return signedUrl;
+              }
+              if (field.type === 'matrix') {
+                return flattenMatrixRows(rawValue, field);
+              }
+              return flattenValue(rawValue);
+            }),
+        );
+
+        return [
+          submission.id,
+          typeof data.submissionDate === 'string'
+            ? data.submissionDate
+            : submission.submittedAt.toISOString(),
+          submission.submittedBy?.name ?? '',
+          submission.submittedBy?.email ?? '',
+          ...fieldValues,
+        ];
+      }),
+    );
+
+    const csvLines = [toCsvRow(headers), ...rows.map((row) => toCsvRow(row))];
+    return csvLines.join('\n');
+  }
+
+  async reviewSubmission(params: {
+    organizationId: string;
+    formType: string;
+    submissionId: string;
+    payload: unknown;
+    authContext: AuthContext;
+  }) {
+    const parsedType = evidenceFormTypeSchema.safeParse(params.formType);
+    if (!parsedType.success) {
+      throw new BadRequestException('Unsupported form type');
+    }
+
+    const reviewerUserId = this.requirePrivilegedEvidenceAccess(
+      params.authContext,
+    );
+
+    const parsed = reviewSchema.safeParse(params.payload);
+    if (!parsed.success) {
+      throw new BadRequestException(parsed.error.flatten());
+    }
+
+    if (parsed.data.action === 'rejected' && !parsed.data.reason) {
+      throw new BadRequestException(
+        'A reason is required when rejecting a submission',
+      );
+    }
+
+    const submission = await db.evidenceSubmission.findFirst({
+      where: {
+        id: params.submissionId,
+        organizationId: params.organizationId,
+        formType: parsedType.data,
+      },
+    });
+
+    if (!submission) {
+      throw new NotFoundException('Submission not found');
+    }
+
+    if (submission.status !== 'pending') {
+      throw new BadRequestException(
+        'Submission must be pending to be reviewed',
+      );
+    }
+
+    return await db.evidenceSubmission.update({
+      where: { id: params.submissionId },
+      data: {
+        status: parsed.data.action,
+        reviewedById: reviewerUserId,
+        reviewedAt: new Date(),
+        reviewReason: parsed.data.reason ?? null,
+      },
+      include: {
+        submittedBy: {
+          select: {
+            id: true,
+            name: true,
+            email: true,
+          },
+        },
+        reviewedBy: {
+          select: {
+            id: true,
+            name: true,
+            email: true,
+          },
+        },
+      },
+    });
+  }
+
+  async getMySubmissions(params: {
+    organizationId: string;
+    authContext: AuthContext;
+    formType?: string;
+  }) {
+    const userId = this.requireJwtUser(params.authContext);
+
+    const where: Record<string, unknown> = {
+      organizationId: params.organizationId,
+      submittedById: userId,
+    };
+
+    if (params.formType) {
+      const parsedType = evidenceFormTypeSchema.safeParse(params.formType);
+      if (!parsedType.success) {
+        throw new BadRequestException('Unsupported form type');
+      }
+      where.formType = parsedType.data;
+    }
+
+    return await db.evidenceSubmission.findMany({
+      where,
+      include: {
+        reviewedBy: {
+          select: {
+            id: true,
+            name: true,
+            email: true,
+          },
+        },
+      },
+      orderBy: {
+        submittedAt: 'desc',
+      },
+    });
+  }
+
+  async getPendingSubmissionCount(params: {
+    organizationId: string;
+    authContext: AuthContext;
+  }) {
+    const userId = this.requireJwtUser(params.authContext);
+
+    const count = await db.evidenceSubmission.count({
+      where: {
+        organizationId: params.organizationId,
+        submittedById: userId,
+        status: 'pending',
+      },
+    });
+
+    return { count };
+  }
+}
diff --git a/apps/api/src/findings/dto/create-finding.dto.ts b/apps/api/src/findings/dto/create-finding.dto.ts
index ada5d1ee9..c759a68a8 100644
--- a/apps/api/src/findings/dto/create-finding.dto.ts
+++ b/apps/api/src/findings/dto/create-finding.dto.ts
@@ -12,10 +12,20 @@ export class CreateFindingDto {
   @ApiProperty({
     description: 'Task ID this finding is associated with',
     example: 'tsk_abc123',
+    required: false,
   })
   @IsString()
-  @IsNotEmpty()
-  taskId: string;
+  @IsOptional()
+  taskId?: string;
+
+  @ApiProperty({
+    description: 'Evidence submission ID this finding is associated with',
+    example: 'evs_abc123',
+    required: false,
+  })
+  @IsString()
+  @IsOptional()
+  evidenceSubmissionId?: string;
 
   @ApiProperty({
     description: 'Type of finding (SOC 2 or ISO 27001)',
diff --git a/apps/api/src/findings/finding-audit.service.ts b/apps/api/src/findings/finding-audit.service.ts
index d7698cead..19aa45966 100644
--- a/apps/api/src/findings/finding-audit.service.ts
+++ b/apps/api/src/findings/finding-audit.service.ts
@@ -17,8 +17,10 @@ export class FindingAuditService {
    */
   async logFindingCreated(
     params: FindingAuditParams & {
-      taskId: string;
-      taskTitle: string;
+      taskId?: string;
+      taskTitle?: string;
+      evidenceSubmissionId?: string;
+      evidenceSubmissionFormType?: string;
       content: string;
       type: FindingType;
     },
@@ -37,6 +39,8 @@ export class FindingAuditService {
             findingId: params.findingId,
             taskId: params.taskId,
             taskTitle: params.taskTitle,
+            evidenceSubmissionId: params.evidenceSubmissionId,
+            evidenceSubmissionFormType: params.evidenceSubmissionFormType,
             content: params.content,
             type: params.type,
             status: FindingStatus.open,
@@ -147,8 +151,10 @@ export class FindingAuditService {
    */
   async logFindingDeleted(
     params: FindingAuditParams & {
-      taskId: string;
-      taskTitle: string;
+      taskId?: string;
+      taskTitle?: string;
+      evidenceSubmissionId?: string;
+      evidenceSubmissionFormType?: string;
       content: string;
     },
   ): Promise<void> {
@@ -166,6 +172,8 @@ export class FindingAuditService {
             findingId: params.findingId,
             taskId: params.taskId,
             taskTitle: params.taskTitle,
+            evidenceSubmissionId: params.evidenceSubmissionId,
+            evidenceSubmissionFormType: params.evidenceSubmissionFormType,
             content: params.content,
           },
         },
diff --git a/apps/api/src/findings/finding-notifier.service.ts b/apps/api/src/findings/finding-notifier.service.ts
index d4ea71b8e..b22ca0175 100644
--- a/apps/api/src/findings/finding-notifier.service.ts
+++ b/apps/api/src/findings/finding-notifier.service.ts
@@ -32,8 +32,11 @@ interface Recipient {
 interface NotificationParams {
   organizationId: string;
   findingId: string;
-  taskId: string;
-  taskTitle: string;
+  taskId?: string;
+  taskTitle?: string;
+  evidenceSubmissionId?: string;
+  evidenceSubmissionFormType?: string;
+  evidenceSubmissionSubmittedById?: string | null;
   findingContent: string;
   findingType: FindingType;
   actorUserId: string;
@@ -84,6 +87,19 @@ function getAppUrl(): string {
   );
 }
 
+function getDocumentContextTitle(
+  formType?: string,
+  evidenceSubmissionId?: string,
+): string {
+  if (formType) {
+    return `Document submission (${formType})`;
+  }
+  if (evidenceSubmissionId) {
+    return `Document submission (${evidenceSubmissionId})`;
+  }
+  return 'Document submission';
+}
+
 // ============================================================================
 // Service
 // ============================================================================
@@ -107,29 +123,40 @@ export class FindingNotifierService {
       organizationId,
       taskId,
       taskTitle,
+      evidenceSubmissionId,
+      evidenceSubmissionFormType,
+      evidenceSubmissionSubmittedById,
       findingType,
       actorUserId,
       actorName,
     } = params;
 
-    const recipients = await this.getTaskAssigneeAndAdmins(
-      organizationId,
-      taskId,
-      actorUserId,
-    );
+    const recipients = taskId
+      ? await this.getTaskAssigneeAndAdmins(organizationId, taskId, actorUserId)
+      : await this.getSubmissionSubmitterAndAdmins(
+          organizationId,
+          evidenceSubmissionId,
+          evidenceSubmissionSubmittedById,
+          actorUserId,
+        );
 
     if (recipients.length === 0) {
       this.logger.log('No recipients for finding created notification');
       return;
     }
 
+    const contextTitle =
+      taskTitle ??
+      getDocumentContextTitle(evidenceSubmissionFormType, evidenceSubmissionId);
+    const contextLabel = taskId ? 'task' : 'document submission';
+
     await this.sendNotifications({
       ...params,
       action: 'created',
       recipients,
-      subject: `New finding on task: ${taskTitle}`,
+      subject: `New finding on ${contextLabel}: ${contextTitle}`,
       heading: 'New Finding Created',
-      message: `${actorName} created a new ${TYPE_LABELS[findingType]} finding on the task "${taskTitle}".`,
+      message: `${actorName} created a new ${TYPE_LABELS[findingType]} finding on the ${contextLabel} "${contextTitle}".`,
     });
   }
 
@@ -143,6 +170,8 @@ export class FindingNotifierService {
     const {
       findingId,
       taskTitle,
+      evidenceSubmissionId,
+      evidenceSubmissionFormType,
       actorUserId,
       actorName,
       findingCreatorMemberId,
@@ -168,13 +197,17 @@ export class FindingNotifierService {
       `[notifyReadyForReview] Finding ${findingId}: Sending to ${recipients.length} recipient(s): ${recipients.map((r) => r.email).join(', ')}`,
     );
 
+    const contextTitle =
+      taskTitle ??
+      getDocumentContextTitle(evidenceSubmissionFormType, evidenceSubmissionId);
+
     await this.sendNotifications({
       ...params,
       action: 'ready_for_review',
       recipients,
-      subject: `Finding ready for review: ${taskTitle}`,
+      subject: `Finding ready for review: ${contextTitle}`,
       heading: 'Finding Ready for Review',
-      message: `${actorName} marked a finding on "${taskTitle}" as ready for your review.`,
+      message: `${actorName} marked a finding on "${contextTitle}" as ready for your review.`,
       newStatus: FindingStatus.ready_for_review,
     });
   }
@@ -184,27 +217,42 @@ export class FindingNotifierService {
    * Recipients: Task assignee + Organization admins/owners
    */
   async notifyNeedsRevision(params: NotificationParams): Promise<void> {
-    const { organizationId, taskId, taskTitle, actorUserId, actorName } =
-      params;
-
-    const recipients = await this.getTaskAssigneeAndAdmins(
+    const {
       organizationId,
       taskId,
+      taskTitle,
+      evidenceSubmissionId,
+      evidenceSubmissionFormType,
+      evidenceSubmissionSubmittedById,
       actorUserId,
-    );
+      actorName,
+    } = params;
+
+    const recipients = taskId
+      ? await this.getTaskAssigneeAndAdmins(organizationId, taskId, actorUserId)
+      : await this.getSubmissionSubmitterAndAdmins(
+          organizationId,
+          evidenceSubmissionId,
+          evidenceSubmissionSubmittedById,
+          actorUserId,
+        );
 
     if (recipients.length === 0) {
       this.logger.log('No recipients for needs revision notification');
       return;
     }
 
+    const contextTitle =
+      taskTitle ??
+      getDocumentContextTitle(evidenceSubmissionFormType, evidenceSubmissionId);
+
     await this.sendNotifications({
       ...params,
       action: 'needs_revision',
       recipients,
-      subject: `Finding needs revision: ${taskTitle}`,
+      subject: `Finding needs revision: ${contextTitle}`,
       heading: 'Finding Needs Revision',
-      message: `${actorName} reviewed a finding on "${taskTitle}" and marked it as needing revision.`,
+      message: `${actorName} reviewed a finding on "${contextTitle}" and marked it as needing revision.`,
       newStatus: FindingStatus.needs_revision,
     });
   }
@@ -214,27 +262,42 @@ export class FindingNotifierService {
    * Recipients: Task assignee + Organization admins/owners
    */
   async notifyFindingClosed(params: NotificationParams): Promise<void> {
-    const { organizationId, taskId, taskTitle, actorUserId, actorName } =
-      params;
-
-    const recipients = await this.getTaskAssigneeAndAdmins(
+    const {
       organizationId,
       taskId,
+      taskTitle,
+      evidenceSubmissionId,
+      evidenceSubmissionFormType,
+      evidenceSubmissionSubmittedById,
       actorUserId,
-    );
+      actorName,
+    } = params;
+
+    const recipients = taskId
+      ? await this.getTaskAssigneeAndAdmins(organizationId, taskId, actorUserId)
+      : await this.getSubmissionSubmitterAndAdmins(
+          organizationId,
+          evidenceSubmissionId,
+          evidenceSubmissionSubmittedById,
+          actorUserId,
+        );
 
     if (recipients.length === 0) {
       this.logger.log('No recipients for finding closed notification');
       return;
     }
 
+    const contextTitle =
+      taskTitle ??
+      getDocumentContextTitle(evidenceSubmissionFormType, evidenceSubmissionId);
+
     await this.sendNotifications({
       ...params,
       action: 'closed',
       recipients,
-      subject: `Finding closed: ${taskTitle}`,
+      subject: `Finding closed: ${contextTitle}`,
       heading: 'Finding Closed',
-      message: `${actorName} closed a finding on "${taskTitle}". The issue has been resolved.`,
+      message: `${actorName} closed a finding on "${contextTitle}". The issue has been resolved.`,
       newStatus: FindingStatus.closed,
     });
   }
@@ -255,6 +318,8 @@ export class FindingNotifierService {
       findingId,
       taskId,
       taskTitle,
+      evidenceSubmissionId,
+      evidenceSubmissionFormType,
       findingContent,
       findingType,
       action,
@@ -272,7 +337,13 @@ export class FindingNotifierService {
     });
     const organizationName = organization?.name ?? 'your organization';
 
-    const findingUrl = `${getAppUrl()}/${organizationId}/tasks/${taskId}`;
+    const contextTitle =
+      taskTitle ??
+      getDocumentContextTitle(evidenceSubmissionFormType, evidenceSubmissionId);
+    const findingUrl =
+      evidenceSubmissionId && evidenceSubmissionFormType
+        ? `${getAppUrl()}/${organizationId}/documents/${evidenceSubmissionFormType}/submissions/${evidenceSubmissionId}`
+        : `${getAppUrl()}/${organizationId}/tasks/${taskId}`;
     const typeLabel = TYPE_LABELS[findingType];
     const statusLabel = newStatus ? STATUS_LABELS[newStatus] : undefined;
 
@@ -285,7 +356,7 @@ export class FindingNotifierService {
           organizationName,
           findingId,
           taskId,
-          taskTitle,
+          taskTitle: contextTitle,
           findingContent,
           findingType: typeLabel,
           action,
@@ -307,7 +378,7 @@ export class FindingNotifierService {
     organizationId: string;
     organizationName: string;
     findingId: string;
-    taskId: string;
+    taskId?: string;
     taskTitle: string;
     findingContent: string;
     findingType: string;
@@ -460,7 +531,7 @@ export class FindingNotifierService {
     organizationId: string;
     organizationName: string;
     findingId: string;
-    taskId: string;
+    taskId?: string;
     taskTitle: string;
     findingType: string;
     findingContent: string;
@@ -605,6 +676,103 @@ export class FindingNotifierService {
     }
   }
 
+  private async getSubmissionSubmitterAndAdmins(
+    organizationId: string,
+    evidenceSubmissionId: string | undefined,
+    submitterUserId: string | null | undefined,
+    excludeUserId: string,
+  ): Promise<Recipient[]> {
+    try {
+      const allMembers = await db.member.findMany({
+        where: {
+          organizationId,
+          deactivated: false,
+        },
+        select: {
+          role: true,
+          user: { select: { id: true, email: true, name: true } },
+        },
+      });
+
+      const adminMembers = allMembers.filter(
+        (member) =>
+          member.role.includes('admin') || member.role.includes('owner'),
+      );
+
+      const recipients: Recipient[] = [];
+      const addedUserIds = new Set<string>();
+
+      if (submitterUserId) {
+        const submitter = await db.user.findUnique({
+          where: { id: submitterUserId },
+          select: { id: true, email: true, name: true },
+        });
+
+        if (
+          submitter &&
+          submitter.id !== excludeUserId &&
+          submitter.email &&
+          !addedUserIds.has(submitter.id)
+        ) {
+          recipients.push({
+            userId: submitter.id,
+            email: submitter.email,
+            name: submitter.name || submitter.email,
+          });
+          addedUserIds.add(submitter.id);
+        }
+      } else if (evidenceSubmissionId) {
+        const submission = await db.evidenceSubmission.findUnique({
+          where: { id: evidenceSubmissionId },
+          select: {
+            submittedBy: {
+              select: { id: true, email: true, name: true },
+            },
+          },
+        });
+
+        const submitter = submission?.submittedBy;
+        if (
+          submitter &&
+          submitter.id !== excludeUserId &&
+          submitter.email &&
+          !addedUserIds.has(submitter.id)
+        ) {
+          recipients.push({
+            userId: submitter.id,
+            email: submitter.email,
+            name: submitter.name || submitter.email,
+          });
+          addedUserIds.add(submitter.id);
+        }
+      }
+
+      for (const member of adminMembers) {
+        const user = member.user;
+        if (
+          user.id !== excludeUserId &&
+          user.email &&
+          !addedUserIds.has(user.id)
+        ) {
+          recipients.push({
+            userId: user.id,
+            email: user.email,
+            name: user.name || user.email,
+          });
+          addedUserIds.add(user.id);
+        }
+      }
+
+      return recipients;
+    } catch (error) {
+      this.logger.error(
+        'Failed to get submission recipients:',
+        error instanceof Error ? error.message : 'Unknown error',
+      );
+      return [];
+    }
+  }
+
   /**
    * Get the finding creator as recipient (for Ready for Review notifications).
    * Excludes the actor (person who triggered the action).
diff --git a/apps/api/src/findings/findings.controller.ts b/apps/api/src/findings/findings.controller.ts
index a4006a2dd..937716f50 100644
--- a/apps/api/src/findings/findings.controller.ts
+++ b/apps/api/src/findings/findings.controller.ts
@@ -54,10 +54,16 @@ export class FindingsController {
   })
   @ApiQuery({
     name: 'taskId',
-    required: true,
+    required: false,
     description: 'Task ID to get findings for',
     example: 'tsk_abc123',
   })
+  @ApiQuery({
+    name: 'evidenceSubmissionId',
+    required: false,
+    description: 'Evidence submission ID to get findings for',
+    example: 'evs_abc123',
+  })
   @ApiResponse({
     status: 200,
     description: 'List of findings for the task',
@@ -72,14 +78,31 @@ export class FindingsController {
   })
   async getFindingsByTask(
     @Query('taskId') taskId: string,
+    @Query('evidenceSubmissionId') evidenceSubmissionId: string,
     @AuthContext() authContext: AuthContextType,
   ) {
-    if (!taskId) {
-      throw new BadRequestException('taskId query parameter is required');
+    if (!taskId && !evidenceSubmissionId) {
+      throw new BadRequestException(
+        'Either taskId or evidenceSubmissionId query parameter is required',
+      );
+    }
+
+    if (taskId && evidenceSubmissionId) {
+      throw new BadRequestException(
+        'Provide only one target: taskId or evidenceSubmissionId',
+      );
     }
-    return await this.findingsService.findByTaskId(
+
+    if (taskId) {
+      return await this.findingsService.findByTaskId(
+        authContext.organizationId,
+        taskId,
+      );
+    }
+
+    return await this.findingsService.findByEvidenceSubmissionId(
       authContext.organizationId,
-      taskId,
+      evidenceSubmissionId,
     );
   }
 
diff --git a/apps/api/src/findings/findings.service.ts b/apps/api/src/findings/findings.service.ts
index 57e6b8f26..8c6f11549 100644
--- a/apps/api/src/findings/findings.service.ts
+++ b/apps/api/src/findings/findings.service.ts
@@ -14,6 +14,41 @@ import { FindingNotifierService } from './finding-notifier.service';
 @Injectable()
 export class FindingsService {
   private readonly logger = new Logger(FindingsService.name);
+  private readonly findingInclude = {
+    createdBy: {
+      include: {
+        user: {
+          select: {
+            id: true,
+            name: true,
+            email: true,
+            image: true,
+          },
+        },
+      },
+    },
+    template: {
+      select: {
+        id: true,
+        category: true,
+        title: true,
+      },
+    },
+    task: {
+      select: {
+        id: true,
+        title: true,
+      },
+    },
+    evidenceSubmission: {
+      select: {
+        id: true,
+        formType: true,
+        submittedAt: true,
+        submittedById: true,
+      },
+    },
+  };
 
   constructor(
     private readonly findingAuditService: FindingAuditService,
@@ -37,33 +72,7 @@ export class FindingsService {
 
     const findings = await db.finding.findMany({
       where: { taskId, organizationId },
-      include: {
-        createdBy: {
-          include: {
-            user: {
-              select: {
-                id: true,
-                name: true,
-                email: true,
-                image: true,
-              },
-            },
-          },
-        },
-        template: {
-          select: {
-            id: true,
-            category: true,
-            title: true,
-          },
-        },
-        task: {
-          select: {
-            id: true,
-            title: true,
-          },
-        },
-      },
+      include: this.findingInclude,
       orderBy: [
         // Sort by status: open first, then ready_for_review, needs_revision, closed
         { status: 'asc' },
@@ -75,6 +84,35 @@ export class FindingsService {
     return findings;
   }
 
+  /**
+   * Get all findings for a specific evidence submission
+   */
+  async findByEvidenceSubmissionId(
+    organizationId: string,
+    evidenceSubmissionId: string,
+  ) {
+    const submission = await db.evidenceSubmission.findFirst({
+      where: { id: evidenceSubmissionId, organizationId },
+    });
+
+    if (!submission) {
+      throw new NotFoundException(
+        `Evidence submission with ID ${evidenceSubmissionId} not found in organization`,
+      );
+    }
+
+    const findings = await db.finding.findMany({
+      where: { evidenceSubmissionId, organizationId },
+      include: this.findingInclude,
+      orderBy: [{ status: 'asc' }, { createdAt: 'desc' }],
+    });
+
+    this.logger.log(
+      `Retrieved ${findings.length} findings for evidence submission ${evidenceSubmissionId}`,
+    );
+    return findings;
+  }
+
   /**
    * Get all findings for an organization
    */
@@ -84,33 +122,7 @@ export class FindingsService {
         organizationId,
         ...(status && { status }),
       },
-      include: {
-        createdBy: {
-          include: {
-            user: {
-              select: {
-                id: true,
-                name: true,
-                email: true,
-                image: true,
-              },
-            },
-          },
-        },
-        template: {
-          select: {
-            id: true,
-            category: true,
-            title: true,
-          },
-        },
-        task: {
-          select: {
-            id: true,
-            title: true,
-          },
-        },
-      },
+      include: this.findingInclude,
       orderBy: [{ status: 'asc' }, { createdAt: 'desc' }],
     });
 
@@ -126,33 +138,7 @@ export class FindingsService {
   async findById(organizationId: string, findingId: string) {
     const finding = await db.finding.findFirst({
       where: { id: findingId, organizationId },
-      include: {
-        createdBy: {
-          include: {
-            user: {
-              select: {
-                id: true,
-                name: true,
-                email: true,
-                image: true,
-              },
-            },
-          },
-        },
-        template: {
-          select: {
-            id: true,
-            category: true,
-            title: true,
-          },
-        },
-        task: {
-          select: {
-            id: true,
-            title: true,
-          },
-        },
-      },
+      include: this.findingInclude,
     });
 
     if (!finding) {
@@ -173,16 +159,64 @@ export class FindingsService {
     userId: string,
     createDto: CreateFindingDto,
   ) {
-    // Verify task belongs to organization
-    const task = await db.task.findFirst({
-      where: { id: createDto.taskId, organizationId },
-    });
-
-    if (!task) {
-      throw new NotFoundException(
-        `Task with ID ${createDto.taskId} not found in organization`,
+    const hasTaskTarget = Boolean(createDto.taskId);
+    const hasSubmissionTarget = Boolean(createDto.evidenceSubmissionId);
+    if (!hasTaskTarget && !hasSubmissionTarget) {
+      throw new BadRequestException(
+        'Either taskId or evidenceSubmissionId is required',
       );
     }
+    if (hasTaskTarget && hasSubmissionTarget) {
+      throw new BadRequestException(
+        'Provide only one target: taskId or evidenceSubmissionId',
+      );
+    }
+
+    let task:
+      | {
+          id: string;
+          title: string;
+        }
+      | null = null;
+    let evidenceSubmission:
+      | {
+          id: string;
+          formType: string;
+          submittedAt: Date;
+          submittedById: string | null;
+        }
+      | null = null;
+
+    if (createDto.taskId) {
+      task = await db.task.findFirst({
+        where: { id: createDto.taskId, organizationId },
+        select: { id: true, title: true },
+      });
+
+      if (!task) {
+        throw new NotFoundException(
+          `Task with ID ${createDto.taskId} not found in organization`,
+        );
+      }
+    }
+
+    if (createDto.evidenceSubmissionId) {
+      evidenceSubmission = await db.evidenceSubmission.findFirst({
+        where: { id: createDto.evidenceSubmissionId, organizationId },
+        select: {
+          id: true,
+          formType: true,
+          submittedAt: true,
+          submittedById: true,
+        },
+      });
+
+      if (!evidenceSubmission) {
+        throw new NotFoundException(
+          `Evidence submission with ID ${createDto.evidenceSubmissionId} not found in organization`,
+        );
+      }
+    }
 
     // Verify template exists if provided
     if (createDto.templateId) {
@@ -199,7 +233,8 @@ export class FindingsService {
 
     const finding = await db.finding.create({
       data: {
-        taskId: createDto.taskId,
+        taskId: createDto.taskId ?? null,
+        evidenceSubmissionId: createDto.evidenceSubmissionId ?? null,
         type: createDto.type,
         content: createDto.content,
         templateId: createDto.templateId,
@@ -207,33 +242,7 @@ export class FindingsService {
         organizationId,
         status: FindingStatus.open,
       },
-      include: {
-        createdBy: {
-          include: {
-            user: {
-              select: {
-                id: true,
-                name: true,
-                email: true,
-                image: true,
-              },
-            },
-          },
-        },
-        template: {
-          select: {
-            id: true,
-            category: true,
-            title: true,
-          },
-        },
-        task: {
-          select: {
-            id: true,
-            title: true,
-          },
-        },
-      },
+      include: this.findingInclude,
     });
 
     // Log to audit trail
@@ -242,8 +251,10 @@ export class FindingsService {
       organizationId,
       userId,
       memberId,
-      taskId: createDto.taskId,
-      taskTitle: task.title,
+      taskId: task?.id,
+      taskTitle: task?.title,
+      evidenceSubmissionId: evidenceSubmission?.id,
+      evidenceSubmissionFormType: evidenceSubmission?.formType,
       content: createDto.content,
       type: createDto.type ?? FindingType.soc2,
     });
@@ -256,17 +267,21 @@ export class FindingsService {
     void this.findingNotifierService.notifyFindingCreated({
       organizationId,
       findingId: finding.id,
-      taskId: createDto.taskId,
-      taskTitle: task.title,
+      taskId: task?.id,
+      taskTitle: task?.title,
+      evidenceSubmissionId: evidenceSubmission?.id,
+      evidenceSubmissionFormType: evidenceSubmission?.formType,
+      evidenceSubmissionSubmittedById: evidenceSubmission?.submittedById,
       findingContent: createDto.content,
       findingType: createDto.type ?? FindingType.soc2,
       actorUserId: userId,
       actorName,
     });
 
-    this.logger.log(
-      `Created finding ${finding.id} for task ${createDto.taskId}`,
-    );
+    const target = task
+      ? `task ${task.id}`
+      : `evidence submission ${evidenceSubmission?.id}`;
+    this.logger.log(`Created finding ${finding.id} for ${target}`);
     return finding;
   }
 
@@ -418,8 +433,12 @@ export class FindingsService {
       const notificationParams = {
         organizationId,
         findingId,
-        taskId: finding.taskId,
-        taskTitle: finding.task.title,
+        taskId: finding.task?.id,
+        taskTitle: finding.task?.title,
+        evidenceSubmissionId: finding.evidenceSubmission?.id,
+        evidenceSubmissionFormType: finding.evidenceSubmission?.formType,
+        evidenceSubmissionSubmittedById:
+          finding.evidenceSubmission?.submittedById,
         findingContent: updatedFinding.content,
         findingType: updatedFinding.type,
         actorUserId: userId,
@@ -496,17 +515,20 @@ export class FindingsService {
       organizationId,
       userId,
       memberId,
-      taskId: finding.taskId,
-      taskTitle: finding.task.title,
+      taskId: finding.task?.id,
+      taskTitle: finding.task?.title,
+      evidenceSubmissionId: finding.evidenceSubmission?.id,
+      evidenceSubmissionFormType: finding.evidenceSubmission?.formType,
       content: finding.content,
     });
 
-    this.logger.log(`Deleted finding ${findingId} from task ${finding.taskId}`);
+    this.logger.log(`Deleted finding ${findingId}`);
     return {
       message: 'Finding deleted successfully',
       deletedFinding: {
         id: finding.id,
         taskId: finding.taskId,
+        evidenceSubmissionId: finding.evidenceSubmissionId,
       },
     };
   }
diff --git a/apps/api/src/tasks/task-notifier.service.ts b/apps/api/src/tasks/task-notifier.service.ts
index 180b6733c..b8fae1b90 100644
--- a/apps/api/src/tasks/task-notifier.service.ts
+++ b/apps/api/src/tasks/task-notifier.service.ts
@@ -624,45 +624,49 @@ export class TaskNotifierService {
     } = params;
 
     try {
-      const [organization, changedByUser, oldAssigneeMember, newAssigneeMember] =
-        await Promise.all([
-          db.organization.findUnique({
-            where: { id: organizationId },
-            select: { name: true },
-          }),
-          db.user.findUnique({
-            where: { id: changedByUserId },
-            select: { name: true, email: true },
-          }),
-          oldAssigneeId
-            ? db.member.findUnique({
-                where: { id: oldAssigneeId },
-                select: {
-                  user: {
-                    select: {
-                      id: true,
-                      name: true,
-                      email: true,
-                    },
+      const [
+        organization,
+        changedByUser,
+        oldAssigneeMember,
+        newAssigneeMember,
+      ] = await Promise.all([
+        db.organization.findUnique({
+          where: { id: organizationId },
+          select: { name: true },
+        }),
+        db.user.findUnique({
+          where: { id: changedByUserId },
+          select: { name: true, email: true },
+        }),
+        oldAssigneeId
+          ? db.member.findUnique({
+              where: { id: oldAssigneeId },
+              select: {
+                user: {
+                  select: {
+                    id: true,
+                    name: true,
+                    email: true,
                   },
                 },
-              })
-            : Promise.resolve(null),
-          newAssigneeId
-            ? db.member.findUnique({
-                where: { id: newAssigneeId },
-                select: {
-                  user: {
-                    select: {
-                      id: true,
-                      name: true,
-                      email: true,
-                    },
+              },
+            })
+          : Promise.resolve(null),
+        newAssigneeId
+          ? db.member.findUnique({
+              where: { id: newAssigneeId },
+              select: {
+                user: {
+                  select: {
+                    id: true,
+                    name: true,
+                    email: true,
                   },
                 },
-              })
-            : Promise.resolve(null),
-        ]);
+              },
+            })
+          : Promise.resolve(null),
+      ]);
 
       const organizationName = organization?.name ?? 'your organization';
       const changedByName =
@@ -792,31 +796,39 @@ export class TaskNotifierService {
     submittedByUserId: string;
     approverMemberId: string;
   }): Promise<void> {
-    const { organizationId, taskId, taskTitle, submittedByUserId, approverMemberId } = params;
+    const {
+      organizationId,
+      taskId,
+      taskTitle,
+      submittedByUserId,
+      approverMemberId,
+    } = params;
 
     try {
-      const [organization, submittedByUser, approverMember] = await Promise.all([
-        db.organization.findUnique({
-          where: { id: organizationId },
-          select: { name: true },
-        }),
-        db.user.findUnique({
-          where: { id: submittedByUserId },
-          select: { name: true, email: true },
-        }),
-        db.member.findUnique({
-          where: { id: approverMemberId },
-          select: {
-            user: {
-              select: {
-                id: true,
-                name: true,
-                email: true,
+      const [organization, submittedByUser, approverMember] = await Promise.all(
+        [
+          db.organization.findUnique({
+            where: { id: organizationId },
+            select: { name: true },
+          }),
+          db.user.findUnique({
+            where: { id: submittedByUserId },
+            select: { name: true, email: true },
+          }),
+          db.member.findUnique({
+            where: { id: approverMemberId },
+            select: {
+              user: {
+                select: {
+                  id: true,
+                  name: true,
+                  email: true,
+                },
               },
             },
-          },
-        }),
-      ]);
+          }),
+        ],
+      );
 
       const organizationName = organization?.name ?? 'your organization';
       const submittedByName =
@@ -825,7 +837,9 @@ export class TaskNotifierService {
         'Someone';
 
       if (!approverMember?.user?.id || !approverMember.user.email) {
-        this.logger.warn('Approver not found, skipping review request notification');
+        this.logger.warn(
+          'Approver not found, skipping review request notification',
+        );
         return;
       }
 
@@ -836,7 +850,10 @@ export class TaskNotifierService {
 
       const recipient = {
         id: approverMember.user.id,
-        name: approverMember.user.name?.trim() || approverMember.user.email?.trim() || 'User',
+        name:
+          approverMember.user.name?.trim() ||
+          approverMember.user.email?.trim() ||
+          'User',
         email: approverMember.user.email,
       };
 
@@ -925,41 +942,48 @@ export class TaskNotifierService {
     submittedByUserId: string;
     approverMemberId: string;
   }): Promise<void> {
-    const { organizationId, taskIds, taskCount, submittedByUserId, approverMemberId } = params;
+    const {
+      organizationId,
+      taskIds,
+      taskCount,
+      submittedByUserId,
+      approverMemberId,
+    } = params;
 
     try {
-      const [organization, submittedByUser, approverMember, tasks] = await Promise.all([
-        db.organization.findUnique({
-          where: { id: organizationId },
-          select: { name: true },
-        }),
-        db.user.findUnique({
-          where: { id: submittedByUserId },
-          select: { name: true, email: true },
-        }),
-        db.member.findUnique({
-          where: { id: approverMemberId },
-          select: {
-            user: {
-              select: {
-                id: true,
-                name: true,
-                email: true,
+      const [organization, submittedByUser, approverMember, tasks] =
+        await Promise.all([
+          db.organization.findUnique({
+            where: { id: organizationId },
+            select: { name: true },
+          }),
+          db.user.findUnique({
+            where: { id: submittedByUserId },
+            select: { name: true, email: true },
+          }),
+          db.member.findUnique({
+            where: { id: approverMemberId },
+            select: {
+              user: {
+                select: {
+                  id: true,
+                  name: true,
+                  email: true,
+                },
               },
             },
-          },
-        }),
-        db.task.findMany({
-          where: {
-            id: { in: taskIds },
-            organizationId,
-          },
-          select: {
-            id: true,
-            title: true,
-          },
-        }),
-      ]);
+          }),
+          db.task.findMany({
+            where: {
+              id: { in: taskIds },
+              organizationId,
+            },
+            select: {
+              id: true,
+              title: true,
+            },
+          }),
+        ]);
 
       const organizationName = organization?.name ?? 'your organization';
       const submittedByName =
@@ -968,7 +992,9 @@ export class TaskNotifierService {
         'Someone';
 
       if (!approverMember?.user?.id || !approverMember.user.email) {
-        this.logger.warn('Approver not found, skipping bulk review notification');
+        this.logger.warn(
+          'Approver not found, skipping bulk review notification',
+        );
         return;
       }
 
@@ -979,7 +1005,10 @@ export class TaskNotifierService {
 
       const recipient = {
         id: approverMember.user.id,
-        name: approverMember.user.name?.trim() || approverMember.user.email?.trim() || 'User',
+        name:
+          approverMember.user.name?.trim() ||
+          approverMember.user.email?.trim() ||
+          'User',
         email: approverMember.user.email,
       };
 
diff --git a/apps/api/src/tasks/tasks.controller.ts b/apps/api/src/tasks/tasks.controller.ts
index 92bfa929a..e14eb0e0b 100644
--- a/apps/api/src/tasks/tasks.controller.ts
+++ b/apps/api/src/tasks/tasks.controller.ts
@@ -408,7 +408,8 @@ export class TasksController {
   @Get(':taskId/activity')
   @ApiOperation({
     summary: 'Get task activity',
-    description: 'Retrieve audit log activity for a specific task with pagination',
+    description:
+      'Retrieve audit log activity for a specific task with pagination',
   })
   @ApiParam({
     name: 'taskId',
@@ -424,8 +425,15 @@ export class TasksController {
     @Query('take') take?: string,
   ) {
     const parsedSkip = skip ? Math.max(0, parseInt(skip, 10) || 0) : 0;
-    const parsedTake = take ? Math.min(50, Math.max(1, parseInt(take, 10) || 10)) : 10;
-    return await this.tasksService.getTaskActivity(organizationId, taskId, parsedSkip, parsedTake);
+    const parsedTake = take
+      ? Math.min(50, Math.max(1, parseInt(take, 10) || 10))
+      : 10;
+    return await this.tasksService.getTaskActivity(
+      organizationId,
+      taskId,
+      parsedSkip,
+      parsedTake,
+    );
   }
 
   @Patch(':taskId')
@@ -552,8 +560,7 @@ export class TasksController {
   @Post(':taskId/submit-for-review')
   @ApiOperation({
     summary: 'Submit task for review',
-    description:
-      'Move task status to in_review and assign an approver.',
+    description: 'Move task status to in_review and assign an approver.',
   })
   @ApiParam({
     name: 'taskId',
diff --git a/apps/api/src/tasks/tasks.service.ts b/apps/api/src/tasks/tasks.service.ts
index ee5403c07..88d799c41 100644
--- a/apps/api/src/tasks/tasks.service.ts
+++ b/apps/api/src/tasks/tasks.service.ts
@@ -571,7 +571,10 @@ export class TasksService {
         approverMemberId: approverId,
       })
       .catch((error) => {
-        console.error('Failed to send evidence review request notifications:', error);
+        console.error(
+          'Failed to send evidence review request notifications:',
+          error,
+        );
       });
 
     return updatedTask;
@@ -652,7 +655,10 @@ export class TasksService {
         approverMemberId: approverId,
       })
       .catch((error) => {
-        console.error('Failed to send bulk evidence review request notifications:', error);
+        console.error(
+          'Failed to send bulk evidence review request notifications:',
+          error,
+        );
       });
 
     return { submittedCount: tasks.length };
@@ -772,9 +778,8 @@ export class TasksService {
       throw new ForbiddenException('User is not a member of this organization');
     }
 
-    const memberRoles = currentMember.role
-      ?.split(',')
-      .map((r: string) => r.trim()) ?? [];
+    const memberRoles =
+      currentMember.role?.split(',').map((r: string) => r.trim()) ?? [];
     const isAdminOrOwner =
       memberRoles.includes('admin') || memberRoles.includes('owner');
     const isApprover = task.approverId === currentMember.id;
@@ -801,7 +806,7 @@ export class TasksService {
       });
 
       const assigneeName = task.assignee
-        ? (task.assignee.user.name || task.assignee.user.email)
+        ? task.assignee.user.name || task.assignee.user.email
         : 'Unknown';
 
       await tx.auditLog.create({
diff --git a/apps/api/src/trust-portal/badge-svgs-new.ts b/apps/api/src/trust-portal/badge-svgs-new.ts
index 7907c50df..e94a41f48 100644
--- a/apps/api/src/trust-portal/badge-svgs-new.ts
+++ b/apps/api/src/trust-portal/badge-svgs-new.ts
@@ -31,4 +31,4 @@ export const BADGE_ICON_MAP: Record<string, { icon: string; label: string }> = {
     icon: 'data:image/svg+xml;base64,PHN2ZwogICAgd2lkdGg9IjE2OCIKICAgIGhlaWdodD0iMjEwIgogICAgdmlld0JveD0iMCAwIDE2OCAyMTAiCiAgICBmaWxsPSJub25lIgogICAgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIgogID4KICAgIDxwYXRoCiAgICAgIGQ9Ik0xNTcuMjI3IDIuODAzNzFIMTAuNDc4QzYuMzQ4IDIuODAzNzEgMyA2LjE1MTYxIDMgMTAuMjgxNFYxNjAuNDM2QzMgMTYzLjIyNiA0LjU1MyAxNjUuNzgzIDcuMDI4IDE2Ny4wN0w4MS4yOTcgMjA1LjY5QzgzLjQ4MiAyMDYuODI3IDg2LjA4NiAyMDYuODE0IDg4LjI2IDIwNS42NTdMMTYwLjc0IDE2Ny4wODZDMTYzLjE4IDE2NS43ODcgMTY0LjcwNSAxNjMuMjQ5IDE2NC43MDUgMTYwLjQ4NVYxMC4yODE0QzE2NC43MDUgNi4xNTE2MSAxNjEuMzU3IDIuODAzNzEgMTU3LjIyNyAyLjgwMzcxWiIKICAgICAgZmlsbD0id2hpdGUiCiAgICAvPgogICAgPHBhdGgKICAgICAgZD0iTTE2MS43MDUgMTAuMjgxOEMxNjEuNzA1IDcuNzAwNyAxNTkuNjEzIDUuNjA4MyAxNTcuMDMyIDUuNjA4M0gxMC4yODJDNy43MDEgNS42MDgzIDUuNjA4IDcuNzAwNyA1LjYwOCAxMC4yODE4VjE2MC40MzZMNS42MTkgMTYwLjc2MkM1LjczMiAxNjIuMzc3IDYuNjc2IDE2My44MjkgOC4xMjYgMTY0LjU4M0w4Mi4zOTUgMjAzLjIwM0w4Mi42NTQgMjAzLjMyOEM4My45NjMgMjAzLjkxIDg1LjQ3MyAyMDMuODYgODYuNzQ3IDIwMy4xODNMMTU5LjIyNyAxNjQuNjExTDE1OS41MDYgMTY0LjQ1QzE2MC44NjcgMTYzLjYgMTYxLjcwNSAxNjIuMTA1IDE2MS43MDUgMTYwLjQ4NVYxMC4yODE4Wk0xNjcuMzEzIDE2MC40ODVDMTY3LjMxMyAxNjQuMTY3IDE2NS4zNDYgMTY3LjU1OCAxNjIuMTcyIDE2OS4zOUwxNjEuODYyIDE2OS41NjFMODkuMzgyIDIwOC4xMzNDODYuNDg2IDIwOS42NzQgODMuMDM1IDIwOS43MzggODAuMDkxIDIwOC4zMjFMNzkuODA4IDIwOC4xNzhMNS41MzggMTY5LjU1OUMyLjI0MSAxNjcuODQ0IDAuMTM1IDE2NC40OSAwLjAwNyAxNjAuNzk1TDAgMTYwLjQzNlYxMC4yODE4QzAgNC42MDMzIDQuNjA0IDAgMTAuMjgyIDBIMTU3LjAzMkMxNjIuNzEgMCAxNjcuMzEzIDQuNjAzMyAxNjcuMzEzIDEwLjI4MThWMTYwLjQ4NVoiCiAgICAgIGZpbGw9IiMxNjE3MUIiCiAgICAvPgogICAgPHBhdGgKICAgICAgZD0iTTEwMy40ODkgNS42MDg0SDYzLjI5NjlWMzYuMjQ5TDgzLjYyNDkgNDYuNzM1N0wxMDMuNDg5IDM2LjI0OVY1LjYwODRaIgogICAgICBmaWxsPSIjMTYxNzFCIgogICAgLz4KICAgIDxwYXRoCiAgICAgIGQ9Ik04OS4yMzQgMTcuMDgzTDg4LjUwMSAxNi41ODAzTDgzLjM5NCAxMy4wODVMNzEuNzA4IDIxLjA4MVYyNS42NTEyTDgzLjM5MyAzMy42NDg3TDk1LjA3NiAyNS42NTEyVjIxLjA4MUw4OS4yMzMgMTcuMDgzSDg5LjIzNFpNODMuMzk0IDE1LjA5ODhMODcuMDMxIDE3LjU4ODdMODUuMTYzIDE4Ljg2NjJMODQuOTk3IDE4Ljk4TDgzLjM5NiAxNy44ODQ0TDc4LjcyMSAyMS4wODI1TDgwLjMyMyAyMi4xNzk2TDgxLjc5MyAyMy4xODY1TDgzLjM5NCAyNC4yODM2TDg4LjA2NyAyMS4wODRMODYuNDY3IDE5Ljk4ODRMODYuNjMzIDE5Ljg3NDVMODguNTAxIDE4LjU5NzFMOTIuMTM2IDIxLjA4NTVMOTAuMjY4IDIyLjM2NDRMODMuMzk0IDI3LjA2OTFMNzkuNzU3IDI0LjU3OTNMNzguMjg3IDIzLjU3MzlMNzYuNTE4IDIyLjM2NDRMNzQuNjUxIDIxLjA4NTVMODMuMzk0IDE1LjA5ODhaIgogICAgICBmaWxsPSJ3aGl0ZSIKICAgIC8+CiAgICA8cGF0aAogICAgICBkPSJNNTEuODYwNCA4NS44ODVWNTcuNjIzMkg1OC43ODY0Vjg1Ljg4NUg1MS44NjA0Wk03Mi43OTY0IDg2LjUyMThDNjkuMDI4NCA4Ni41MjE4IDY2LjA4MzQgODUuNjE5NiA2My45NjA0IDgzLjgxNTFDNjEuODM3NCA4MS45ODQgNjAuNjY5NCA3OS41NDI2IDYwLjQ1NzQgNzYuNDkwOUw2Ny4zODM0IDc2LjE3MjRDNjcuNTk1NCA3Ny43MTE2IDY4LjEzOTQgNzguODkyNSA2OS4wMTU0IDc5LjcxNTFDNjkuOTE3NCA4MC41Mzc4IDcxLjIwNDQgODAuOTQ5MSA3Mi44NzY0IDgwLjk0OTFDNzQuMjI5NCA4MC45NDkxIDc1LjI2NDQgODAuNzEwMyA3NS45ODE0IDgwLjIzMjZDNzYuNzI0NCA3OS43NTQ5IDc3LjA5NTQgNzkuMDM4NCA3Ny4wOTU0IDc4LjA4MzFDNzcuMDk1NCA3Ny40OTkzIDc2Ljk0OTQgNzYuOTk1MSA3Ni42NTg0IDc2LjU3MDVDNzYuMzkyNCA3Ni4xMTk0IDc1Ljg0ODQgNzUuNzIxMyA3NS4wMjU0IDc1LjM3NjNDNzQuMjI5NCA3NS4wMDQ4IDczLjAyMjQgNzQuNjQ2NiA3MS40MDM0IDc0LjMwMTZDNjguOTA5NCA3My43NzA5IDY2Ljg5MjQgNzMuMTYwNSA2NS4zNTM0IDcyLjQ3MDVDNjMuODQwNCA3MS43NTQgNjIuNzI2NCA3MC44NjUxIDYyLjAwOTQgNjkuODAzNkM2MS4zMTk0IDY4LjcxNTYgNjAuOTc0NCA2Ny4zMzU3IDYwLjk3NDQgNjUuNjYzOEM2MC45NzQ0IDYzLjkzODkgNjEuNDEyNCA2Mi40MjYzIDYyLjI4ODQgNjEuMTI2QzYzLjE2MzQgNTkuODI1NyA2NC40MjQ0IDU4LjgxNzMgNjYuMDY5NCA1OC4xMDA4QzY3LjcxNTQgNTcuMzU3OCA2OS42Nzg0IDU2Ljk4NjMgNzEuOTYwNCA1Ni45ODYzQzc0LjQwMjQgNTYuOTg2MyA3Ni40NDU0IDU3LjQxMDkgNzguMDkwNCA1OC4yNkM3OS43NjI0IDU5LjA4MjcgODEuMDQ5NCA2MC4yMjM4IDgxLjk1MjQgNjEuNjgzM0M4Mi44ODA0IDYzLjE0MjggODMuNDUxNCA2NC44Mjc5IDgzLjY2MzQgNjYuNzM4Nkw3Ni44MTc0IDY3LjA1N0M3Ni42ODQ0IDY1LjY3NzEgNzYuMTkzNCA2NC41ODkxIDc1LjM0NDQgNjMuNzkzQzc0LjQ5NTQgNjIuOTcwMyA3My4zNDA0IDYyLjU1OSA3MS44ODE0IDYyLjU1OUM3MC42NjA0IDYyLjU1OSA2OS42OTI0IDYyLjgyNDQgNjguOTc1NCA2My4zNTUxQzY4LjI4NTQgNjMuODg1OSA2Ny45NDA0IDY0LjU3NTggNjcuOTQwNCA2NS40MjVDNjcuOTQwNCA2Ni40MDY5IDY4LjMxMjQgNjcuMTQ5OSA2OS4wNTU0IDY3LjY1NDFDNjkuODI0NCA2OC4xNTgzIDcxLjI0NDQgNjguNjA5NCA3My4zMTQ0IDY5LjAwNzVDNzYuMDIxNCA2OS41MTE3IDc4LjE1NzQgNzAuMTc1MSA3OS43MjM0IDcwLjk5NzdDODEuMjg4NCA3MS43OTM5IDgyLjQwMzQgNzIuNzYyNSA4My4wNjY0IDczLjkwMzVDODMuNzMwNCA3NS4wMTgxIDg0LjA2MTQgNzYuMzA1MSA4NC4wNjE0IDc3Ljc2NDdDODQuMDYxNCA4MC40NzE0IDgzLjA1MzQgODIuNjA3NiA4MS4wMzY0IDg0LjE3MzNDNzkuMDQ2NCA4NS43MzkgNzYuMjk5NCA4Ni41MjE4IDcyLjc5NjQgODYuNTIxOFpNOTkuMzk5NCA4Ni41MjE4Qzk2LjQ4MDQgODYuNTIxOCA5My45NzI0IDg1LjkyNDggOTEuODc2NCA4NC43MzA2Qzg5Ljc3OTQgODMuNTM2NCA4OC4xNjA0IDgxLjgzODEgODcuMDE5NCA3OS42MzU1Qzg1LjkwNTQgNzcuNDMyOSA4NS4zNDg0IDc0LjgxOTEgODUuMzQ4NCA3MS43OTM5Qzg1LjM0ODQgNjguNzY4NyA4NS45MDU0IDY2LjE1NDggODcuMDE5NCA2My45NTIyQzg4LjE2MDQgNjEuNzIzMSA4OS43Nzk0IDYwLjAxMTUgOTEuODc2NCA1OC44MTczQzkzLjk3MjQgNTcuNTk2NiA5Ni40ODA0IDU2Ljk4NjMgOTkuMzk5NCA1Ni45ODYzQzEwMi4zMTggNTYuOTg2MyAxMDQuODI2IDU3LjU5NjYgMTA2LjkyMiA1OC44MTczQzEwOS4wMTggNjAuMDExNSAxMTAuNjI0IDYxLjcyMzEgMTExLjczOCA2My45NTIyQzExMi44OCA2Ni4xNTQ4IDExMy40NSA2OC43Njg3IDExMy40NSA3MS43OTM5QzExMy40NSA3NC44MTkxIDExMi44OCA3Ny40MzI5IDExMS43MzggNzkuNjM1NUMxMTAuNjI0IDgxLjgzODEgMTA5LjAxOCA4My41MzY0IDEwNi45MjIgODQuNzMwNkMxMDQuODI2IDg1LjkyNDggMTAyLjMxOCA4Ni41MjE4IDk5LjM5OTQgODYuNTIxOFpNOTkuMzk5NCA4MC44Njk1QzEwMS41NzUgODAuODY5NSAxMDMuMjczIDgwLjA4NjYgMTA0LjQ5NCA3OC41MjFDMTA1LjcxNSA3Ni45Mjg3IDEwNi4zMjUgNzQuNjg2NCAxMDYuMzI1IDcxLjc5MzlDMTA2LjMyNSA2OC45MDEzIDEwNS43MTUgNjYuNjU5IDEwNC40OTQgNjUuMDY2OEMxMDMuMjczIDYzLjQ0OCAxMDEuNTc1IDYyLjYzODYgOTkuMzk5NCA2Mi42Mzg2Qzk3LjIyMzQgNjIuNjM4NiA5NS41MjQ0IDYzLjQ0OCA5NC4zMDQ0IDY1LjA2NjhDOTMuMDgzNCA2Ni42NTkgOTIuNDczNCA2OC45MDEzIDkyLjQ3MzQgNzEuNzkzOUM5Mi40NzM0IDc0LjY4NjQgOTMuMDgzNCA3Ni45Mjg3IDk0LjMwNDQgNzguNTIxQzk1LjUyNDQgODAuMDg2NiA5Ny4yMjM0IDgwLjg2OTUgOTkuMzk5NCA4MC44Njk1WiIKICAgICAgZmlsbD0iIzE2MTcxQiIKICAgIC8+CiAgICA8cGF0aAogICAgICBkPSJNNDUuNzU0NyA5NC4xMTU3QzQ3LjM2NSA5NC4xMTU3IDQ4Ljg4OTkgOTQuMzcyMSA1MC4zMjkzIDk0Ljg4NDlDNTEuNzY4NyA5NS4zODg2IDUzLjA0MTYgOTYuMTg0OCA1NC4xNDgyIDk3LjI3MzNDNTUuMjYzNyA5OC4zNjE5IDU2LjEzNjMgOTkuNzgzMyA1Ni43NjYxIDEwMS41MzhDNTcuNDA0OCAxMDMuMjgzIDU3LjcyODcgMTA1LjM5NyA1Ny43Mzc3IDEwNy44OEM1Ny43NDY3IDExMC4xNDcgNTcuNDYzMyAxMTIuMTg1IDU2Ljg4NzUgMTEzLjk5M0M1Ni4zMjA4IDExNS43OTIgNTUuNTA2NiAxMTcuMzI2IDU0LjQ0NSAxMTguNTk0QzUzLjM5MjUgMTE5Ljg2MyA1Mi4xMjQgMTIwLjgzNCA1MC42Mzk2IDEyMS41MDlDNDkuMTY0MyAxMjIuMTc1IDQ3LjUxOCAxMjIuNTA4IDQ1LjcwMDcgMTIyLjUwOEM0My42NTg2IDEyMi41MDggNDEuODYzOCAxMjIuMTE2IDQwLjMxNjUgMTIxLjMzNEMzOC43NjkxIDEyMC41NTEgMzcuNTM2NyAxMTkuNDk4IDM2LjYxOTEgMTE4LjE3NkMzNS43MDE0IDExNi44NTQgMzUuMTY2MiAxMTUuMzgzIDM1LjAxMzIgMTEzLjc2M0g0Mi40MDgxQzQyLjU4OCAxMTQuNiA0Mi45ODM5IDExNS4yMDcgNDMuNTk1NiAxMTUuNTg1QzQ0LjIwNzQgMTE1Ljk1NCA0NC45MDkxIDExNi4xMzggNDUuNzAwNyAxMTYuMTM4QzQ3LjI4NDEgMTE2LjEzOCA0OC40NDAxIDExNS40NTUgNDkuMTY4OCAxMTQuMDg3QzQ5LjkwNjUgMTEyLjcxMSA1MC4yNzk4IDExMC44NzYgNTAuMjg4OCAxMDguNTgySDUwLjEyNjlDNDkuNzc2IDEwOS40MjcgNDkuMjQ1MiAxMTAuMTUxIDQ4LjUzNDUgMTEwLjc1NEM0Ny44MjM4IDExMS4zNTcgNDYuOTk2MiAxMTEuODIgNDYuMDUxNiAxMTIuMTQ0QzQ1LjEwNyAxMTIuNDY4IDQ0LjEwODQgMTEyLjYzIDQzLjA1NTggMTEyLjYzQzQxLjM5MTUgMTEyLjYzIDM5LjkzNDIgMTEyLjI1NyAzOC42ODM3IDExMS41MUMzNy40MzMyIDExMC43NTQgMzYuNDU3MSAxMDkuNzI0IDM1Ljc1NTQgMTA4LjQyQzM1LjA1MzcgMTA3LjEwNiAzNC42OTg0IDEwNS42MTMgMzQuNjg5NCAxMDMuOTRDMzQuNjgwNCAxMDEuOTc4IDM1LjE0MzcgMTAwLjI2IDM2LjA3OTMgOTguNzg0N0MzNy4wMTQ5IDk3LjMwOTMgMzguMzE0OCA5Ni4xNjIzIDM5Ljk3OTEgOTUuMzQzN0M0MS42NDM0IDk0LjUyNSA0My41Njg2IDk0LjExNTcgNDUuNzU0NyA5NC4xMTU3Wk00NS44MDg3IDk5Ljc4MzNDNDUuMDYyIDk5Ljc4MzMgNDQuMzk2MyA5OS45NTQyIDQzLjgxMTUgMTAwLjI5NkM0My4yMzU4IDEwMC42MzggNDIuNzgxNSAxMDEuMTAxIDQyLjQ0ODYgMTAxLjY4NkM0Mi4xMjQ3IDEwMi4yNzEgNDEuOTY3MyAxMDIuOTMyIDQxLjk3NjMgMTAzLjY3QzQxLjk4NTMgMTA0LjQwNyA0Mi4xNTE3IDEwNS4wNjkgNDIuNDc1NiAxMDUuNjUzQzQyLjgwODQgMTA2LjIzOCA0My4yNTgzIDEwNi43MDEgNDMuODI1IDEwNy4wNDNDNDQuNDAwOCAxMDcuMzg1IDQ1LjA2MiAxMDcuNTU2IDQ1LjgwODcgMTA3LjU1NkM0Ni4zNTc1IDEwNy41NTYgNDYuODY1NyAxMDcuNDYyIDQ3LjMzMzUgMTA3LjI3M0M0Ny44MDEzIDEwNy4wNzUgNDguMjA2MiAxMDYuOCA0OC41NDggMTA2LjQ0OUM0OC44OTg5IDEwNi4wOSA0OS4xNjg4IDEwNS42NzYgNDkuMzU3NyAxMDUuMjA4QzQ5LjU1NTYgMTA0LjczMSA0OS42NTAxIDEwNC4yMTggNDkuNjQxMSAxMDMuNjdDNDkuNjMyMSAxMDIuOTMyIDQ5LjQ2MTEgMTAyLjI3MSA0OS4xMjgzIDEwMS42ODZDNDguNzk1NCAxMDEuMTAxIDQ4LjM0MTEgMTAwLjYzOCA0Ny43NjU0IDEwMC4yOTZDNDcuMTg5NiA5OS45NTQyIDQ2LjUzNzQgOTkuNzgzMyA0NS44MDg3IDk5Ljc4MzNaTTczLjAwOTkgMTIyLjg4NkM3MC40OTk5IDEyMi44NzcgNjguMzMxOCAxMjIuMjk2IDY2LjUwNTYgMTIxLjE0NUM2NC42Nzk0IDExOS45OTMgNjMuMjcxNSAxMTguMzMzIDYyLjI4MTkgMTE2LjE2NUM2MS4yOTIzIDExMy45OTcgNjAuODAyIDExMS4zOTcgNjAuODExIDEwOC4zNjZDNjAuODIgMTA1LjMyNSA2MS4zMTQ4IDEwMi43NDMgNjIuMjk1NCAxMDAuNjJDNjMuMjg0OSA5OC40OTY4IDY0LjY4ODQgOTYuODgyIDY2LjUwNTYgOTUuNzc1NUM2OC4zMzE4IDk0LjY2ODkgNzAuNDk5OSA5NC4xMTU3IDczLjAwOTkgOTQuMTE1N0M3NS41MTk4IDk0LjExNTcgNzcuNjg3OSA5NC42NzM0IDc5LjUxNDEgOTUuNzg5QzgxLjM0MDMgOTYuODk1NSA4Mi43NDgzIDk4LjUxMDMgODMuNzM3OCAxMDAuNjMzQzg0LjcyNzQgMTAyLjc1NyA4NS4yMTc3IDEwNS4zMzQgODUuMjA4NyAxMDguMzY2Qzg1LjIwODcgMTExLjQxNSA4NC43MTM5IDExNC4wMjQgODMuNzI0MyAxMTYuMTkyQzgyLjczNDggMTE4LjM2IDgxLjMyNjkgMTIwLjAyIDc5LjUwMDYgMTIxLjE3MkM3Ny42ODM0IDEyMi4zMTQgNzUuNTE5OCAxMjIuODg2IDczLjAwOTkgMTIyLjg4NlpNNzMuMDA5OSAxMTYuNzg2Qzc0LjMwNTMgMTE2Ljc4NiA3NS4zNjY5IDExNi4xMTEgNzYuMTk0NSAxMTQuNzYyQzc3LjAzMTIgMTEzLjQwNCA3Ny40NDUgMTExLjI3MSA3Ny40MzYgMTA4LjM2NkM3Ny40MzYgMTA2LjQ2NyA3Ny4yNDcxIDEwNC45MTYgNzYuODY5MiAxMDMuNzFDNzYuNDkxNCAxMDIuNTA1IDc1Ljk2OTYgMTAxLjYxNCA3NS4zMDM5IDEwMS4wMzhDNzQuNjM4MiAxMDAuNDU0IDczLjg3MzUgMTAwLjE2MSA3My4wMDk5IDEwMC4xNjFDNzEuNzE0NCAxMDAuMTYxIDcwLjY1NzMgMTAwLjgxOCA2OS44Mzg3IDEwMi4xMzFDNjkuMDIgMTAzLjQ0NSA2OC42MDE3IDEwNS41MjMgNjguNTgzNyAxMDguMzY2QzY4LjU3NDcgMTEwLjMgNjguNzU5MSAxMTEuODkyIDY5LjEzNyAxMTMuMTQzQzY5LjUxNDggMTE0LjM4NCA3MC4wMzY2IDExNS4zMDIgNzAuNzAyMyAxMTUuODk2QzcxLjM3NyAxMTYuNDg5IDcyLjE0NjIgMTE2Ljc4NiA3My4wMDk5IDExNi43ODZaTTEwMC43NjggMTIyLjg4NkM5OC4yNTc3IDEyMi44NzcgOTYuMDg5NiAxMjIuMjk2IDk0LjI2MzQgMTIxLjE0NUM5Mi40MzcyIDExOS45OTMgOTEuMDI5MyAxMTguMzMzIDkwLjAzOTcgMTE2LjE2NUM4OS4wNTAxIDExMy45OTcgODguNTU5OCAxMTEuMzk3IDg4LjU2ODggMTA4LjM2NkM4OC41Nzc4IDEwNS4zMjUgODkuMDcyNiAxMDIuNzQzIDkwLjA1MzIgMTAwLjYyQzkxLjA0MjggOTguNDk2OCA5Mi40NDYyIDk2Ljg4MiA5NC4yNjM0IDk1Ljc3NTVDOTYuMDg5NiA5NC42Njg5IDk4LjI1NzcgOTQuMTE1NyAxMDAuNzY4IDk0LjExNTdDMTAzLjI3OCA5NC4xMTU3IDEwNS40NDYgOTQuNjczNCAxMDcuMjcyIDk1Ljc4OUMxMDkuMDk4IDk2Ljg5NTUgMTEwLjUwNiA5OC41MTAzIDExMS40OTYgMTAwLjYzM0MxMTIuNDg1IDEwMi43NTcgMTEyLjk3NiAxMDUuMzM0IDExMi45NjcgMTA4LjM2NkMxMTIuOTY3IDExMS40MTUgMTEyLjQ3MiAxMTQuMDI0IDExMS40ODIgMTE2LjE5MkMxMTAuNDkzIDExOC4zNiAxMDkuMDg1IDEyMC4wMiAxMDcuMjU4IDEyMS4xNzJDMTA1LjQ0MSAxMjIuMzE0IDEwMy4yNzggMTIyLjg4NiAxMDAuNzY4IDEyMi44ODZaTTEwMC43NjggMTE2Ljc4NkMxMDIuMDYzIDExNi43ODYgMTAzLjEyNSAxMTYuMTExIDEwMy45NTIgMTE0Ljc2MkMxMDQuNzg5IDExMy40MDQgMTA1LjIwMyAxMTEuMjcxIDEwNS4xOTQgMTA4LjM2NkMxMDUuMTk0IDEwNi40NjcgMTA1LjAwNSAxMDQuOTE2IDEwNC42MjcgMTAzLjcxQzEwNC4yNDkgMTAyLjUwNSAxMDMuNzI3IDEwMS42MTQgMTAzLjA2MiAxMDEuMDM4QzEwMi4zOTYgMTAwLjQ1NCAxMDEuNjMxIDEwMC4xNjEgMTAwLjc2OCAxMDAuMTYxQzk5LjQ3MjIgMTAwLjE2MSA5OC40MTUyIDEwMC44MTggOTcuNTk2NSAxMDIuMTMxQzk2Ljc3NzggMTAzLjQ0NSA5Ni4zNTk1IDEwNS41MjMgOTYuMzQxNSAxMDguMzY2Qzk2LjMzMjUgMTEwLjMgOTYuNTE3IDExMS44OTIgOTYuODk0OCAxMTMuMTQzQzk3LjI3MjYgMTE0LjM4NCA5Ny43OTQ0IDExNS4zMDIgOTguNDYwMSAxMTUuODk2Qzk5LjEzNDkgMTE2LjQ4OSA5OS45MDQgMTE2Ljc4NiAxMDAuNzY4IDExNi43ODZaTTEzMC4wMzcgOTQuNDkzNVYxMjIuMTNIMTIyLjUzNFYxMDEuNDAzSDEyMi4zNzJMMTE2LjMyNyAxMDUuMDE5Vjk4LjY0OThMMTIzLjEyOCA5NC40OTM1SDEzMC4wMzdaIgogICAgICBmaWxsPSIjMTYxNzFCIgogICAgLz4KICAgIDxwYXRoCiAgICAgIGQ9Ik00NS41MTY3IDE0MS4xMUM0NC43MzA3IDE0MS4xMSA0NC4wMzM3IDE0MC45MzIgNDMuNDI2NyAxNDAuNTc2QzQyLjgxOTcgMTQwLjIxOSA0Mi4zNDE3IDEzOS43MDUgNDEuOTkzNyAxMzkuMDMzQzQxLjY0NDcgMTM4LjM2IDQxLjQ3MDcgMTM3LjU1NSA0MS40NzA3IDEzNi42MTVDNDEuNDcwNyAxMzUuNyA0MS42MzY3IDEzNC45MDYgNDEuOTY4NyAxMzQuMjM0QzQyLjMwODcgMTMzLjU1NCA0Mi43ODI3IDEzMy4wMjcgNDMuMzkwNyAxMzIuNjU1QzQ0LjAwNTcgMTMyLjI4MiA0NC43MjY3IDEzMi4wOTYgNDUuNTUyNyAxMzIuMDk2QzQ2LjY3ODcgMTMyLjA5NiA0Ny41NTM3IDEzMi4zNzUgNDguMTc2NyAxMzIuOTM0QzQ4LjgwMDcgMTMzLjQ4NSA0OS4yMDU3IDEzNC4yNzQgNDkuMzkxNyAxMzUuMzAzTDQ3LjQ3MjcgMTM1LjM3NkM0Ny4zNzQ3IDEzNC44MzMgNDcuMTY0NyAxMzQuNDEyIDQ2Ljg0MDcgMTM0LjExMkM0Ni41MTY3IDEzMy44MDUgNDYuMDg3NyAxMzMuNjUxIDQ1LjU1MjcgMTMzLjY1MUM0NC44NjQ3IDEzMy42NTEgNDQuMzI5NyAxMzMuOTIyIDQzLjk0ODcgMTM0LjQ2NUM0My41Njg3IDEzNC45OTkgNDMuMzc3NyAxMzUuNzE2IDQzLjM3NzcgMTM2LjYxNUM0My4zNzc3IDEzNy41MjIgNDMuNTcyNyAxMzguMjM5IDQzLjk2MTcgMTM4Ljc2NUM0NC4zNDk3IDEzOS4yOTIgNDQuODc2NyAxMzkuNTU1IDQ1LjU0MDcgMTM5LjU1NUM0Ni4xMTU3IDEzOS41NTUgNDYuNTY0NyAxMzkuMzkzIDQ2Ljg4ODcgMTM5LjA2OUM0Ny4yMTI3IDEzOC43MzcgNDcuNDE1NyAxMzguMjc5IDQ3LjQ5NjcgMTM3LjY5Nkw0OS40Mjc3IDEzNy43NjlDNDkuMjQ5NyAxMzguODIyIDQ4LjgzMjcgMTM5LjY0NCA0OC4xNzY3IDE0MC4yMzVDNDcuNTI4NyAxNDAuODE4IDQ2LjY0MTcgMTQxLjExIDQ1LjUxNjcgMTQxLjExWk01My4wODA3IDE0MC45MTZWMTMyLjI5SDU5LjA4MTdWMTMzLjg0NUg1NC45MjY3VjEzNS44MjVINTguOTM1N1YxMzcuMzU2SDU0LjkyNjdWMTM5LjM2MUg1OS4xNzg3VjE0MC45MTZINTMuMDgwN1pNNjMuMDMxNyAxNDAuOTE2VjEzMi4yOUg2Ni44MTA3QzY3LjQ0MTcgMTMyLjI5IDY3Ljk4ODcgMTMyLjM5NSA2OC40NTA3IDEzMi42MDZDNjguOTExNyAxMzIuODE3IDY5LjI2ODcgMTMzLjExNiA2OS41MTk3IDEzMy41MDVDNjkuNzc4NyAxMzMuODg2IDY5LjkwNzcgMTM0LjMzOSA2OS45MDc3IDEzNC44NjZDNjkuOTA3NyAxMzUuMzkyIDY5Ljc2NjcgMTM1LjgzOCA2OS40ODI3IDEzNi4yMDJDNjkuMjA3NyAxMzYuNTY2IDY4Ljg0MjcgMTM2LjgxOCA2OC4zODk3IDEzNi45NTVDNjkuMjM5NyAxMzcuMDc3IDY5LjcwMTcgMTM3LjU3MSA2OS43NzQ3IDEzOC40MzdMNjkuOTkyNyAxNDAuOTE2SDY4LjEwOTdMNjcuOTUxNyAxMzguNzI5QzY3LjkyNzcgMTM4LjM5NyA2Ny44MjI3IDEzOC4xNTQgNjcuNjM2NyAxMzhDNjcuNDU3NyAxMzcuODM4IDY3LjE1MDcgMTM3Ljc1NyA2Ni43MTI3IDEzNy43NTdINjQuODc4N1YxNDAuOTE2SDYzLjAzMTdaTTY0Ljg3ODcgMTM2LjIxNEg2Ni42MDM3QzY3LjA0ODcgMTM2LjIxNCA2Ny4zOTM3IDEzNi4xMTMgNjcuNjM2NyAxMzUuOTFDNjcuODg3NyAxMzUuNyA2OC4wMTI3IDEzNS40MDQgNjguMDEyNyAxMzUuMDI0QzY4LjAxMjcgMTM0LjYzNSA2Ny44ODc3IDEzNC4zNDMgNjcuNjM2NyAxMzQuMTQ5QzY3LjM4NTcgMTMzLjk0NiA2Ny4wMjA3IDEzMy44NDUgNjYuNTQyNyAxMzMuODQ1SDY0Ljg3ODdWMTM2LjIxNFpNNzUuNTI4NyAxNDAuOTE2VjEzMy44NDVINzIuOTUzN1YxMzIuMjlINzkuOTc1N1YxMzMuODQ1SDc3LjM4NzdWMTQwLjkxNkg3NS41Mjg3Wk04My4yMDc3IDE0MC45MTZWMTMyLjI5SDg1LjA1NDdWMTQwLjkxNkg4My4yMDc3Wk04OS4xMTM3IDE0MC45MTZWMTMyLjI5SDk1LjA2NjdWMTMzLjg0NUg5MC45NjA3VjEzNS45MzVIOTQuODQ3N1YxMzcuNDY1SDkwLjk2MDdWMTQwLjkxNkg4OS4xMTM3Wk05OC43MDk3IDE0MC45MTZWMTMyLjI5SDEwMC41NTZWMTQwLjkxNkg5OC43MDk3Wk0xMDQuNjE1IDE0MC45MTZWMTMyLjI5SDExMC42MTdWMTMzLjg0NUgxMDYuNDYyVjEzNS44MjVIMTEwLjQ3MVYxMzcuMzU2SDEwNi40NjJWMTM5LjM2MUgxMTAuNzE0VjE0MC45MTZIMTA0LjYxNVpNMTE0LjU2NyAxNDAuOTE2VjEzMi4yOUgxMTcuNTQzQzExOC45MzYgMTMyLjI5IDEyMC4wMDkgMTMyLjY2NyAxMjAuNzYzIDEzMy40MkMxMjEuNTI0IDEzNC4xNjUgMTIxLjkwNSAxMzUuMjMgMTIxLjkwNSAxMzYuNjE1QzEyMS45MDUgMTM3Ljk5MiAxMjEuNTMyIDEzOS4wNTMgMTIwLjc4NyAxMzkuNzk4QzEyMC4wNDIgMTQwLjU0MyAxMTguOTg1IDE0MC45MTYgMTE3LjYxNiAxNDAuOTE2SDExNC41NjdaTTExNi40MTMgMTM5LjM2MUgxMTcuNTQzQzExOC4zNzggMTM5LjM2MSAxMTguOTkzIDEzOS4xMzggMTE5LjM5IDEzOC42OTJDMTE5Ljc5NSAxMzguMjM5IDExOS45OTcgMTM3LjU0MiAxMTkuOTk3IDEzNi42MDNDMTE5Ljk5NyAxMzUuNjcxIDExOS43OTUgMTM0Ljk3OSAxMTkuMzkgMTM0LjUyNUMxMTguOTkzIDEzNC4wNzIgMTE4LjM3OCAxMzMuODQ1IDExNy41NDMgMTMzLjg0NUgxMTYuNDEzVjEzOS4zNjFaIgogICAgICBmaWxsPSIjMTYxNzFCIgogICAgLz4KICAgIDxwYXRoCiAgICAgIGQ9Ik01OS41NTc1IDUuMTQwMjhMNTYuNTE5NSA0LjkxNTg4VjMuNzM4MjhINjYuODAxNVYxMS45ODE0SDY0LjA5NjVDNjQuMDk2NSAxMi4zNzM5IDYzLjc2MzUgMTIuMTc2NCA2My43NjM1IDguODc5MThDNjMuNzYzNSA1LjU4MTg4IDYxLjE4MTUgNS4xNDAyOCA1OS41NTc1IDUuMTQwMjhaIgogICAgICBmaWxsPSIjMTYxNzFCIgogICAgLz4KICAgIDxwYXRoCiAgICAgIGQ9Ik01Ni41MTg4IDQuOTE1NTFINTYuMDUxOFY1LjM0OTYxTDU2LjQ4NDggNS4zODE2MUw1Ni41MTg4IDQuOTE1NTFaTTU5LjU1NjggNS4xMzk5MUw1OS41MjI4IDUuNjA2MDFMNTkuNTM5OCA1LjYwNzMxSDU5LjU1NjhWNS4xMzk5MVpNNjQuMDk1OCAxMS45ODFWMTEuNTEzNkg2My42Mjc4VjExLjk4MUg2NC4wOTU4Wk02Ni44MDA4IDExLjk4MVYxMi40NDg0SDY3LjI2ODhWMTEuOTgxSDY2LjgwMDhaTTY2LjgwMDggMy43Mzc5MUg2Ny4yNjg4VjMuMjcwNTFINjYuODAwOFYzLjczNzkxWk01Ni41MTg4IDMuNzM3OTFWMy4yNzA1MUg1Ni4wNTE4VjMuNzM3OTFINTYuNTE4OFpNNTYuNTE4OCA0LjkxNTUxTDU2LjQ4NDggNS4zODE2MUw1OS41MjI4IDUuNjA2MDFMNTkuNTU2OCA1LjEzOTkxTDU5LjU5MTggNC42NzM5MUw1Ni41NTM4IDQuNDQ5NDFMNTYuNTE4OCA0LjkxNTUxWk01OS41NTY4IDUuMTM5OTFWNS42MDczMUM2MC4zNDE4IDUuNjA3MzEgNjEuMjg2OCA1LjcxNzIxIDYyLjAyMzggNi4xNzA5MUM2Mi43MjA4IDYuNjAwMTEgNjMuMjk1OCA3LjM3NjExIDYzLjI5NTggOC44Nzg4MUg2My43NjI4SDY0LjIzMDhDNjQuMjMwOCA3LjA4NDIxIDYzLjUxMzggNS45OTA4MSA2Mi41MTM4IDUuMzc0OTFDNjEuNTUzOCA0Ljc4MzUxIDYwLjM5NTggNC42NzI2MSA1OS41NTY4IDQuNjcyNjFWNS4xMzk5MVpNNjMuNzYyOCA4Ljg3ODgxSDYzLjI5NThDNjMuMjk1OCAxMC41MzM1IDYzLjM3ODggMTEuNDQ1NiA2My40NzA4IDExLjkwNThDNjMuNDk0OCAxMi4wMjE2IDYzLjUyMTggMTIuMTI0NiA2My41NTQ4IDEyLjIwOTdDNjMuNTcwOCAxMi4yNTE3IDYzLjU5MjggMTIuMzAyNyA2My42MjU4IDEyLjM1MjhDNjMuNjUwOCAxMi4zOTE4IDYzLjcxNjggMTIuNDg3OCA2My44NDI4IDEyLjU0NzVDNjMuOTEzOCAxMi41ODE0IDY0LjAwNjggMTIuNjA0NyA2NC4xMTI4IDEyLjU5MTNDNjQuMjE4OCAxMi41NzggNjQuMzAxOCAxMi41MzI3IDY0LjM2MDggMTIuNDg0M0M2NC40NjU4IDEyLjM5ODcgNjQuNTA2OCAxMi4yOTM1IDY0LjUyMTggMTIuMjUxMkM2NC41NTY4IDEyLjE1MjUgNjQuNTYyOCAxMi4wNTE0IDY0LjU2MjggMTEuOTgxSDY0LjA5NThINjMuNjI3OEM2My42Mjc4IDEyLjAwODcgNjMuNjIzOCAxMS45ODczIDYzLjY0MDggMTEuOTQwMUM2My42NDU4IDExLjkyMzUgNjMuNjc2OCAxMS44MzcgNjMuNzY3OCAxMS43NjE4QzYzLjgyMDggMTEuNzE4NSA2My44OTc4IDExLjY3NjMgNjMuOTk1OCAxMS42NjM5QzY0LjA5NDggMTEuNjUxNSA2NC4xODA4IDExLjY3MzUgNjQuMjQ0OCAxMS43MDM2QzY0LjM1MzggMTEuNzU1OSA2NC40MDM4IDExLjgzNSA2NC40MTA4IDExLjg0NjNDNjQuNDI1OCAxMS44Njg3IDY0LjQyOTggMTEuODgxMyA2NC40MjU4IDExLjg3MjlDNjQuNDE5OCAxMS44NTczIDY0LjQwNTggMTEuODExNyA2NC4zODc4IDExLjcyMTNDNjQuMzEzOCAxMS4zNTY1IDY0LjIzMDggMTAuNTIxNCA2NC4yMzA4IDguODc4ODFINjMuNzYyOFpNNjQuMDk1OCAxMS45ODFWMTIuNDQ4NEg2Ni44MDA4VjExLjk4MVYxMS41MTM2SDY0LjA5NThWMTEuOTgxWk02Ni44MDA4IDExLjk4MUg2Ny4yNjg4VjMuNzM3OTFINjYuODAwOEg2Ni4zMzM4VjExLjk4MUg2Ni44MDA4Wk02Ni44MDA4IDMuNzM3OTFWMy4yNzA1MUg1Ni41MTg4VjMuNzM3OTFWNC4yMDUyMUg2Ni44MDA4VjMuNzM3OTFaTTU2LjUxODggMy43Mzc5MUg1Ni4wNTE4VjQuOTE1NTFINTYuNTE4OEg1Ni45ODY4VjMuNzM3OTFINTYuNTE4OFoiCiAgICAgIGZpbGw9IiMxNjE3MUIiCiAgICAvPgogICAgPHBhdGgKICAgICAgZD0iTTEwNy45MjggNS4xNDAyOEwxMTAuOTY2IDQuOTE1ODhWMy43MzgyOEgxMDAuNjg0VjExLjk4MTRMMTAyLjU1MyAxMi4xNTA3QzEwMi41NTMgMTIuNTQzMiAxMDMuMDIxIDExLjY4MzMgMTAzLjAyMSA4Ljg3OTE4QzEwMy4wMjEgNS41ODE4OCAxMDYuMzA1IDUuMTQwMjggMTA3LjkyOCA1LjE0MDI4WiIKICAgICAgZmlsbD0iIzE2MTcxQiIKICAgIC8+CiAgICA8cGF0aAogICAgICBkPSJNMTEwLjk2NSA0LjkxNTUxSDExMS40MzJWNS4zNDk2MUwxMTAuOTk5IDUuMzgxNjFMMTEwLjk2NSA0LjkxNTUxWk0xMDcuOTI3IDUuMTM5OTFMMTA3Ljk2MSA1LjYwNjAxTDEwNy45NDQgNS42MDczMUgxMDcuOTI3VjUuMTM5OTFaTTEwMi41NTIgMTIuMTUwM0wxMDIuNTk1IDExLjY4NDhMMTAzLjAyIDExLjcyMzNWMTIuMTUwM0gxMDIuNTUyWk0xMDAuNjgzIDExLjk4MUwxMDAuNjQxIDEyLjQ0NjRMMTAwLjIxNiAxMi40MDc5VjExLjk4MUgxMDAuNjgzWk0xMDAuNjgzIDMuNzM3OTFIMTAwLjIxNlYzLjI3MDUxSDEwMC42ODNWMy43Mzc5MVpNMTEwLjk2NSAzLjczNzkxVjMuMjcwNTFIMTExLjQzMlYzLjczNzkxSDExMC45NjVaTTExMC45NjUgNC45MTU1MUwxMTAuOTk5IDUuMzgxNjFMMTA3Ljk2MSA1LjYwNjAxTDEwNy45MjcgNS4xMzk5MUwxMDcuODkzIDQuNjczOTFMMTEwLjkzIDQuNDQ5NDFMMTEwLjk2NSA0LjkxNTUxWk0xMDcuOTI3IDUuMTM5OTFWNS42MDczMUMxMDcuMTQyIDUuNjA3MzEgMTA2LjAwMyA1LjcxNjQxIDEwNS4wNzcgNi4xODkyMUMxMDQuNjIgNi40MjIzMSAxMDQuMjI4IDYuNzM3NDEgMTAzLjk0OCA3LjE2MDkxQzEwMy42NzEgNy41ODE2MSAxMDMuNDg3IDguMTM1OTEgMTAzLjQ4NyA4Ljg3ODgxSDEwMy4wMkgxMDIuNTUyQzEwMi41NTIgNy45NzMxMSAxMDIuNzc5IDcuMjM1NzEgMTAzLjE2OCA2LjY0NjIxQzEwMy41NTUgNi4wNTk2MSAxMDQuMDg1IDUuNjQ2MTEgMTA0LjY1MiA1LjM1NjYxQzEwNS43NzQgNC43ODQzMSAxMDcuMDg4IDQuNjcyNjEgMTA3LjkyNyA0LjY3MjYxVjUuMTM5OTFaTTEwMy4wMiA4Ljg3ODgxSDEwMy40ODdDMTAzLjQ4NyAxMC4zMDMzIDEwMy4zNjkgMTEuMjU2IDEwMy4yNDIgMTEuODE2NEMxMDMuMTgzIDEyLjA3ODYgMTAzLjExMSAxMi4zMDYzIDEwMy4wMiAxMi40NDlDMTAyLjk5OCAxMi40ODM4IDEwMi45NDkgMTIuNTU2MiAxMDIuODY3IDEyLjYxNTFDMTAyLjgyMyAxMi42NDY1IDEwMi43NDYgMTIuNjkwMiAxMDIuNjQyIDEyLjcwMzVDMTAyLjUyNyAxMi43MTgzIDEwMi40MSAxMi42OTA5IDEwMi4zMTIgMTIuNjI1NUMxMDIuMTUgMTIuNTE2OSAxMDIuMTExIDEyLjM1MzIgMTAyLjEwMyAxMi4zMTU4QzEwMi4wODggMTIuMjUyNSAxMDIuMDg1IDEyLjE5MzIgMTAyLjA4NSAxMi4xNTAzSDEwMi41NTJIMTAzLjAyQzEwMy4wMiAxMi4xNTY0IDEwMy4wMjEgMTIuMTM2NCAxMDMuMDEzIDEyLjEwMjJDMTAzLjAxMSAxMi4wOTQgMTAyLjk4MiAxMS45NDk0IDEwMi44MzMgMTEuODQ5NEMxMDIuNzQyIDExLjc4ODIgMTAyLjYzMiAxMS43NjI1IDEwMi41MjQgMTEuNzc2M0MxMDIuNDI3IDExLjc4ODYgMTAyLjM2IDExLjgyODcgMTAyLjMyNCAxMS44NTM4QzEwMi4yNTkgMTEuOSAxMDIuMjMxIDExLjk0ODkgMTAyLjIzIDExLjk0OTFDMTAyLjIyOCAxMS45NTMzIDEwMi4yNzMgMTEuODY0MyAxMDIuMzMgMTEuNjEwMUMxMDIuNDM3IDExLjEzNzcgMTAyLjU1MiAxMC4yNTg0IDEwMi41NTIgOC44Nzg4MUgxMDMuMDJaTTEwMi41NTIgMTIuMTUwM0wxMDIuNTEgMTIuNjE1N0wxMDAuNjQxIDEyLjQ0NjRMMTAwLjY4MyAxMS45ODFMMTAwLjcyNSAxMS41MTU1TDEwMi41OTUgMTEuNjg0OEwxMDIuNTUyIDEyLjE1MDNaTTEwMC42ODMgMTEuOTgxSDEwMC4yMTZWMy43Mzc5MUgxMDAuNjgzSDEwMS4xNVYxMS45ODFIMTAwLjY4M1pNMTAwLjY4MyAzLjczNzkxVjMuMjcwNTFIMTEwLjk2NVYzLjczNzkxVjQuMjA1MjFIMTAwLjY4M1YzLjczNzkxWk0xMTAuOTY1IDMuNzM3OTFIMTExLjQzMlY0LjkxNTUxSDExMC45NjVIMTEwLjQ5N1YzLjczNzkxSDExMC45NjVaIgogICAgICBmaWxsPSIjMTYxNzFCIgogICAgLz4KICAgIDxwYXRoCiAgICAgIGQ9Ik04Mi40MDYxIDE2Mi42MjdDODMuMTc3MSAxNjIuNzMxIDgzLjk1ODEgMTYyLjczMSA4NC43MjkxIDE2Mi42MjhMMTUzLjM3NSAxNTMuNDQzQzE1NS4yODggMTUzLjE4NyAxNTYuOTYyIDE1NC43MzMgMTU2Ljg1OSAxNTYuNjYxQzE1Ni44MDEgMTU3Ljc0NyAxNTYuMTc0IDE1OC43MjIgMTU1LjIxIDE1OS4yMjZMODUuNTkxMSAxOTUuNTk0Qzg0LjMyMzEgMTk2LjI1NiA4Mi44MTIxIDE5Ni4yNTYgODEuNTQ0MSAxOTUuNTk0TDEyLjA0NjEgMTU5LjI4OUMxMS4wMTUxIDE1OC43NTEgMTAuMzY5MSAxNTcuNjg0IDEwLjM2OTEgMTU2LjUyMUMxMC4zNjkxIDE1NC42MzEgMTIuMDM1MSAxNTMuMTc0IDEzLjkwODEgMTUzLjQyNkw4Mi40MDYxIDE2Mi42MjdaIgogICAgICBmaWxsPSIjMDA0RjNCIgogICAgLz4KICA8L3N2Zz4=',
     label: 'ISO 9001',
   },
-};
\ No newline at end of file
+};
diff --git a/apps/api/src/trust-portal/dto/trust-vendor.dto.ts b/apps/api/src/trust-portal/dto/trust-vendor.dto.ts
index a790c4fb7..47396e54d 100644
--- a/apps/api/src/trust-portal/dto/trust-vendor.dto.ts
+++ b/apps/api/src/trust-portal/dto/trust-vendor.dto.ts
@@ -1,7 +1,16 @@
 import { z } from 'zod';
 
 const ComplianceBadgeSchema = z.object({
-  type: z.enum(['soc2', 'iso27001', 'iso42001', 'gdpr', 'hipaa', 'pci_dss', 'nen7510', 'iso9001']),
+  type: z.enum([
+    'soc2',
+    'iso27001',
+    'iso42001',
+    'gdpr',
+    'hipaa',
+    'pci_dss',
+    'nen7510',
+    'iso9001',
+  ]),
   verified: z.boolean(),
 });
 
@@ -12,6 +21,8 @@ export const UpdateVendorTrustSettingsSchema = z.object({
   complianceBadges: z.array(ComplianceBadgeSchema).optional().nullable(),
 });
 
-export type UpdateVendorTrustSettingsDto = z.infer<typeof UpdateVendorTrustSettingsSchema>;
+export type UpdateVendorTrustSettingsDto = z.infer<
+  typeof UpdateVendorTrustSettingsSchema
+>;
 
 export type ComplianceBadge = z.infer<typeof ComplianceBadgeSchema>;
diff --git a/apps/api/src/trust-portal/trust-access.service.ts b/apps/api/src/trust-portal/trust-access.service.ts
index 6427cbf2c..003b9acef 100644
--- a/apps/api/src/trust-portal/trust-access.service.ts
+++ b/apps/api/src/trust-portal/trust-access.service.ts
@@ -25,7 +25,6 @@ import archiver from 'archiver';
 import { PassThrough, Readable } from 'stream';
 import { PDFDocument, rgb, StandardFonts } from 'pdf-lib';
 
-
 @Injectable()
 export class TrustAccessService {
   /**
@@ -2522,7 +2521,9 @@ export class TrustAccessService {
       }
       return {
         ...vendor,
-        complianceBadges: this.formatComplianceBadgeLabels(vendor.complianceBadges),
+        complianceBadges: this.formatComplianceBadgeLabels(
+          vendor.complianceBadges,
+        ),
         trustPortalUrl,
       };
     });
@@ -2532,7 +2533,9 @@ export class TrustAccessService {
    * Format compliance badges as simple type + label pairs for external rendering.
    * Does NOT include branded icons to avoid implying vendors were certified through us.
    */
-  private formatComplianceBadgeLabels(badges: unknown): { type: string; label: string }[] {
+  private formatComplianceBadgeLabels(
+    badges: unknown,
+  ): { type: string; label: string }[] {
     if (!badges || !Array.isArray(badges)) {
       return [];
     }
diff --git a/apps/api/src/trust-portal/trust-portal.controller.ts b/apps/api/src/trust-portal/trust-portal.controller.ts
index 4cc5e5a18..1117467ab 100644
--- a/apps/api/src/trust-portal/trust-portal.controller.ts
+++ b/apps/api/src/trust-portal/trust-portal.controller.ts
@@ -325,7 +325,11 @@ export class TrustPortalController {
     @AuthContext() authContext: AuthContextType,
   ) {
     const dto = UpdateCustomLinkSchema.parse(body);
-    return this.trustPortalService.updateCustomLink(linkId, dto, authContext.organizationId);
+    return this.trustPortalService.updateCustomLink(
+      linkId,
+      dto,
+      authContext.organizationId,
+    );
   }
 
   @Post('custom-links/:linkId/delete')
@@ -341,7 +345,10 @@ export class TrustPortalController {
     @Param('linkId') linkId: string,
     @AuthContext() authContext: AuthContextType,
   ) {
-    return this.trustPortalService.deleteCustomLink(linkId, authContext.organizationId);
+    return this.trustPortalService.deleteCustomLink(
+      linkId,
+      authContext.organizationId,
+    );
   }
 
   @Post('custom-links/reorder')
@@ -394,7 +401,11 @@ export class TrustPortalController {
     @AuthContext() authContext: AuthContextType,
   ) {
     const dto = UpdateVendorTrustSettingsSchema.parse(body);
-    return this.trustPortalService.updateVendorTrustSettings(vendorId, dto, authContext.organizationId);
+    return this.trustPortalService.updateVendorTrustSettings(
+      vendorId,
+      dto,
+      authContext.organizationId,
+    );
   }
 
   @Get('vendors')
diff --git a/apps/api/src/trust-portal/trust-portal.service.ts b/apps/api/src/trust-portal/trust-portal.service.ts
index ea21950a6..cae381605 100644
--- a/apps/api/src/trust-portal/trust-portal.service.ts
+++ b/apps/api/src/trust-portal/trust-portal.service.ts
@@ -644,11 +644,14 @@ export class TrustPortalService {
     }
   }
 
-  async updateOverview(organizationId: string, data: {
-    overviewTitle?: string | null;
-    overviewContent?: string | null;
-    showOverview?: boolean;
-  }) {
+  async updateOverview(
+    organizationId: string,
+    data: {
+      overviewTitle?: string | null;
+      overviewContent?: string | null;
+      showOverview?: boolean;
+    },
+  ) {
     const trust = await db.trust.findUnique({
       where: { organizationId },
     });
@@ -684,11 +687,14 @@ export class TrustPortalService {
     return trust;
   }
 
-  async createCustomLink(organizationId: string, data: {
-    title: string;
-    description?: string | null;
-    url: string;
-  }) {
+  async createCustomLink(
+    organizationId: string,
+    data: {
+      title: string;
+      description?: string | null;
+      url: string;
+    },
+  ) {
     const maxOrder = await db.trustCustomLink.findFirst({
       where: { organizationId },
       orderBy: { order: 'desc' },
@@ -708,12 +714,16 @@ export class TrustPortalService {
     });
   }
 
-  async updateCustomLink(linkId: string, data: {
-    title?: string;
-    description?: string | null;
-    url?: string;
-    isActive?: boolean;
-  }, organizationId: string) {
+  async updateCustomLink(
+    linkId: string,
+    data: {
+      title?: string;
+      description?: string | null;
+      url?: string;
+      isActive?: boolean;
+    },
+    organizationId: string,
+  ) {
     const link = await db.trustCustomLink.findUnique({
       where: { id: linkId },
     });
@@ -723,7 +733,9 @@ export class TrustPortalService {
     }
 
     if (link.organizationId !== organizationId) {
-      throw new BadRequestException('You can only modify custom links belonging to your organization');
+      throw new BadRequestException(
+        'You can only modify custom links belonging to your organization',
+      );
     }
 
     return db.trustCustomLink.update({
@@ -742,7 +754,9 @@ export class TrustPortalService {
     }
 
     if (link.organizationId !== organizationId) {
-      throw new BadRequestException('You can only delete custom links belonging to your organization');
+      throw new BadRequestException(
+        'You can only delete custom links belonging to your organization',
+      );
     }
 
     await db.trustCustomLink.delete({
@@ -761,7 +775,9 @@ export class TrustPortalService {
     const invalidIds = linkIds.filter((id) => !linkIdSet.has(id));
 
     if (invalidIds.length > 0) {
-      throw new BadRequestException('Some link IDs do not belong to this organization');
+      throw new BadRequestException(
+        'Some link IDs do not belong to this organization',
+      );
     }
 
     await db.$transaction(
@@ -790,10 +806,7 @@ export class TrustPortalService {
         isSubProcessor: true,
         showOnTrustPortal: true,
       },
-      orderBy: [
-        { trustPortalOrder: 'asc' },
-        { name: 'asc' },
-      ],
+      orderBy: [{ trustPortalOrder: 'asc' }, { name: 'asc' }],
       select: {
         id: true,
         name: true,
@@ -805,12 +818,16 @@ export class TrustPortalService {
     });
   }
 
-  async updateVendorTrustSettings(vendorId: string, data: {
-    logoUrl?: string | null;
-    showOnTrustPortal?: boolean;
-    trustPortalOrder?: number | null;
-    complianceBadges?: any;
-  }, organizationId: string) {
+  async updateVendorTrustSettings(
+    vendorId: string,
+    data: {
+      logoUrl?: string | null;
+      showOnTrustPortal?: boolean;
+      trustPortalOrder?: number | null;
+      complianceBadges?: any;
+    },
+    organizationId: string,
+  ) {
     const vendor = await db.vendor.findUnique({
       where: { id: vendorId },
     });
@@ -820,7 +837,9 @@ export class TrustPortalService {
     }
 
     if (vendor.organizationId !== organizationId) {
-      throw new BadRequestException('You can only modify vendors belonging to your organization');
+      throw new BadRequestException(
+        'You can only modify vendors belonging to your organization',
+      );
     }
 
     return db.vendor.update({
diff --git a/apps/app/next.config.ts b/apps/app/next.config.ts
index ab6dc8956..d5fffca64 100644
--- a/apps/app/next.config.ts
+++ b/apps/app/next.config.ts
@@ -48,6 +48,7 @@ const config: NextConfig = {
     '@prisma/client',
     '@trycompai/design-system',
     '@carbon/icons-react',
+    '@comp/company',
   ],
   images: {
     remotePatterns: [
diff --git a/apps/app/package.json b/apps/app/package.json
index 19c7b1f2b..5ab0118ae 100644
--- a/apps/app/package.json
+++ b/apps/app/package.json
@@ -1,191 +1,192 @@
 {
-  "name": "@comp/app",
-  "version": "0.1.0",
-  "type": "module",
-  "dependencies": {
-    "@ai-sdk/anthropic": "^2.0.0",
-    "@ai-sdk/groq": "^2.0.0",
-    "@ai-sdk/openai": "^2.0.80",
-    "@ai-sdk/provider": "^2.0.0",
-    "@ai-sdk/react": "^2.0.60",
-    "@ai-sdk/rsc": "^1.0.0",
-    "@aws-sdk/client-ec2": "^3.911.0",
-    "@aws-sdk/client-lambda": "^3.891.0",
-    "@aws-sdk/client-s3": "^3.859.0",
-    "@aws-sdk/client-sts": "^3.808.0",
-    "@aws-sdk/s3-request-presigner": "^3.859.0",
-    "@azure/core-rest-pipeline": "^1.21.0",
-    "@browserbasehq/sdk": "^2.5.0",
-    "@browserbasehq/stagehand": "^3.0.5",
-    "@calcom/atoms": "^1.0.102-framer",
-    "@calcom/embed-react": "^1.5.3",
-    "@comp/integration-platform": "workspace:*",
-    "@date-fns/tz": "^1.2.0",
-    "@dnd-kit/core": "^6.3.1",
-    "@dnd-kit/modifiers": "^9.0.0",
-    "@dnd-kit/sortable": "^10.0.0",
-    "@dnd-kit/utilities": "^3.2.2",
-    "@dub/analytics": "^0.0.27",
-    "@dub/better-auth": "^0.0.6",
-    "@dub/embed-react": "^0.0.16",
-    "@hookform/resolvers": "^5.1.1",
-    "@mendable/firecrawl-js": "^1.24.0",
-    "@monaco-editor/react": "^4.7.0",
-    "@nangohq/frontend": "^0.53.2",
-    "@next/third-parties": "^15.3.1",
-    "@novu/api": "^1.6.0",
-    "@novu/nextjs": "^3.10.1",
-    "@number-flow/react": "^0.5.9",
-    "@prisma/client": "6.18.0",
-    "@prisma/instrumentation": "6.18.0",
-    "@prisma/nextjs-monorepo-workaround-plugin": "6.18.0",
-    "@radix-ui/react-slot": "^1.2.3",
-    "@react-email/components": "^0.0.41",
-    "@react-email/render": "^1.1.2",
-    "@react-three/drei": "^10.3.0",
-    "@react-three/fiber": "^9.1.2",
-    "@react-three/postprocessing": "^3.0.4",
-    "@t3-oss/env-nextjs": "^0.13.8",
-    "@tanstack/react-form": "^1.23.8",
-    "@tanstack/react-query": "^5.90.7",
-    "@tanstack/react-table": "^8.21.3",
-    "@tiptap/extension-mention": "3.16.0",
-    "@tiptap/extension-table": "3.16.0",
-    "@tiptap/react": "3.16.0",
-    "@trigger.dev/react-hooks": "4.0.6",
-    "@trigger.dev/sdk": "4.0.6",
-    "@trycompai/db": "1.3.22",
-    "@trycompai/design-system": "^1.0.32",
-    "@trycompai/email": "workspace:*",
-    "@types/canvas-confetti": "^1.9.0",
-    "@types/react-syntax-highlighter": "^15.5.13",
-    "@types/three": "^0.180.0",
-    "@uiw/react-json-view": "^2.0.0-alpha.40",
-    "@uploadthing/react": "^7.3.0",
-    "@upstash/ratelimit": "^2.0.5",
-    "@vercel/analytics": "^1.5.0",
-    "@vercel/sandbox": "^0.0.21",
-    "@vercel/sdk": "^1.7.1",
-    "@xyflow/react": "^12.10.0",
-    "ai": "^5.0.108",
-    "ai-elements": "^1.6.1",
-    "axios": "^1.9.0",
-    "better-auth": "^1.3.27",
-    "botid": "^1.5.5",
-    "canvas-confetti": "^1.9.3",
-    "d3": "^7.9.0",
-    "date-fns": "^4.1.0",
-    "diff": "^8.0.2",
-    "dub": "^0.66.1",
-    "framer-motion": "^12.18.1",
-    "geist": "^1.3.1",
-    "jspdf": "^3.0.2",
-    "lucide-react": "^0.544.0",
-    "mammoth": "^1.11.0",
-    "motion": "^12.9.2",
-    "next": "^16.0.10",
-    "next-safe-action": "^8.0.3",
-    "next-themes": "^0.4.4",
-    "nuqs": "^2.4.3",
-    "pdf-parse": "^2.4.5",
-    "playwright-core": "^1.52.0",
-    "posthog-js": "^1.236.6",
-    "posthog-node": "^5.8.2",
-    "prisma": "6.18.0",
-    "puppeteer-core": "^24.7.2",
-    "react": "^19.2.3",
-    "react-dom": "^19.2.3",
-    "react-email": "^4.0.15",
-    "react-hook-form": "^7.61.1",
-    "react-hotkeys-hook": "^5.1.0",
-    "react-intersection-observer": "^9.16.0",
-    "react-markdown": "10.1.0",
-    "react-spinners": "^0.17.0",
-    "react-syntax-highlighter": "^15.6.6",
-    "react-textarea-autosize": "^8.5.9",
-    "react-use-draggable-scroll": "^0.4.7",
-    "react-wrap-balancer": "^1.1.1",
-    "rehype-raw": "^7.0.0",
-    "remark-gfm": "^4.0.1",
-    "remark-parse": "^11.0.0",
-    "resend": "^4.4.1",
-    "sonner": "^2.0.5",
-    "stripe": "^20.0.0",
-    "swr": "^2.3.4",
-    "three": "^0.182.0",
-    "ts-pattern": "^5.7.0",
-    "use-debounce": "^10.0.4",
-    "use-long-press": "^3.3.0",
-    "use-stick-to-bottom": "^1.1.1",
-    "xlsx": "^0.18.5",
-    "xml2js": "^0.6.2",
-    "zaraz-ts": "^1.2.0",
-    "zod": "^4.0.0",
-    "zustand": "^5.0.3"
-  },
-  "devDependencies": {
-    "@playwright/experimental-ct-react": "^1.53.1",
-    "@playwright/test": "^1.53.1",
-    "@tailwindcss/postcss": "^4.1.10",
-    "@testing-library/dom": "^10.4.0",
-    "@testing-library/jest-dom": "^6.6.3",
-    "@testing-library/react": "^16.3.0",
-    "@trigger.dev/build": "4.0.6",
-    "@types/d3": "^7.4.3",
-    "@types/jspdf": "^2.0.0",
-    "@types/node": "^24.0.3",
-    "@vitejs/plugin-react": "^4.6.0",
-    "@vitest/ui": "^3.2.4",
-    "eslint": "^9.18.0",
-    "eslint-config-next": "15.5.2",
-    "fleetctl": "^4.68.1",
-    "glob": "^11.0.3",
-    "jsdom": "^26.1.0",
-    "postcss": "^8.5.4",
-    "raw-loader": "^4.0.2",
-    "tailwindcss": "^4.1.8",
-    "typescript": "^5.8.3",
-    "vite-tsconfig-paths": "^5.1.4",
-    "vitest": "^3.2.4"
-  },
-  "exports": {
-    "./src/lib/encryption": "./src/lib/encryption.ts"
-  },
-  "peerDependencies": {
-    "react": "^19.1.1",
-    "react-dom": "^19.1.0"
-  },
-  "pnpm": {
-    "overrides": {
-      "tiptap-extension-global-drag-handle": "^0.1.18"
+    "name": "@comp/app",
+    "version": "0.1.0",
+    "type": "module",
+    "dependencies": {
+        "@ai-sdk/anthropic": "^2.0.0",
+        "@ai-sdk/groq": "^2.0.0",
+        "@ai-sdk/openai": "^2.0.80",
+        "@ai-sdk/provider": "^2.0.0",
+        "@ai-sdk/react": "^2.0.60",
+        "@ai-sdk/rsc": "^1.0.0",
+        "@aws-sdk/client-ec2": "^3.911.0",
+        "@aws-sdk/client-lambda": "^3.891.0",
+        "@aws-sdk/client-s3": "^3.859.0",
+        "@aws-sdk/client-sts": "^3.808.0",
+        "@aws-sdk/s3-request-presigner": "^3.859.0",
+        "@azure/core-rest-pipeline": "^1.21.0",
+        "@browserbasehq/sdk": "^2.5.0",
+        "@browserbasehq/stagehand": "^3.0.5",
+        "@calcom/atoms": "^1.0.102-framer",
+        "@calcom/embed-react": "^1.5.3",
+        "@comp/company": "workspace:*",
+        "@comp/integration-platform": "workspace:*",
+        "@date-fns/tz": "^1.2.0",
+        "@dnd-kit/core": "^6.3.1",
+        "@dnd-kit/modifiers": "^9.0.0",
+        "@dnd-kit/sortable": "^10.0.0",
+        "@dnd-kit/utilities": "^3.2.2",
+        "@dub/analytics": "^0.0.27",
+        "@dub/better-auth": "^0.0.6",
+        "@dub/embed-react": "^0.0.16",
+        "@hookform/resolvers": "^5.1.1",
+        "@mendable/firecrawl-js": "^1.24.0",
+        "@monaco-editor/react": "^4.7.0",
+        "@nangohq/frontend": "^0.53.2",
+        "@next/third-parties": "^15.3.1",
+        "@novu/api": "^1.6.0",
+        "@novu/nextjs": "^3.10.1",
+        "@number-flow/react": "^0.5.9",
+        "@prisma/client": "6.18.0",
+        "@prisma/instrumentation": "6.18.0",
+        "@prisma/nextjs-monorepo-workaround-plugin": "6.18.0",
+        "@radix-ui/react-slot": "^1.2.3",
+        "@react-email/components": "^0.0.41",
+        "@react-email/render": "^1.1.2",
+        "@react-three/drei": "^10.3.0",
+        "@react-three/fiber": "^9.1.2",
+        "@react-three/postprocessing": "^3.0.4",
+        "@t3-oss/env-nextjs": "^0.13.8",
+        "@tanstack/react-form": "^1.23.8",
+        "@tanstack/react-query": "^5.90.7",
+        "@tanstack/react-table": "^8.21.3",
+        "@tiptap/extension-mention": "3.16.0",
+        "@tiptap/extension-table": "3.16.0",
+        "@tiptap/react": "3.16.0",
+        "@trigger.dev/react-hooks": "4.0.6",
+        "@trigger.dev/sdk": "4.0.6",
+        "@trycompai/db": "1.3.22",
+        "@trycompai/design-system": "^1.0.32",
+        "@trycompai/email": "workspace:*",
+        "@types/canvas-confetti": "^1.9.0",
+        "@types/react-syntax-highlighter": "^15.5.13",
+        "@types/three": "^0.180.0",
+        "@uiw/react-json-view": "^2.0.0-alpha.40",
+        "@uploadthing/react": "^7.3.0",
+        "@upstash/ratelimit": "^2.0.5",
+        "@vercel/analytics": "^1.5.0",
+        "@vercel/sandbox": "^0.0.21",
+        "@vercel/sdk": "^1.7.1",
+        "@xyflow/react": "^12.10.0",
+        "ai": "^5.0.108",
+        "ai-elements": "^1.6.1",
+        "axios": "^1.9.0",
+        "better-auth": "^1.3.27",
+        "botid": "^1.5.5",
+        "canvas-confetti": "^1.9.3",
+        "d3": "^7.9.0",
+        "date-fns": "^4.1.0",
+        "diff": "^8.0.2",
+        "dub": "^0.66.1",
+        "framer-motion": "^12.18.1",
+        "geist": "^1.3.1",
+        "jspdf": "^3.0.2",
+        "lucide-react": "^0.544.0",
+        "mammoth": "^1.11.0",
+        "motion": "^12.9.2",
+        "next": "^16.0.10",
+        "next-safe-action": "^8.0.3",
+        "next-themes": "^0.4.4",
+        "nuqs": "^2.4.3",
+        "pdf-parse": "^2.4.5",
+        "playwright-core": "^1.52.0",
+        "posthog-js": "^1.236.6",
+        "posthog-node": "^5.8.2",
+        "prisma": "6.18.0",
+        "puppeteer-core": "^24.7.2",
+        "react": "^19.2.3",
+        "react-dom": "^19.2.3",
+        "react-email": "^4.0.15",
+        "react-hook-form": "^7.61.1",
+        "react-hotkeys-hook": "^5.1.0",
+        "react-intersection-observer": "^9.16.0",
+        "react-markdown": "10.1.0",
+        "react-spinners": "^0.17.0",
+        "react-syntax-highlighter": "^15.6.6",
+        "react-textarea-autosize": "^8.5.9",
+        "react-use-draggable-scroll": "^0.4.7",
+        "react-wrap-balancer": "^1.1.1",
+        "rehype-raw": "^7.0.0",
+        "remark-gfm": "^4.0.1",
+        "remark-parse": "^11.0.0",
+        "resend": "^4.4.1",
+        "sonner": "^2.0.5",
+        "stripe": "^20.0.0",
+        "swr": "^2.3.4",
+        "three": "^0.182.0",
+        "ts-pattern": "^5.7.0",
+        "use-debounce": "^10.0.4",
+        "use-long-press": "^3.3.0",
+        "use-stick-to-bottom": "^1.1.1",
+        "xlsx": "^0.18.5",
+        "xml2js": "^0.6.2",
+        "zaraz-ts": "^1.2.0",
+        "zod": "^4.0.0",
+        "zustand": "^5.0.3"
+    },
+    "devDependencies": {
+        "@playwright/experimental-ct-react": "^1.53.1",
+        "@playwright/test": "^1.53.1",
+        "@tailwindcss/postcss": "^4.1.10",
+        "@testing-library/dom": "^10.4.0",
+        "@testing-library/jest-dom": "^6.6.3",
+        "@testing-library/react": "^16.3.0",
+        "@trigger.dev/build": "4.0.6",
+        "@types/d3": "^7.4.3",
+        "@types/jspdf": "^2.0.0",
+        "@types/node": "^24.0.3",
+        "@vitejs/plugin-react": "^4.6.0",
+        "@vitest/ui": "^3.2.4",
+        "eslint": "^9.18.0",
+        "eslint-config-next": "15.5.2",
+        "fleetctl": "^4.68.1",
+        "glob": "^11.0.3",
+        "jsdom": "^26.1.0",
+        "postcss": "^8.5.4",
+        "raw-loader": "^4.0.2",
+        "tailwindcss": "^4.1.8",
+        "typescript": "^5.8.3",
+        "vite-tsconfig-paths": "^5.1.4",
+        "vitest": "^3.2.4"
+    },
+    "exports": {
+        "./src/lib/encryption": "./src/lib/encryption.ts"
+    },
+    "peerDependencies": {
+        "react": "^19.1.1",
+        "react-dom": "^19.1.0"
+    },
+    "pnpm": {
+        "overrides": {
+            "tiptap-extension-global-drag-handle": "^0.1.18"
+        }
+    },
+    "private": true,
+    "scripts": {
+        "analyze-locale-usage": "bunx tsx src/locales/analyze-locale-usage.ts",
+        "build": "next build",
+        "build:docker": "prisma generate && next build",
+        "db:generate": "bun run db:getschema && prisma generate",
+        "db:getschema": "node ../../packages/db/scripts/combine-schemas.js && cp ../../packages/db/dist/schema.prisma prisma/schema.prisma",
+        "db:migrate": "cd ../../packages/db && bunx prisma migrate dev && cd ../../apps/app",
+        "deploy:trigger-prod": "npx trigger.dev@4.0.6 deploy",
+        "dev": "bun i && bunx concurrently --kill-others --names \"next,trigger\" --prefix-colors \"yellow,blue\" \"next dev --turbo -p 3000\" \"bunx trigger.dev@4.0.6 dev\"",
+        "lint": "eslint . && prettier --check .",
+        "prebuild": "bun run db:generate",
+        "postinstall": "prisma generate --schema=./prisma/schema.prisma || exit 0",
+        "start": "next start",
+        "test": "vitest",
+        "test:all": "./scripts/test-all.sh",
+        "test:coverage": "vitest run --coverage",
+        "test:e2e": "playwright test",
+        "test:e2e:debug": "playwright test --debug",
+        "test:e2e:headed": "playwright test --headed",
+        "test:e2e:install": "playwright install --with-deps",
+        "test:e2e:report": "playwright show-report",
+        "test:e2e:setup": "./scripts/setup-e2e.sh",
+        "test:e2e:ui": "playwright test --ui",
+        "test:ui": "vitest --ui",
+        "test:watch": "vitest --watch",
+        "typecheck": "tsc --noEmit"
     }
-  },
-  "private": true,
-  "scripts": {
-    "analyze-locale-usage": "bunx tsx src/locales/analyze-locale-usage.ts",
-    "build": "next build",
-    "build:docker": "prisma generate && next build",
-    "db:generate": "bun run db:getschema && prisma generate",
-    "db:getschema": "node ../../packages/db/scripts/combine-schemas.js && cp ../../packages/db/dist/schema.prisma prisma/schema.prisma",
-    "db:migrate": "cd ../../packages/db && bunx prisma migrate dev && cd ../../apps/app",
-    "deploy:trigger-prod": "npx trigger.dev@4.0.6 deploy",
-    "dev": "bun i && bunx concurrently --kill-others --names \"next,trigger\" --prefix-colors \"yellow,blue\" \"next dev --turbo -p 3000\" \"bunx trigger.dev@4.0.6 dev\"",
-    "lint": "eslint . && prettier --check .",
-    "prebuild": "bun run db:generate",
-    "postinstall": "prisma generate --schema=./prisma/schema.prisma || exit 0",
-    "start": "next start",
-    "test": "vitest",
-    "test:all": "./scripts/test-all.sh",
-    "test:coverage": "vitest run --coverage",
-    "test:e2e": "playwright test",
-    "test:e2e:debug": "playwright test --debug",
-    "test:e2e:headed": "playwright test --headed",
-    "test:e2e:install": "playwright install --with-deps",
-    "test:e2e:report": "playwright show-report",
-    "test:e2e:setup": "./scripts/setup-e2e.sh",
-    "test:e2e:ui": "playwright test --ui",
-    "test:ui": "vitest --ui",
-    "test:watch": "vitest --watch",
-    "typecheck": "tsc --noEmit"
-  }
-}
\ No newline at end of file
+}
diff --git a/apps/app/src/actions/organization/update-organization-access-request-form-action.ts b/apps/app/src/actions/organization/update-organization-access-request-form-action.ts
new file mode 100644
index 000000000..adfd12e7a
--- /dev/null
+++ b/apps/app/src/actions/organization/update-organization-access-request-form-action.ts
@@ -0,0 +1,46 @@
+'use server';
+
+import { db } from '@db';
+import { revalidatePath, revalidateTag } from 'next/cache';
+import { headers } from 'next/headers';
+import { authActionClient } from '../safe-action';
+import { organizationAccessRequestFormSchema } from '../schema';
+
+export const updateOrganizationAccessRequestFormAction = authActionClient
+  .inputSchema(organizationAccessRequestFormSchema)
+  .metadata({
+    name: 'update-organization-access-request-form',
+    track: {
+      event: 'update-organization-access-request-form',
+      channel: 'server',
+    },
+  })
+  .action(async ({ parsedInput, ctx }) => {
+    const { accessRequestFormEnabled } = parsedInput;
+    const { activeOrganizationId } = ctx.session;
+
+    if (!activeOrganizationId) {
+      throw new Error('No active organization');
+    }
+
+    try {
+      await db.organization.update({
+        where: { id: activeOrganizationId },
+        data: { accessRequestFormEnabled },
+      });
+
+      const headersList = await headers();
+      let path = headersList.get('x-pathname') || headersList.get('referer') || '';
+      path = path.replace(/\/[a-z]{2}\//, '/');
+
+      revalidatePath(path);
+      revalidateTag(`organization_${activeOrganizationId}`, 'max');
+
+      return {
+        success: true,
+      };
+    } catch (error) {
+      console.error(error);
+      throw new Error('Failed to update access request form setting');
+    }
+  });
diff --git a/apps/app/src/actions/organization/update-organization-whistleblower-report-action.ts b/apps/app/src/actions/organization/update-organization-whistleblower-report-action.ts
new file mode 100644
index 000000000..e01cceb2c
--- /dev/null
+++ b/apps/app/src/actions/organization/update-organization-whistleblower-report-action.ts
@@ -0,0 +1,46 @@
+'use server';
+
+import { db } from '@db';
+import { revalidatePath, revalidateTag } from 'next/cache';
+import { headers } from 'next/headers';
+import { authActionClient } from '../safe-action';
+import { organizationWhistleblowerReportSchema } from '../schema';
+
+export const updateOrganizationWhistleblowerReportAction = authActionClient
+  .inputSchema(organizationWhistleblowerReportSchema)
+  .metadata({
+    name: 'update-organization-whistleblower-report',
+    track: {
+      event: 'update-organization-whistleblower-report',
+      channel: 'server',
+    },
+  })
+  .action(async ({ parsedInput, ctx }) => {
+    const { whistleblowerReportEnabled } = parsedInput;
+    const { activeOrganizationId } = ctx.session;
+
+    if (!activeOrganizationId) {
+      throw new Error('No active organization');
+    }
+
+    try {
+      await db.organization.update({
+        where: { id: activeOrganizationId },
+        data: { whistleblowerReportEnabled },
+      });
+
+      const headersList = await headers();
+      let path = headersList.get('x-pathname') || headersList.get('referer') || '';
+      path = path.replace(/\/[a-z]{2}\//, '/');
+
+      revalidatePath(path);
+      revalidateTag(`organization_${activeOrganizationId}`, 'max');
+
+      return {
+        success: true,
+      };
+    } catch (error) {
+      console.error(error);
+      throw new Error('Failed to update whistleblower report setting');
+    }
+  });
diff --git a/apps/app/src/actions/schema.ts b/apps/app/src/actions/schema.ts
index 3f7034ce6..9a91c755f 100644
--- a/apps/app/src/actions/schema.ts
+++ b/apps/app/src/actions/schema.ts
@@ -77,6 +77,14 @@ export const organizationSecurityTrainingStepSchema = z.object({
   securityTrainingStepEnabled: z.boolean(),
 });
 
+export const organizationWhistleblowerReportSchema = z.object({
+  whistleblowerReportEnabled: z.boolean(),
+});
+
+export const organizationAccessRequestFormSchema = z.object({
+  accessRequestFormEnabled: z.boolean(),
+});
+
 // Risks
 export const createRiskSchema = z.object({
   title: z
diff --git a/apps/app/src/app/(app)/[orgId]/components/AppShellWrapper.tsx b/apps/app/src/app/(app)/[orgId]/components/AppShellWrapper.tsx
index 3b57abb8c..2833f0fc7 100644
--- a/apps/app/src/app/(app)/[orgId]/components/AppShellWrapper.tsx
+++ b/apps/app/src/app/(app)/[orgId]/components/AppShellWrapper.tsx
@@ -243,7 +243,13 @@ function AppShellWrapperContent({
         <AppShellMain>
           <AppShellSidebar collapsible>
             <AppShellSidebarHeader
-              title={isSettingsActive ? 'Settings' : isTrustActive ? 'Trust' : 'Compliance'}
+              title={
+                isSettingsActive
+                  ? 'Settings'
+                  : isTrustActive
+                    ? 'Trust'
+                    : 'Compliance'
+              }
             />
             {isSettingsActive ? (
               <SettingsSidebar orgId={organization.id} showBrowserTab={isWebAutomationsEnabled} />
diff --git a/apps/app/src/app/(app)/[orgId]/components/AppSidebar.tsx b/apps/app/src/app/(app)/[orgId]/components/AppSidebar.tsx
index d5b58307f..f92cfeb30 100644
--- a/apps/app/src/app/(app)/[orgId]/components/AppSidebar.tsx
+++ b/apps/app/src/app/(app)/[orgId]/components/AppSidebar.tsx
@@ -1,6 +1,7 @@
 'use client';
 
 import {
+  Catalog,
   Chemistry,
   Dashboard,
   Document,
@@ -74,6 +75,12 @@ export function AppSidebar({
       name: 'Evidence',
       icon: <ListChecked className="size-4" />,
     },
+    {
+      id: 'documents',
+      path: `/${organization.id}/documents`,
+      name: 'Documents',
+      icon: <Catalog className="size-4" />,
+    },
     {
       id: 'people',
       path: `/${organization.id}/people/all`,
diff --git a/apps/app/src/app/(app)/[orgId]/components/app-shell-search-groups.tsx b/apps/app/src/app/(app)/[orgId]/components/app-shell-search-groups.tsx
index 5d260829b..ad944cf2d 100644
--- a/apps/app/src/app/(app)/[orgId]/components/app-shell-search-groups.tsx
+++ b/apps/app/src/app/(app)/[orgId]/components/app-shell-search-groups.tsx
@@ -1,4 +1,5 @@
 import {
+  Catalog,
   Chemistry,
   Dashboard,
   Document,
@@ -124,6 +125,14 @@ export const getAppShellSearchGroups = ({
           }),
         ]
       : []),
+    createNavItem({
+      id: 'documents',
+      label: 'Documents',
+      icon: <Catalog size={16} />,
+      path: `/${organizationId}/documents`,
+      keywords: ['company', 'tasks', 'forms', 'evidence submissions', 'documents'],
+      router,
+    }),
     createNavItem({
       id: 'people',
       label: 'People',
diff --git a/apps/app/src/app/(app)/[orgId]/documents/[formType]/new/page.tsx b/apps/app/src/app/(app)/[orgId]/documents/[formType]/new/page.tsx
new file mode 100644
index 000000000..eec663891
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/documents/[formType]/new/page.tsx
@@ -0,0 +1,49 @@
+import { CompanySubmissionWizard } from '@/app/(app)/[orgId]/documents/components/CompanySubmissionWizard';
+import { conciseFormDescriptions } from '@/app/(app)/[orgId]/documents/form-descriptions';
+import { Breadcrumb, PageHeader, PageLayout, Text } from '@trycompai/design-system';
+import Link from 'next/link';
+import { notFound } from 'next/navigation';
+import { evidenceFormDefinitions, evidenceFormTypeSchema } from '../../forms';
+
+export default async function NewCompanySubmissionPage({
+  params,
+}: {
+  params: Promise<{ orgId: string; formType: string }>;
+}) {
+  const { orgId, formType } = await params;
+  const parsedType = evidenceFormTypeSchema.safeParse(formType);
+
+  if (!parsedType.success) {
+    notFound();
+  }
+
+  const parsedFormType = parsedType.data;
+  const formDefinition = evidenceFormDefinitions[parsedFormType];
+
+  return (
+    <PageLayout>
+      <Breadcrumb
+        items={[
+          {
+            label: 'Documents',
+            href: `/${orgId}/documents`,
+            props: { render: <Link href={`/${orgId}/documents`} /> },
+          },
+          {
+            label: formDefinition.title,
+            href: `/${orgId}/documents/${parsedFormType}`,
+            props: { render: <Link href={`/${orgId}/documents/${parsedFormType}`} /> },
+          },
+          { label: 'New Submission', isCurrent: true },
+        ]}
+      />
+      <PageHeader title={`New ${formDefinition.title} Submission`} />
+      <div className="space-y-6">
+        <Text variant="muted">
+          {conciseFormDescriptions[parsedFormType] ?? formDefinition.description}
+        </Text>
+        <CompanySubmissionWizard organizationId={orgId} formType={parsedFormType} />
+      </div>
+    </PageLayout>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/documents/[formType]/page.tsx b/apps/app/src/app/(app)/[orgId]/documents/[formType]/page.tsx
new file mode 100644
index 000000000..f1651d3c6
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/documents/[formType]/page.tsx
@@ -0,0 +1,36 @@
+import { CompanyFormPageClient } from '@/app/(app)/[orgId]/documents/components/CompanyFormPageClient';
+import { Breadcrumb, PageLayout } from '@trycompai/design-system';
+import Link from 'next/link';
+import { notFound } from 'next/navigation';
+import { evidenceFormDefinitions, evidenceFormTypeSchema } from '../forms';
+
+export default async function CompanyFormDetailPage({
+  params,
+}: {
+  params: Promise<{ orgId: string; formType: string }>;
+}) {
+  const { orgId, formType } = await params;
+  const parsedType = evidenceFormTypeSchema.safeParse(formType);
+
+  if (!parsedType.success) {
+    notFound();
+  }
+
+  const formDefinition = evidenceFormDefinitions[parsedType.data];
+
+  return (
+    <PageLayout>
+      <Breadcrumb
+        items={[
+          {
+            label: 'Documents',
+            href: `/${orgId}/documents`,
+            props: { render: <Link href={`/${orgId}/documents`} /> },
+          },
+          { label: formDefinition.title, isCurrent: true },
+        ]}
+      />
+      <CompanyFormPageClient organizationId={orgId} formType={parsedType.data} />
+    </PageLayout>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/documents/[formType]/submissions/[submissionId]/page.tsx b/apps/app/src/app/(app)/[orgId]/documents/[formType]/submissions/[submissionId]/page.tsx
new file mode 100644
index 000000000..60c26ddf1
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/documents/[formType]/submissions/[submissionId]/page.tsx
@@ -0,0 +1,63 @@
+import { CompanySubmissionDetailPageClient } from '@/app/(app)/[orgId]/documents/components/CompanySubmissionDetailPageClient';
+import { auth } from '@/utils/auth';
+import { db } from '@db';
+import { Breadcrumb, PageHeader, PageLayout } from '@trycompai/design-system';
+import { headers } from 'next/headers';
+import Link from 'next/link';
+import { notFound } from 'next/navigation';
+import { evidenceFormDefinitions, evidenceFormTypeSchema } from '../../../forms';
+
+export default async function CompanySubmissionDetailPage({
+  params,
+}: {
+  params: Promise<{ orgId: string; formType: string; submissionId: string }>;
+}) {
+  const { orgId, formType, submissionId } = await params;
+  const parsedType = evidenceFormTypeSchema.safeParse(formType);
+
+  if (!parsedType.success) {
+    notFound();
+  }
+
+  const parsedFormType = parsedType.data;
+  const formDefinition = evidenceFormDefinitions[parsedFormType];
+  const session = await auth.api.getSession({
+    headers: await headers(),
+  });
+
+  let isPlatformAdmin = false;
+  if (session?.user?.id) {
+    const user = await db.user.findUnique({
+      where: { id: session.user.id },
+      select: { isPlatformAdmin: true },
+    });
+    isPlatformAdmin = user?.isPlatformAdmin ?? false;
+  }
+
+  return (
+    <PageLayout>
+      <Breadcrumb
+        items={[
+          {
+            label: 'Documents',
+            href: `/${orgId}/documents`,
+            props: { render: <Link href={`/${orgId}/documents`} /> },
+          },
+          {
+            label: formDefinition.title,
+            href: `/${orgId}/documents/${parsedFormType}`,
+            props: { render: <Link href={`/${orgId}/documents/${parsedFormType}`} /> },
+          },
+          { label: 'Submission Details', isCurrent: true },
+        ]}
+      />
+      <PageHeader title={`${formDefinition.title} Submission`} />
+      <CompanySubmissionDetailPageClient
+        organizationId={orgId}
+        formType={parsedFormType}
+        submissionId={submissionId}
+        isPlatformAdmin={isPlatformAdmin}
+      />
+    </PageLayout>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/documents/components/CompanyFormPageClient.tsx b/apps/app/src/app/(app)/[orgId]/documents/components/CompanyFormPageClient.tsx
new file mode 100644
index 000000000..dafe1db6e
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/documents/components/CompanyFormPageClient.tsx
@@ -0,0 +1,300 @@
+'use client';
+
+import {
+  evidenceFormDefinitions,
+  type EvidenceFormType,
+} from '@/app/(app)/[orgId]/documents/forms';
+import { conciseFormDescriptions } from '@/app/(app)/[orgId]/documents/form-descriptions';
+import { api } from '@/lib/api-client';
+import { jwtManager } from '@/utils/jwt-manager';
+import {
+  Button,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyMedia,
+  EmptyTitle,
+  InputGroup,
+  InputGroupAddon,
+  InputGroupInput,
+  PageHeader,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+  Text,
+} from '@trycompai/design-system';
+import { Add, Catalog, Download, Search } from '@trycompai/design-system/icons';
+import Link from 'next/link';
+import { useRouter } from 'next/navigation';
+import { useState } from 'react';
+import { toast } from 'sonner';
+import useSWR from 'swr';
+import { StatusBadge, formatSubmissionDate } from './submission-utils';
+
+// ─── Types ───────────────────────────────────────────────────
+
+type EvidenceSubmissionRow = {
+  id: string;
+  submittedAt: string;
+  status: string;
+  data: Record<string, unknown>;
+  submittedBy?: {
+    name: string | null;
+    email: string;
+  } | null;
+};
+
+type EvidenceFormResponse = {
+  form: (typeof evidenceFormDefinitions)[EvidenceFormType];
+  submissions: EvidenceSubmissionRow[];
+  total: number;
+};
+
+const submissionDateColumnWidth = 128;
+const submittedByColumnWidth = 128;
+const statusColumnWidth = 176;
+const summaryColumnWidth = 280;
+
+// ─── Helpers ─────────────────────────────────────────────────
+
+function truncate(str: string, max: number) {
+  if (str.length <= max) return str;
+  return `${str.slice(0, max)}…`;
+}
+
+function getMatrixRowCount(value: unknown): number {
+  if (!Array.isArray(value)) return 0;
+  return value.filter((row) => row && typeof row === 'object').length;
+}
+
+// ─── Main Component ──────────────────────────────────────────
+
+export function CompanyFormPageClient({
+  organizationId,
+  formType,
+}: {
+  organizationId: string;
+  formType: EvidenceFormType;
+}) {
+  const router = useRouter();
+  const [search, setSearch] = useState('');
+  const [isExporting, setIsExporting] = useState(false);
+
+  const formDefinition = evidenceFormDefinitions[formType];
+  const summaryField = formDefinition.fields.find((field) => field.type === 'textarea');
+  const matrixSummaryField = formDefinition.fields.find((field) => field.type === 'matrix');
+  const hasMatrixSummary = Boolean(matrixSummaryField);
+  const showSummaryColumn = Boolean(summaryField) || hasMatrixSummary;
+
+  const query = search.trim() ? `?search=${encodeURIComponent(search.trim())}` : '';
+  const swrKey: readonly [string, string] = [
+    `/v1/evidence-forms/${formType}${query}`,
+    organizationId,
+  ];
+
+  const { data, isLoading } = useSWR<EvidenceFormResponse>(
+    swrKey,
+    async ([endpoint, orgId]: readonly [string, string]) => {
+      const response = await api.get<EvidenceFormResponse>(endpoint, orgId);
+      if (response.error || !response.data) {
+        throw new Error(response.error ?? 'Failed to load evidence form submissions');
+      }
+      return response.data;
+    },
+  );
+
+  const handleExportCsv = async () => {
+    if (!data || data.total === 0) {
+      toast.error('No submissions available to export');
+      return;
+    }
+
+    setIsExporting(true);
+    try {
+      const token = await jwtManager.getValidToken();
+      if (!token) {
+        throw new Error('Authentication failed');
+      }
+
+      const response = await fetch(
+        `${process.env.NEXT_PUBLIC_API_URL ?? 'http://localhost:3333'}/v1/evidence-forms/${formType}/export.csv`,
+        {
+          method: 'GET',
+          headers: {
+            Authorization: `Bearer ${token}`,
+            'X-Organization-Id': organizationId,
+          },
+          credentials: 'include',
+        },
+      );
+
+      if (!response.ok) {
+        throw new Error(await response.text());
+      }
+
+      const blob = await response.blob();
+      const url = URL.createObjectURL(blob);
+      const anchor = document.createElement('a');
+      anchor.href = url;
+      anchor.download = `${formType}-submissions.csv`;
+      document.body.appendChild(anchor);
+      anchor.click();
+      document.body.removeChild(anchor);
+      URL.revokeObjectURL(url);
+    } catch (error) {
+      toast.error(error instanceof Error ? error.message : 'CSV export failed');
+    } finally {
+      setIsExporting(false);
+    }
+  };
+
+  return (
+    <div className="space-y-6">
+      <PageHeader
+        title={formDefinition.title}
+        actions={
+          <div className="flex items-center gap-2">
+            <Link href={`/${organizationId}/documents/${formType}/new`}>
+              <Button iconLeft={<Add size={16} />}>New Submission</Button>
+            </Link>
+            <Button
+              type="button"
+              variant="secondary"
+              iconLeft={<Download size={16} />}
+              onClick={handleExportCsv}
+              disabled={isExporting}
+            >
+              {isExporting ? 'Exporting...' : 'Export CSV'}
+            </Button>
+          </div>
+        }
+      />
+      <div className="line-clamp-1">
+        <Text variant="muted">
+          {conciseFormDescriptions[formType] ?? formDefinition.description}
+        </Text>
+      </div>
+
+      {/* ─── Submissions List ─── */}
+      <div className="space-y-3">
+        <div className="w-full md:max-w-[300px]">
+          <InputGroup>
+            <InputGroupAddon>
+              <Search size={16} />
+            </InputGroupAddon>
+            <InputGroupInput
+              placeholder="Search submissions..."
+              value={search}
+              onChange={(event) => setSearch(event.target.value)}
+            />
+          </InputGroup>
+        </div>
+
+        {isLoading ? (
+          <Empty>
+            <EmptyMedia variant="icon">
+              <Catalog />
+            </EmptyMedia>
+            <EmptyHeader>
+              <EmptyTitle>No submissions yet.</EmptyTitle>
+              <EmptyDescription>
+                Start by creating a new submission, click the New Submission button above.
+              </EmptyDescription>
+            </EmptyHeader>
+          </Empty>
+        ) : !data || data.submissions.length === 0 ? (
+          <Empty>
+            <EmptyMedia variant="icon">
+              <Catalog />
+            </EmptyMedia>
+            <EmptyHeader>
+              <EmptyTitle>No submissions yet</EmptyTitle>
+              <EmptyDescription>
+                Start by creating a new submission, click the New Submission button above.
+              </EmptyDescription>
+            </EmptyHeader>
+          </Empty>
+        ) : (
+          <Table variant="bordered" style={{ tableLayout: 'fixed' }}>
+            <colgroup>
+              <col style={{ width: submissionDateColumnWidth }} />
+              <col style={{ width: submittedByColumnWidth }} />
+              {formType === 'access-request' && <col style={{ width: statusColumnWidth }} />}
+              {showSummaryColumn && <col style={{ width: summaryColumnWidth }} />}
+            </colgroup>
+            <TableHeader>
+              <TableRow>
+                <TableHead>
+                  <div className="whitespace-nowrap">Submission Date</div>
+                </TableHead>
+                <TableHead>
+                  <div className="whitespace-nowrap">Submitted By</div>
+                </TableHead>
+                {formType === 'access-request' && (
+                  <TableHead>
+                    <div className="whitespace-nowrap">Status</div>
+                  </TableHead>
+                )}
+                {showSummaryColumn && <TableHead>Summary</TableHead>}
+              </TableRow>
+            </TableHeader>
+            <TableBody>
+              {data.submissions.map((submission) => {
+                const summaryValue = summaryField
+                  ? String(submission.data[summaryField.key] ?? '')
+                  : '';
+                const matrixSummary = matrixSummaryField
+                  ? `${getMatrixRowCount(submission.data[matrixSummaryField.key])} row(s)`
+                  : '';
+                const rowSummary = summaryField ? truncate(summaryValue, 80) : matrixSummary;
+
+                return (
+                  <TableRow
+                    key={submission.id}
+                    onClick={() =>
+                      router.push(
+                        `/${organizationId}/documents/${formType}/submissions/${submission.id}`,
+                      )
+                    }
+                    style={{ cursor: 'pointer' }}
+                  >
+                    <TableCell>
+                      <div className="whitespace-nowrap">
+                        {formatSubmissionDate(
+                          submission.data.submissionDate,
+                          submission.submittedAt,
+                        )}
+                      </div>
+                    </TableCell>
+                    <TableCell>
+                      <span className="block truncate">
+                        {submission.submittedBy?.name ?? submission.submittedBy?.email ?? 'Unknown'}
+                      </span>
+                    </TableCell>
+                    {formType === 'access-request' && (
+                      <TableCell>
+                        <div>
+                          <StatusBadge status={submission.status} />
+                        </div>
+                      </TableCell>
+                    )}
+                    {showSummaryColumn && (
+                      <TableCell>
+                        <span className="block truncate text-muted-foreground">
+                          {rowSummary || '—'}
+                        </span>
+                      </TableCell>
+                    )}
+                  </TableRow>
+                );
+              })}
+            </TableBody>
+          </Table>
+        )}
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/documents/components/CompanyOverviewCards.tsx b/apps/app/src/app/(app)/[orgId]/documents/components/CompanyOverviewCards.tsx
new file mode 100644
index 000000000..50e791e14
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/documents/components/CompanyOverviewCards.tsx
@@ -0,0 +1,101 @@
+'use client';
+
+import { conciseFormDescriptions } from '@/app/(app)/[orgId]/documents/form-descriptions';
+import { api } from '@/lib/api-client';
+import {
+  Badge,
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Stack,
+  Text,
+} from '@trycompai/design-system';
+import Link from 'next/link';
+import useSWR from 'swr';
+import { evidenceFormDefinitionList } from '../forms';
+
+type FormStatuses = Record<string, { lastSubmittedAt: string | null }>;
+
+const SIX_MONTHS_MS = 6 * 30 * 24 * 60 * 60 * 1000;
+
+function isTodo(lastSubmittedAt: string | null): boolean {
+  if (!lastSubmittedAt) return true;
+  const elapsed = Date.now() - new Date(lastSubmittedAt).getTime();
+  return elapsed > SIX_MONTHS_MS;
+}
+
+export function CompanyOverviewCards({ organizationId }: { organizationId: string }) {
+  const swrKey: readonly [string, string] = ['/v1/evidence-forms/statuses', organizationId];
+
+  const { data: statuses } = useSWR<FormStatuses>(
+    swrKey,
+    async ([endpoint, orgId]: readonly [string, string]) => {
+      const response = await api.get<FormStatuses>(endpoint, orgId);
+      if (response.error || !response.data) {
+        throw new Error(response.error ?? 'Failed to load form statuses');
+      }
+      return response.data;
+    },
+  );
+
+  // Group forms by category
+  const categories = new Map<string, typeof evidenceFormDefinitionList>();
+  for (const form of evidenceFormDefinitionList) {
+    const cat = form.category;
+    if (!categories.has(cat)) {
+      categories.set(cat, []);
+    }
+    categories.get(cat)!.push(form);
+  }
+
+  return (
+    <Stack gap="6">
+      {Array.from(categories.entries()).map(([category, forms]) => (
+        <div key={category} className="space-y-3">
+          <div className="flex items-center gap-2">
+            <Text size="lg" weight="semibold">
+              {category}
+            </Text>
+            <Badge variant="secondary">{forms.length}</Badge>
+          </div>
+          <div className="grid gap-4 lg:grid-cols-2">
+            {forms.map((form) => {
+              const status = statuses?.[form.type];
+              const showTodo = statuses ? isTodo(status?.lastSubmittedAt ?? null) : false;
+
+              return (
+                <Link key={form.type} href={`/${organizationId}/documents/${form.type}`}>
+                  <Card>
+                    <CardHeader>
+                      <CardTitle>{form.title}</CardTitle>
+                      <div className="line-clamp-1">
+                        <CardDescription>
+                          {conciseFormDescriptions[form.type] ?? form.description}
+                        </CardDescription>
+                      </div>
+                    </CardHeader>
+                    <CardContent>
+                      {statuses ? (
+                        showTodo ? (
+                          <Badge variant="outline">TODO</Badge>
+                        ) : (
+                          <Badge variant="secondary">Complete</Badge>
+                        )
+                      ) : (
+                        <Text size="xs" variant="muted">
+                          {form.fields.length} fields
+                        </Text>
+                      )}
+                    </CardContent>
+                  </Card>
+                </Link>
+              );
+            })}
+          </div>
+        </div>
+      ))}
+    </Stack>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/documents/components/CompanySidebar.tsx b/apps/app/src/app/(app)/[orgId]/documents/components/CompanySidebar.tsx
new file mode 100644
index 000000000..1ff6f77f0
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/documents/components/CompanySidebar.tsx
@@ -0,0 +1,56 @@
+'use client';
+
+import { AppShellNav, AppShellNavItem } from '@trycompai/design-system';
+import Link from 'next/link';
+import { usePathname } from 'next/navigation';
+import { evidenceFormDefinitionList } from '../forms';
+
+interface CompanySidebarProps {
+  orgId: string;
+}
+
+export function CompanySidebar({ orgId }: CompanySidebarProps) {
+  const pathname = usePathname() ?? '';
+
+  const isPathActive = (path: string) => {
+    if (path === `/${orgId}/documents`) {
+      return pathname === path;
+    }
+    return pathname.startsWith(path);
+  };
+
+  // Group forms by category preserving insertion order
+  const categories = new Map<string, Array<{ id: string; label: string; path: string }>>();
+  for (const form of evidenceFormDefinitionList) {
+    const cat = form.category;
+    if (!categories.has(cat)) {
+      categories.set(cat, []);
+    }
+    categories.get(cat)!.push({
+      id: form.type,
+      label: form.title,
+      path: `/${orgId}/documents/${form.type}`,
+    });
+  }
+
+  return (
+    <AppShellNav>
+      <Link href={`/${orgId}/documents`}>
+        <AppShellNavItem isActive={isPathActive(`/${orgId}/documents`)}>Overview</AppShellNavItem>
+      </Link>
+
+      {Array.from(categories.entries()).map(([category, items]) => (
+        <div key={category} className="mt-4">
+          <div className="mb-1 px-3 text-xs font-medium uppercase tracking-wider text-muted-foreground">
+            {category}
+          </div>
+          {items.map((item) => (
+            <Link key={item.id} href={item.path}>
+              <AppShellNavItem isActive={isPathActive(item.path)}>{item.label}</AppShellNavItem>
+            </Link>
+          ))}
+        </div>
+      ))}
+    </AppShellNav>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionDetailPageClient.tsx b/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionDetailPageClient.tsx
new file mode 100644
index 000000000..88e964bc5
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionDetailPageClient.tsx
@@ -0,0 +1,370 @@
+'use client';
+
+import {
+  evidenceFormDefinitions,
+  type EvidenceFormType,
+} from '@/app/(app)/[orgId]/documents/forms';
+import { api } from '@/lib/api-client';
+import { useActiveMember } from '@/utils/auth-client';
+import {
+  Button,
+  Empty,
+  EmptyMedia,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  Field,
+  FieldLabel,
+  Section,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+  Text,
+  Textarea,
+} from '@trycompai/design-system';
+import { Document } from '@trycompai/design-system/icons';
+import { useState } from 'react';
+import ReactMarkdown from 'react-markdown';
+import remarkGfm from 'remark-gfm';
+import { toast } from 'sonner';
+import useSWR from 'swr';
+import {
+  StatusBadge,
+  formatSubmissionDate,
+  isMatrixField,
+  normalizeMatrixRows,
+  renderSubmissionValue,
+} from './submission-utils';
+import { DocumentFindingsSection } from './DocumentFindingsSection';
+
+type EvidenceSubmissionRow = {
+  id: string;
+  submittedAt: string;
+  status: string;
+  reviewedAt?: string | null;
+  reviewReason?: string | null;
+  data: Record<string, unknown>;
+  submittedBy?: {
+    name: string | null;
+    email: string;
+  } | null;
+  reviewedBy?: {
+    name: string | null;
+    email: string;
+  } | null;
+};
+
+type EvidenceSubmissionResponse = {
+  form: (typeof evidenceFormDefinitions)[EvidenceFormType];
+  submission: EvidenceSubmissionRow;
+};
+
+function MarkdownPreview({ content }: { content: string }) {
+  return (
+    <div className="prose prose-sm max-w-none dark:prose-invert text-sm">
+      <ReactMarkdown remarkPlugins={[remarkGfm]}>{content}</ReactMarkdown>
+    </div>
+  );
+}
+
+export function CompanySubmissionDetailPageClient({
+  organizationId,
+  formType,
+  submissionId,
+  isPlatformAdmin,
+}: {
+  organizationId: string;
+  formType: EvidenceFormType;
+  submissionId: string;
+  isPlatformAdmin: boolean;
+}) {
+  const endpoint = `/v1/evidence-forms/${formType}/submissions/${submissionId}`;
+  const swrKey: readonly [string, string] = [endpoint, organizationId];
+
+  const { data, isLoading, error, mutate } = useSWR<EvidenceSubmissionResponse>(
+    swrKey,
+    async ([path, orgId]: readonly [string, string]) => {
+      const response = await api.get<EvidenceSubmissionResponse>(path, orgId);
+      if (response.error || !response.data) {
+        throw new Error(response.error ?? 'Failed to load submission');
+      }
+      return response.data;
+    },
+  );
+
+  const [reviewReason, setReviewReason] = useState('');
+  const [isSubmittingReview, setIsSubmittingReview] = useState(false);
+  const { data: activeMember } = useActiveMember();
+  const memberRoles = activeMember?.role?.split(',').map((role: string) => role.trim()) || [];
+  const isAuditor = memberRoles.includes('auditor');
+  const isAdminOrOwner = memberRoles.includes('admin') || memberRoles.includes('owner');
+
+  const handleReview = async (action: 'approved' | 'rejected') => {
+    if (action === 'rejected' && !reviewReason.trim()) {
+      toast.error('A reason is required when rejecting a submission');
+      return;
+    }
+
+    setIsSubmittingReview(true);
+    try {
+      const response = await api.patch(
+        `/v1/evidence-forms/${formType}/submissions/${submissionId}/review`,
+        { action, reason: reviewReason.trim() || undefined },
+        organizationId,
+      );
+
+      if (response.error) {
+        toast.error(response.error);
+        return;
+      }
+
+      toast.success(action === 'approved' ? 'Submission approved' : 'Submission rejected');
+      setReviewReason('');
+      mutate();
+    } catch {
+      toast.error('Failed to submit review');
+    } finally {
+      setIsSubmittingReview(false);
+    }
+  };
+
+  if (isLoading) {
+    return (
+      <Empty>
+        <EmptyMedia variant="icon">
+          <Document size={24} />
+        </EmptyMedia>
+        <EmptyHeader>
+          <EmptyTitle>Loading submission...</EmptyTitle>
+          <EmptyDescription>Fetching the selected document details.</EmptyDescription>
+        </EmptyHeader>
+      </Empty>
+    );
+  }
+
+  if (error || !data?.submission) {
+    return (
+      <Empty>
+        <EmptyHeader>
+          <EmptyTitle>Submission not found</EmptyTitle>
+          <EmptyDescription>
+            This submission may have been removed or you may not have access.
+          </EmptyDescription>
+        </EmptyHeader>
+      </Empty>
+    );
+  }
+
+  const submission = data.submission;
+  const fields = data.form.fields.filter((field) => field.key !== 'submissionDate');
+  const compactFields = fields.filter((f) => f.type === 'text' || f.type === 'date');
+  const selectFields = fields.filter((f) => f.type === 'select');
+  const textareaFields = fields.filter((f) => f.type === 'textarea');
+  const fileFields = fields.filter((f) => f.type === 'file');
+  const matrixFields = fields.filter(isMatrixField);
+
+  return (
+    <Section>
+      <div className="space-y-6">
+        <div className="rounded-md border border-border">
+          <div className="divide-y divide-border">
+            {formType === 'access-request' && (
+              <div className="grid grid-cols-1 gap-2 p-4 lg:grid-cols-3">
+                <div className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+                  Status
+                </div>
+                <div className="lg:col-span-2 text-sm">
+                  <StatusBadge status={submission.status} />
+                </div>
+              </div>
+            )}
+            <div className="grid grid-cols-1 gap-2 p-4 lg:grid-cols-3">
+              <div className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+                Submission Date
+              </div>
+              <div className="lg:col-span-2 text-sm">
+                {formatSubmissionDate(submission.data.submissionDate, submission.submittedAt)}
+              </div>
+            </div>
+            <div className="grid grid-cols-1 gap-2 p-4 lg:grid-cols-3">
+              <div className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+                Submitted By
+              </div>
+              <div className="lg:col-span-2 text-sm">
+                {submission.submittedBy?.name ?? submission.submittedBy?.email ?? 'Unknown'}
+              </div>
+            </div>
+            {formType === 'access-request' && submission.status !== 'pending' && (
+              <>
+                <div className="grid grid-cols-1 gap-2 p-4 lg:grid-cols-3">
+                  <div className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+                    Reviewed By
+                  </div>
+                  <div className="lg:col-span-2 text-sm">
+                    {submission.reviewedBy?.name ?? submission.reviewedBy?.email ?? '—'}
+                  </div>
+                </div>
+                {submission.reviewReason && (
+                  <div className="grid grid-cols-1 gap-2 p-4 lg:grid-cols-3">
+                    <div className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+                      Review Reason
+                    </div>
+                    <div className="lg:col-span-2 text-sm whitespace-pre-wrap">
+                      {submission.reviewReason}
+                    </div>
+                  </div>
+                )}
+              </>
+            )}
+            {compactFields.map((field) => (
+              <div key={field.key} className="grid grid-cols-1 gap-2 p-4 lg:grid-cols-3">
+                <div className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+                  {field.label}
+                </div>
+                <div className="lg:col-span-2 text-sm">
+                  {renderSubmissionValue(submission.data[field.key], field)}
+                </div>
+              </div>
+            ))}
+            {selectFields.map((field) => (
+              <div key={field.key} className="grid grid-cols-1 gap-2 p-4 lg:grid-cols-3">
+                <div className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+                  {field.label}
+                </div>
+                <div className="lg:col-span-2 text-sm">
+                  {renderSubmissionValue(submission.data[field.key], field)}
+                </div>
+              </div>
+            ))}
+            {textareaFields.map((field) => {
+              const value = submission.data[field.key];
+              const content = typeof value === 'string' ? value : '';
+              return (
+                <div key={field.key} className="grid grid-cols-1 gap-2 p-4 lg:grid-cols-3">
+                  <div className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+                    {field.label}
+                  </div>
+                  <div className="lg:col-span-2 text-sm">
+                    {content ? (
+                      <MarkdownPreview content={content} />
+                    ) : (
+                      <Text size="sm" variant="muted">
+                        —
+                      </Text>
+                    )}
+                  </div>
+                </div>
+              );
+            })}
+            {fileFields.map((field) => (
+              <div key={field.key} className="grid grid-cols-1 gap-2 p-4 lg:grid-cols-3">
+                <div className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+                  {field.label}
+                </div>
+                <div className="lg:col-span-2 text-sm">
+                  {renderSubmissionValue(submission.data[field.key], field)}
+                </div>
+              </div>
+            ))}
+            {matrixFields.map((field) => {
+              const rows = normalizeMatrixRows(submission.data[field.key]);
+              return (
+                <div key={field.key} className="grid grid-cols-1 gap-2 p-4 lg:grid-cols-3">
+                  <div className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+                    {field.label}
+                  </div>
+                  <div className="lg:col-span-2 text-sm">
+                    {rows.length === 0 ? (
+                      <Text size="sm" variant="muted">
+                        —
+                      </Text>
+                    ) : (
+                      <Table variant="bordered">
+                        <TableHeader>
+                          <TableRow>
+                            {field.columns.map((column) => (
+                              <TableHead key={`${field.key}-header-${column.key}`}>
+                                {column.label}
+                              </TableHead>
+                            ))}
+                          </TableRow>
+                        </TableHeader>
+                        <TableBody>
+                          {rows.map((row, rowIndex) => (
+                            <TableRow key={`${field.key}-row-${rowIndex}`}>
+                              {field.columns.map((column) => (
+                                <TableCell key={`${field.key}-row-${rowIndex}-${column.key}`}>
+                                  <div className="whitespace-pre-wrap">{row[column.key] || '—'}</div>
+                                </TableCell>
+                              ))}
+                            </TableRow>
+                          ))}
+                        </TableBody>
+                      </Table>
+                    )}
+                  </div>
+                </div>
+              );
+            })}
+          </div>
+        </div>
+
+        {/* Review action area — only for access requests */}
+        {formType === 'access-request' && submission.status === 'pending' && (
+          <div className="rounded-md border border-border">
+            <div className="divide-y divide-border">
+              <div className="p-4">
+                <Text size="sm" weight="medium">
+                  Review this submission
+                </Text>
+              </div>
+              <div className="p-4 space-y-4">
+                <Field>
+                  <FieldLabel htmlFor="reviewReason">Reason (required for rejection)</FieldLabel>
+                  <Textarea
+                    id="reviewReason"
+                    value={reviewReason}
+                    onChange={(e) => setReviewReason(e.target.value)}
+                    placeholder="Provide a reason for your decision..."
+                    rows={4}
+                    style={{
+                      width: '100%',
+                      maxWidth: 'none',
+                    }}
+                  />
+                </Field>
+                <div className="flex items-center gap-2 justify-end">
+                  <Button
+                    type="button"
+                    variant="destructive"
+                    onClick={() => handleReview('rejected')}
+                    disabled={isSubmittingReview}
+                  >
+                    Reject
+                  </Button>
+                  <Button
+                    type="button"
+                    onClick={() => handleReview('approved')}
+                    disabled={isSubmittingReview}
+                  >
+                    Approve
+                  </Button>
+                </div>
+              </div>
+            </div>
+          </div>
+        )}
+
+        <DocumentFindingsSection
+          submissionId={submissionId}
+          isAuditor={isAuditor}
+          isPlatformAdmin={isPlatformAdmin}
+          isAdminOrOwner={isAdminOrOwner}
+        />
+      </div>
+    </Section>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.tsx b/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.tsx
new file mode 100644
index 000000000..43d9610ad
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.tsx
@@ -0,0 +1,594 @@
+'use client';
+
+import {
+  evidenceFormDefinitions,
+  evidenceFormSubmissionSchemaMap,
+  type EvidenceFormFieldDefinition,
+  type EvidenceFormFile,
+  type EvidenceFormType,
+} from '@/app/(app)/[orgId]/documents/forms';
+import { FileUploader } from '@/components/file-uploader';
+import { api } from '@/lib/api-client';
+import { zodResolver } from '@hookform/resolvers/zod';
+import {
+  Button,
+  Field,
+  FieldError,
+  FieldGroup,
+  FieldLabel,
+  Input,
+  Section,
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+  Text,
+  Textarea,
+} from '@trycompai/design-system';
+import Link from 'next/link';
+import { useRouter } from 'next/navigation';
+import { useMemo, useState } from 'react';
+import { Controller, useForm } from 'react-hook-form';
+import { toast } from 'sonner';
+import {
+  type MatrixColumnDefinition,
+  type MatrixRowValue,
+  isMatrixField,
+  normalizeMatrixRows,
+  renderSubmissionValue,
+} from './submission-utils';
+
+type Step = 1 | 2 | 3;
+
+async function fileToBase64(file: File): Promise<string> {
+  return await new Promise((resolve, reject) => {
+    const reader = new FileReader();
+    reader.onload = () => {
+      const result = reader.result as string;
+      const base64 = result.split(',')[1] ?? '';
+      resolve(base64);
+    };
+    reader.onerror = reject;
+    reader.readAsDataURL(file);
+  });
+}
+
+function createEmptyMatrixRow(columns: ReadonlyArray<MatrixColumnDefinition>): MatrixRowValue {
+  return Object.fromEntries(columns.map((column) => [column.key, '']));
+}
+
+export function CompanySubmissionWizard({
+  organizationId,
+  formType,
+}: {
+  organizationId: string;
+  formType: EvidenceFormType;
+}) {
+  const router = useRouter();
+  const [step, setStep] = useState<Step>(1);
+  const [uploadingField, setUploadingField] = useState<string | null>(null);
+
+  const formDefinition = evidenceFormDefinitions[formType];
+  const formSchema = evidenceFormSubmissionSchemaMap[formType];
+  const visibleFields = formDefinition.fields.filter((field) => field.key !== 'submissionDate');
+  const matrixFields = useMemo(() => visibleFields.filter(isMatrixField), [visibleFields]);
+
+  const compactFields = useMemo(() => {
+    const compact = visibleFields.filter(
+      (f) => f.type === 'text' || f.type === 'date' || f.type === 'select',
+    );
+    const dateFields = compact.filter((f) => f.type === 'date');
+    const nonDateFields = compact.filter((f) => f.type !== 'date');
+    return [...dateFields, ...nonDateFields];
+  }, [visibleFields]);
+  const extendedFields = useMemo(
+    () => visibleFields.filter((f) => f.type === 'textarea' || f.type === 'file'),
+    [visibleFields],
+  );
+
+  const defaultValues = useMemo(() => {
+    const defaults: Record<string, unknown> = {
+      submissionDate:
+        formDefinition.submissionDateMode === 'custom'
+          ? new Date().toISOString().slice(0, 10)
+          : new Date().toISOString(),
+    };
+
+    for (const matrixField of matrixFields) {
+      defaults[matrixField.key] = [createEmptyMatrixRow(matrixField.columns)];
+    }
+
+    return defaults;
+  }, [formDefinition.submissionDateMode, matrixFields]);
+
+  const {
+    control,
+    handleSubmit,
+    getValues,
+    setValue,
+    trigger,
+    watch,
+    formState: { errors, isSubmitting },
+  } = useForm<Record<string, unknown>>({
+    resolver: zodResolver(formSchema as never),
+    mode: 'onChange',
+    defaultValues,
+  });
+
+  const values = watch();
+
+  const handleFileUpload = async (fieldKey: string, file: File) => {
+    setUploadingField(fieldKey);
+    try {
+      const fileData = await fileToBase64(file);
+      const response = await api.post<EvidenceFormFile>(
+        '/v1/evidence-forms/uploads',
+        {
+          formType,
+          fileName: file.name,
+          fileType: file.type || 'application/octet-stream',
+          fileData,
+        },
+        organizationId,
+      );
+
+      if (response.error || !response.data) {
+        throw new Error(response.error ?? 'Upload failed');
+      }
+
+      setValue(fieldKey as never, response.data as never, {
+        shouldDirty: true,
+        shouldValidate: true,
+      });
+      toast.success('File uploaded');
+    } catch (error) {
+      toast.error(error instanceof Error ? error.message : 'File upload failed');
+    } finally {
+      setUploadingField(null);
+    }
+  };
+
+  const addMatrixRow = (
+    field: EvidenceFormFieldDefinition & {
+      type: 'matrix';
+      columns: ReadonlyArray<MatrixColumnDefinition>;
+    },
+  ) => {
+    const rows = normalizeMatrixRows(getValues(field.key as never));
+    setValue(field.key as never, [...rows, createEmptyMatrixRow(field.columns)] as never, {
+      shouldDirty: true,
+      shouldValidate: true,
+    });
+  };
+
+  const removeMatrixRow = (
+    field: EvidenceFormFieldDefinition & {
+      type: 'matrix';
+      columns: ReadonlyArray<MatrixColumnDefinition>;
+    },
+    rowIndex: number,
+  ) => {
+    const rows = normalizeMatrixRows(getValues(field.key as never));
+    const nextRows = rows.filter((_, index) => index !== rowIndex);
+    setValue(field.key as never, nextRows as never, {
+      shouldDirty: true,
+      shouldValidate: true,
+    });
+  };
+
+  const updateMatrixCell = (
+    field: EvidenceFormFieldDefinition & {
+      type: 'matrix';
+      columns: ReadonlyArray<MatrixColumnDefinition>;
+    },
+    rowIndex: number,
+    columnKey: string,
+    nextValue: string,
+  ) => {
+    const rows = normalizeMatrixRows(getValues(field.key as never));
+    const safeRows = rows.length > 0 ? rows : [createEmptyMatrixRow(field.columns)];
+    const currentRow = safeRows[rowIndex] ?? createEmptyMatrixRow(field.columns);
+    safeRows[rowIndex] = { ...currentRow, [columnKey]: nextValue };
+    setValue(field.key as never, safeRows as never, {
+      shouldDirty: true,
+      shouldValidate: true,
+    });
+  };
+
+  const goToStepTwo = async () => {
+    const keys: string[] = [];
+    if (formDefinition.submissionDateMode === 'custom') keys.push('submissionDate');
+    keys.push(...compactFields.map((f) => f.key));
+
+    const isValid = await trigger(keys as never, { shouldFocus: true });
+    if (!isValid) return;
+    setStep(2);
+  };
+
+  const goToStepThree = async () => {
+    const keys = [...extendedFields.map((f) => f.key), ...matrixFields.map((f) => f.key)];
+    const isValid = keys.length === 0 ? true : await trigger(keys as never, { shouldFocus: true });
+    if (!isValid) return;
+    setStep(3);
+  };
+
+  const onSubmit = async (formData: Record<string, unknown>) => {
+    const payload =
+      formDefinition.submissionDateMode === 'auto'
+        ? { ...formData, submissionDate: new Date().toISOString() }
+        : formData;
+
+    const response = await api.post(
+      `/v1/evidence-forms/${formType}/submissions`,
+      payload,
+      organizationId,
+    );
+
+    if (response.error) {
+      toast.error(response.error);
+      return;
+    }
+
+    toast.success('Submission saved');
+    router.push(`/${organizationId}/documents/${formType}`);
+    router.refresh();
+  };
+
+  return (
+    <Section>
+      <form onSubmit={handleSubmit(onSubmit)} className="space-y-6">
+        {step === 1 && (
+          <FieldGroup>
+            <div className="grid grid-cols-1 gap-4 lg:grid-cols-2">
+              {formDefinition.submissionDateMode === 'custom' && (
+                <Controller
+                  name={'submissionDate' as never}
+                  control={control}
+                  render={({ field: controllerField, fieldState }) => (
+                    <Field>
+                      <FieldLabel htmlFor="submissionDate">Submission date</FieldLabel>
+                      <Text size="sm" variant="muted">
+                        Date this evidence was submitted
+                      </Text>
+                      <Input
+                        id="submissionDate"
+                        type="date"
+                        value={String(controllerField.value ?? '')}
+                        onChange={controllerField.onChange}
+                      />
+                      <FieldError errors={[fieldState.error]} />
+                    </Field>
+                  )}
+                />
+              )}
+
+              {compactFields.map((field) => (
+                <Controller
+                  key={field.key}
+                  name={field.key as never}
+                  control={control}
+                  render={({ field: controllerField, fieldState }) => {
+                    const selectedOption =
+                      field.type === 'select' && field.options
+                        ? field.options.find(
+                            (opt) => opt.value === String(controllerField.value ?? ''),
+                          )
+                        : undefined;
+
+                    return (
+                      <Field>
+                        <FieldLabel htmlFor={field.key}>{field.label}</FieldLabel>
+                        {field.description && (
+                          <Text size="sm" variant="muted">
+                            {field.description}
+                          </Text>
+                        )}
+
+                        {(field.type === 'text' || field.type === 'date') && (
+                          <Input
+                            id={field.key}
+                            type={field.type === 'date' ? 'date' : 'text'}
+                            value={String(controllerField.value ?? '')}
+                            onChange={controllerField.onChange}
+                            placeholder={field.placeholder}
+                          />
+                        )}
+
+                        {field.type === 'select' && (
+                          <Select
+                            value={String(controllerField.value ?? '')}
+                            onValueChange={controllerField.onChange}
+                          >
+                            <SelectTrigger>
+                              <SelectValue placeholder={`Select ${field.label.toLowerCase()}`}>
+                                {selectedOption?.label ?? `Select ${field.label.toLowerCase()}`}
+                              </SelectValue>
+                            </SelectTrigger>
+                            <SelectContent>
+                              {(field.options ?? []).map((option) => (
+                                <SelectItem key={option.value} value={option.value}>
+                                  {option.label}
+                                </SelectItem>
+                              ))}
+                            </SelectContent>
+                          </Select>
+                        )}
+                        <FieldError errors={[fieldState.error]} />
+                      </Field>
+                    );
+                  }}
+                />
+              ))}
+            </div>
+          </FieldGroup>
+        )}
+
+        {step === 2 && (
+          <FieldGroup>
+            {extendedFields.length === 0 && matrixFields.length === 0 && (
+              <Text variant="muted">No additional fields required for this form.</Text>
+            )}
+            {extendedFields.map((field) => (
+              <Controller
+                key={field.key}
+                name={field.key as never}
+                control={control}
+                render={({ field: controllerField, fieldState }) => (
+                  <Field>
+                    <FieldLabel htmlFor={field.key}>{field.label}</FieldLabel>
+                    {field.description && (
+                      <Text size="sm" variant="muted">
+                        {field.description}
+                      </Text>
+                    )}
+
+                    {field.type === 'textarea' && (
+                      <div className="space-y-3">
+                        <Textarea
+                          id={field.key}
+                          style={{
+                            width: '100%',
+                            maxWidth: 'none',
+                            maxHeight: '350px',
+                            minHeight: '350px',
+                          }}
+                          value={String(controllerField.value ?? '')}
+                          onChange={controllerField.onChange}
+                          placeholder={field.placeholder}
+                          rows={12}
+                        />
+                        <p className="text-xs text-muted-foreground">
+                          {String(controllerField.value ?? '').length}/10,000 characters &bull;
+                          Markdown supported
+                        </p>
+                      </div>
+                    )}
+
+                    {field.type === 'file' && (
+                      <div className="space-y-2">
+                        <FileUploader
+                          maxFileCount={1}
+                          maxSize={100 * 1024 * 1024}
+                          accept={
+                            field.accept
+                              ? Object.fromEntries(
+                                  field.accept
+                                    .split(',')
+                                    .map((ext): [string, string[]] | null => {
+                                      const trimmed = ext.trim().toLowerCase();
+                                      if (trimmed === '.pdf') return ['application/pdf', []];
+                                      if (trimmed === '.doc') return ['application/msword', []];
+                                      if (trimmed === '.docx') {
+                                        return [
+                                          'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+                                          [],
+                                        ];
+                                      }
+                                      if (trimmed === '.png') return ['image/png', []];
+                                      if (trimmed === '.jpg' || trimmed === '.jpeg') {
+                                        return ['image/jpeg', []];
+                                      }
+                                      if (trimmed === '.txt') return ['text/plain', []];
+                                      return null;
+                                    })
+                                    .filter((entry): entry is [string, string[]] => entry !== null),
+                                )
+                              : { 'application/pdf': [], 'image/*': [], 'text/*': [] }
+                          }
+                          disabled={uploadingField === field.key}
+                          onUpload={async (files) => {
+                            const file = files[0];
+                            if (!file) return;
+                            await handleFileUpload(field.key, file);
+                          }}
+                        />
+                        {uploadingField === field.key && (
+                          <Text size="sm" variant="muted">
+                            Uploading file...
+                          </Text>
+                        )}
+                        {controllerField.value &&
+                          typeof controllerField.value === 'object' &&
+                          'fileName' in controllerField.value &&
+                          typeof (controllerField.value as { fileName?: unknown }).fileName ===
+                            'string' && (
+                            <Text size="sm" variant="muted">
+                              Uploaded: {(controllerField.value as { fileName: string }).fileName}
+                            </Text>
+                          )}
+                      </div>
+                    )}
+                    <FieldError errors={[fieldState.error]} />
+                  </Field>
+                )}
+              />
+            ))}
+            {matrixFields.map((field) => {
+              const rows = normalizeMatrixRows(watch(field.key as never));
+              const rowValues = rows.length > 0 ? rows : [createEmptyMatrixRow(field.columns)];
+              const matrixError = errors[field.key as keyof typeof errors];
+
+              return (
+                <Field key={field.key}>
+                  <FieldLabel>{field.label}</FieldLabel>
+                  {field.description && (
+                    <Text size="sm" variant="muted">
+                      {field.description}
+                    </Text>
+                  )}
+
+                  <div className="space-y-3">
+                    {rowValues.map((row, rowIndex) => (
+                      <div
+                        key={`${field.key}-${rowIndex}`}
+                        className="rounded-md border border-border p-3"
+                      >
+                        <div className="mb-3 flex items-center justify-between">
+                          <Text size="sm" weight="medium">
+                            Row {rowIndex + 1}
+                          </Text>
+                          <Button
+                            type="button"
+                            variant="ghost"
+                            onClick={() => removeMatrixRow(field, rowIndex)}
+                            disabled={rowValues.length <= 1}
+                          >
+                            Remove row
+                          </Button>
+                        </div>
+                        <div className="grid grid-cols-1 gap-3 lg:grid-cols-2">
+                          {field.columns.map((column) => (
+                            <Field key={`${field.key}-${rowIndex}-${column.key}`}>
+                              <FieldLabel htmlFor={`${field.key}-${rowIndex}-${column.key}`}>
+                                {column.label}
+                              </FieldLabel>
+                              {column.description && (
+                                <Text size="sm" variant="muted">
+                                  {column.description}
+                                </Text>
+                              )}
+                              <Input
+                                id={`${field.key}-${rowIndex}-${column.key}`}
+                                value={row[column.key] ?? ''}
+                                onChange={(event) =>
+                                  updateMatrixCell(field, rowIndex, column.key, event.target.value)
+                                }
+                                placeholder={column.placeholder}
+                              />
+                            </Field>
+                          ))}
+                        </div>
+                      </div>
+                    ))}
+
+                    <div>
+                      <Button type="button" variant="secondary" onClick={() => addMatrixRow(field)}>
+                        {field.addRowLabel ?? 'Add row'}
+                      </Button>
+                    </div>
+                  </div>
+                  <FieldError errors={[matrixError as never]} />
+                </Field>
+              );
+            })}
+          </FieldGroup>
+        )}
+
+        {step === 3 && (
+          <div className="space-y-4">
+            <Text size="sm" variant="muted">
+              Review your submission before saving.
+            </Text>
+            <div className="rounded-md border border-border">
+              <div className="divide-y divide-border">
+                {formDefinition.submissionDateMode === 'custom' && (
+                  <div className="grid grid-cols-1 gap-2 p-4 lg:grid-cols-3">
+                    <div className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+                      Submission date
+                    </div>
+                    <div className="lg:col-span-2 text-sm whitespace-pre-wrap wrap-anywhere">
+                      {String(values.submissionDate ?? '—')}
+                    </div>
+                  </div>
+                )}
+                {visibleFields.map((field) => (
+                  <div key={field.key} className="grid grid-cols-1 gap-2 p-4 lg:grid-cols-3">
+                    <div className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+                      {field.label}
+                    </div>
+                    <div className="lg:col-span-2 text-sm whitespace-pre-wrap wrap-anywhere">
+                      {isMatrixField(field)
+                        ? (() => {
+                            const rows = normalizeMatrixRows(
+                              values[field.key as keyof typeof values],
+                            );
+                            if (rows.length === 0) return '—';
+
+                            return (
+                              <div className="space-y-3">
+                                {rows.map((row, rowIndex) => (
+                                  <div
+                                    key={`${field.key}-review-${rowIndex}`}
+                                    className="rounded-md border border-border p-3"
+                                  >
+                                    <Text size="sm" weight="medium">
+                                      Row {rowIndex + 1}
+                                    </Text>
+                                    <div className="mt-2 grid grid-cols-1 gap-2 lg:grid-cols-2">
+                                      {field.columns.map((column) => (
+                                        <div key={`${field.key}-review-${rowIndex}-${column.key}`}>
+                                          <div className="text-xs uppercase tracking-wider text-muted-foreground">
+                                            {column.label}
+                                          </div>
+                                          <div className="text-sm whitespace-pre-wrap wrap-anywhere">
+                                            {row[column.key] || '—'}
+                                          </div>
+                                        </div>
+                                      ))}
+                                    </div>
+                                  </div>
+                                ))}
+                              </div>
+                            );
+                          })()
+                        : renderSubmissionValue(values[field.key as keyof typeof values], field)}
+                    </div>
+                  </div>
+                ))}
+              </div>
+            </div>
+          </div>
+        )}
+
+        <div className="flex items-center justify-between">
+          <Link href={`/${organizationId}/documents/${formType}`}>
+            <Button variant="ghost">Cancel</Button>
+          </Link>
+          <div className="flex items-center gap-2">
+            {step > 1 && (
+              <Button type="button" variant="secondary" onClick={() => setStep((step - 1) as Step)}>
+                Back
+              </Button>
+            )}
+            {step === 1 && (
+              <Button type="button" onClick={goToStepTwo}>
+                Continue
+              </Button>
+            )}
+            {step === 2 && (
+              <Button type="button" onClick={goToStepThree}>
+                Review
+              </Button>
+            )}
+            {step === 3 && (
+              <Button type="submit" disabled={isSubmitting}>
+                {isSubmitting ? 'Submitting...' : 'Submit evidence'}
+              </Button>
+            )}
+          </div>
+        </div>
+      </form>
+    </Section>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/documents/components/DocumentFindingsSection.tsx b/apps/app/src/app/(app)/[orgId]/documents/components/DocumentFindingsSection.tsx
new file mode 100644
index 000000000..2dbda449e
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/documents/components/DocumentFindingsSection.tsx
@@ -0,0 +1,202 @@
+'use client';
+
+import { useFindingActions, useSubmissionFindings, type Finding } from '@/hooks/use-findings-api';
+import { Button } from '@comp/ui/button';
+import { FindingStatus } from '@db';
+import { AlertTriangle, ChevronDown, ChevronUp, FileWarning, Loader2 } from 'lucide-react';
+import { useCallback, useMemo, useState } from 'react';
+import { toast } from 'sonner';
+import { CreateFindingButton } from '../../tasks/[taskId]/components/findings/CreateFindingButton';
+import { FindingItem } from '../../tasks/[taskId]/components/findings/FindingItem';
+
+const INITIAL_DISPLAY_COUNT = 5;
+
+const STATUS_ORDER: Record<FindingStatus, number> = {
+  [FindingStatus.open]: 0,
+  [FindingStatus.needs_revision]: 1,
+  [FindingStatus.ready_for_review]: 2,
+  [FindingStatus.closed]: 3,
+};
+
+interface DocumentFindingsSectionProps {
+  submissionId: string;
+  isAuditor: boolean;
+  isPlatformAdmin: boolean;
+  isAdminOrOwner: boolean;
+}
+
+export function DocumentFindingsSection({
+  submissionId,
+  isAuditor,
+  isPlatformAdmin,
+  isAdminOrOwner,
+}: DocumentFindingsSectionProps) {
+  const { data, isLoading, error, mutate } = useSubmissionFindings(submissionId);
+  const { updateFinding, deleteFinding } = useFindingActions();
+  const [expandedId, setExpandedId] = useState<string | null>(null);
+  const [showAll, setShowAll] = useState(false);
+
+  const rawFindings = data?.data || [];
+
+  const sortedFindings = useMemo(() => {
+    return [...rawFindings].sort((a: Finding, b: Finding) => {
+      const statusDiff = STATUS_ORDER[a.status] - STATUS_ORDER[b.status];
+      if (statusDiff !== 0) return statusDiff;
+      return new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime();
+    });
+  }, [rawFindings]);
+
+  const visibleFindings = showAll ? sortedFindings : sortedFindings.slice(0, INITIAL_DISPLAY_COUNT);
+  const hiddenCount = sortedFindings.length - visibleFindings.length;
+
+  const canCreateFinding = isAuditor || isPlatformAdmin;
+  const canChangeStatus = isAuditor || isPlatformAdmin || isAdminOrOwner;
+  const canSetRestrictedStatus = isAuditor || isPlatformAdmin;
+
+  const handleStatusChange = useCallback(
+    async (findingId: string, status: FindingStatus, revisionNote?: string) => {
+      try {
+        const updateData: { status: FindingStatus; revisionNote?: string | null } = { status };
+        if (status === FindingStatus.needs_revision && revisionNote) {
+          updateData.revisionNote = revisionNote;
+        }
+
+        await updateFinding(findingId, updateData);
+        toast.success(
+          revisionNote ? 'Finding marked for revision with note' : 'Finding status updated',
+        );
+        mutate();
+      } catch (findingError) {
+        toast.error(findingError instanceof Error ? findingError.message : 'Failed to update status');
+      }
+    },
+    [updateFinding, mutate],
+  );
+
+  const handleDelete = useCallback(
+    async (findingId: string) => {
+      if (!confirm('Are you sure you want to delete this finding?')) {
+        return;
+      }
+      try {
+        await deleteFinding(findingId);
+        toast.success('Finding deleted');
+        mutate();
+      } catch (findingError) {
+        toast.error(findingError instanceof Error ? findingError.message : 'Failed to delete finding');
+      }
+    },
+    [deleteFinding, mutate],
+  );
+
+  const openFindingsCount = sortedFindings.filter(
+    (finding: Finding) =>
+      finding.status === FindingStatus.open || finding.status === FindingStatus.needs_revision,
+  ).length;
+
+  if (isLoading) {
+    return (
+      <div className="flex items-center justify-center py-8">
+        <Loader2 className="h-6 w-6 animate-spin text-muted-foreground" />
+      </div>
+    );
+  }
+
+  if (error) {
+    return (
+      <div className="flex items-center justify-center py-8 text-destructive">
+        <AlertTriangle className="h-5 w-5 mr-2" />
+        <span>Failed to load findings</span>
+      </div>
+    );
+  }
+
+  return (
+    <div className="rounded-lg border border-border bg-card overflow-hidden">
+      <div className="px-5 py-4 border-b border-border">
+        <div className="flex items-center justify-between">
+          <div className="flex items-center gap-2.5">
+            <div className="p-1.5 rounded-md bg-muted">
+              <FileWarning className="h-4 w-4 text-primary" />
+            </div>
+            <div>
+              <h3 className="text-sm font-semibold text-foreground">Findings</h3>
+              <p className="text-xs text-muted-foreground">
+                Audit findings and issues requiring attention
+              </p>
+            </div>
+          </div>
+
+          <div className="flex items-center gap-3">
+            {openFindingsCount > 0 && (
+              <div className="flex items-center gap-2 px-3 py-1.5 rounded-md bg-red-50 border border-red-100">
+                <div className="w-2 h-2 rounded-full bg-red-500" />
+                <span className="text-xs font-medium text-red-700">
+                  {openFindingsCount} requires action
+                </span>
+              </div>
+            )}
+            {canCreateFinding && (
+              <CreateFindingButton
+                evidenceSubmissionId={submissionId}
+                onSuccess={() => {
+                  mutate();
+                }}
+              />
+            )}
+          </div>
+        </div>
+      </div>
+
+      <div className="p-5">
+        {sortedFindings.length === 0 ? (
+          <div className="flex flex-col items-center justify-center py-8 text-muted-foreground">
+            <FileWarning className="h-10 w-10 mb-3 opacity-50" />
+            <p className="text-sm">No findings for this submission</p>
+            {canCreateFinding && <p className="text-xs mt-1">Create a finding to flag an issue</p>}
+          </div>
+        ) : (
+          <div className="space-y-2">
+            {visibleFindings.map((finding: Finding) => (
+              <FindingItem
+                key={finding.id}
+                finding={finding}
+                isAuditor={isAuditor}
+                isPlatformAdmin={isPlatformAdmin}
+                isExpanded={expandedId === finding.id}
+                canChangeStatus={canChangeStatus}
+                canSetRestrictedStatus={canSetRestrictedStatus}
+                onToggleExpand={() => setExpandedId(expandedId === finding.id ? null : finding.id)}
+                onStatusChange={(status, revisionNote) =>
+                  handleStatusChange(finding.id, status, revisionNote)
+                }
+                onDelete={() => handleDelete(finding.id)}
+              />
+            ))}
+
+            {sortedFindings.length > INITIAL_DISPLAY_COUNT && (
+              <Button
+                variant="ghost"
+                size="sm"
+                className="w-full mt-2 text-muted-foreground hover:text-foreground"
+                onClick={() => setShowAll(!showAll)}
+              >
+                {showAll ? (
+                  <>
+                    <ChevronUp className="h-4 w-4 mr-1.5" />
+                    Show less
+                  </>
+                ) : (
+                  <>
+                    <ChevronDown className="h-4 w-4 mr-1.5" />
+                    Show {hiddenCount} more {hiddenCount === 1 ? 'finding' : 'findings'}
+                  </>
+                )}
+              </Button>
+            )}
+          </div>
+        )}
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/documents/components/submission-utils.tsx b/apps/app/src/app/(app)/[orgId]/documents/components/submission-utils.tsx
new file mode 100644
index 000000000..d79da522d
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/documents/components/submission-utils.tsx
@@ -0,0 +1,120 @@
+'use client';
+
+import type {
+  EvidenceFormFieldDefinition,
+  EvidenceFormFile,
+} from '@/app/(app)/[orgId]/documents/forms';
+
+const submissionDateFormatter = new Intl.DateTimeFormat('en-US', {
+  month: '2-digit',
+  day: '2-digit',
+  year: 'numeric',
+});
+
+export function formatSubmissionDate(submissionDate: unknown, submittedAt?: string | null): string {
+  const candidates: unknown[] = [submissionDate, submittedAt];
+
+  for (const candidate of candidates) {
+    if (typeof candidate !== 'string') continue;
+    const value = candidate.trim();
+    if (!value) continue;
+
+    const ymdMatch = value.match(/^(\d{4})-(\d{2})-(\d{2})(?:$|T)/);
+    if (ymdMatch) {
+      return `${ymdMatch[2]}/${ymdMatch[3]}/${ymdMatch[1]}`;
+    }
+
+    const parsed = new Date(value);
+    if (!Number.isNaN(parsed.getTime())) {
+      return submissionDateFormatter.format(parsed);
+    }
+  }
+
+  return '—';
+}
+
+export function renderSubmissionValue(value: unknown, field?: EvidenceFormFieldDefinition) {
+  if (!value) return '—';
+
+  if (
+    typeof value === 'object' &&
+    value !== null &&
+    'downloadUrl' in value &&
+    typeof value.downloadUrl === 'string'
+  ) {
+    const fileValue = value as EvidenceFormFile;
+    return (
+      <a
+        href={fileValue.downloadUrl}
+        target="_blank"
+        rel="noreferrer"
+        className="text-primary underline"
+      >
+        {fileValue.fileName}
+      </a>
+    );
+  }
+
+  if (field?.type === 'select' && field.options && typeof value === 'string') {
+    const matched = field.options.find((option) => option.value === value);
+    if (matched) return matched.label;
+  }
+
+  if (field?.type === 'date') {
+    return formatSubmissionDate(value);
+  }
+
+  if (typeof value === 'string' && value.length > 0) return value;
+  return '—';
+}
+
+export function StatusBadge({ status }: { status: string }) {
+  switch (status) {
+    case 'approved':
+      return (
+        <span className="inline-flex items-center rounded-full bg-green-50 px-2.5 py-0.5 text-xs font-medium text-green-700 dark:bg-green-950/30 dark:text-green-400">
+          Approved
+        </span>
+      );
+    case 'rejected':
+      return (
+        <span className="inline-flex items-center rounded-full bg-red-50 px-2.5 py-0.5 text-xs font-medium text-red-700 dark:bg-red-950/30 dark:text-red-400">
+          Rejected
+        </span>
+      );
+    default:
+      return (
+        <span className="inline-flex items-center rounded-full bg-yellow-50 px-2.5 py-0.5 text-xs font-medium text-yellow-700 dark:bg-yellow-950/30 dark:text-yellow-400">
+          Pending
+        </span>
+      );
+  }
+}
+
+export type MatrixRowValue = Record<string, string>;
+export type MatrixColumnDefinition = {
+  key: string;
+  label: string;
+  required?: boolean;
+  placeholder?: string;
+  description?: string;
+};
+
+export function isMatrixField(
+  field: EvidenceFormFieldDefinition,
+): field is EvidenceFormFieldDefinition & {
+  type: 'matrix';
+  columns: ReadonlyArray<MatrixColumnDefinition>;
+} {
+  return field.type === 'matrix' && Array.isArray(field.columns) && field.columns.length > 0;
+}
+
+export function normalizeMatrixRows(value: unknown): MatrixRowValue[] {
+  if (!Array.isArray(value)) return [];
+  return value.map((row) => {
+    if (!row || typeof row !== 'object') return {};
+    return Object.fromEntries(
+      Object.entries(row).map(([key, rawValue]) => [key, typeof rawValue === 'string' ? rawValue : '']),
+    );
+  });
+}
diff --git a/apps/app/src/app/(app)/[orgId]/documents/form-descriptions.ts b/apps/app/src/app/(app)/[orgId]/documents/form-descriptions.ts
new file mode 100644
index 000000000..22cc11d27
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/documents/form-descriptions.ts
@@ -0,0 +1,12 @@
+export const conciseFormDescriptions: Record<string, string> = {
+  'board-meeting': 'Hold a board meeting and capture minutes.',
+  'it-leadership-meeting': 'Run an IT leadership meeting and document outcomes.',
+  'risk-committee-meeting': 'Conduct a risk committee meeting and record decisions.',
+  'access-request':
+    'Track and retain user access requests. Employees can request access to systems through the employee portal.',
+  'whistleblower-report': 'Submit a confidential whistleblower report.',
+  'penetration-test': 'Upload a third-party penetration test report.',
+  'rbac-matrix': 'Document role-based access by system, role, and approval.',
+  'infrastructure-inventory': 'Track infrastructure assets, ownership, and review dates.',
+  'employee-performance-evaluation': 'Capture structured employee review outcomes and sign-off.',
+};
diff --git a/apps/app/src/app/(app)/[orgId]/documents/forms.ts b/apps/app/src/app/(app)/[orgId]/documents/forms.ts
new file mode 100644
index 000000000..8e190badc
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/documents/forms.ts
@@ -0,0 +1,12 @@
+// Single source of truth: re-export from shared @comp/company package
+export {
+  evidenceFormDefinitionList,
+  evidenceFormDefinitions,
+  evidenceFormFileSchema,
+  evidenceFormSubmissionSchemaMap,
+  evidenceFormTypeSchema,
+  type EvidenceFormDefinition,
+  type EvidenceFormFieldDefinition,
+  type EvidenceFormFile,
+  type EvidenceFormType,
+} from '@comp/company';
diff --git a/apps/app/src/app/(app)/[orgId]/documents/page.tsx b/apps/app/src/app/(app)/[orgId]/documents/page.tsx
new file mode 100644
index 000000000..c9aebfd64
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/documents/page.tsx
@@ -0,0 +1,13 @@
+import { PageHeader, PageLayout } from '@trycompai/design-system';
+import { CompanyOverviewCards } from './components/CompanyOverviewCards';
+
+export default async function CompanyPage({ params }: { params: Promise<{ orgId: string }> }) {
+  const { orgId } = await params;
+
+  return (
+    <PageLayout>
+      <PageHeader title="Documents" />
+      <CompanyOverviewCards organizationId={orgId} />
+    </PageLayout>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/frameworks/components/FindingsOverview.tsx b/apps/app/src/app/(app)/[orgId]/frameworks/components/FindingsOverview.tsx
index 63b50c2ac..5c4bb8313 100644
--- a/apps/app/src/app/(app)/[orgId]/frameworks/components/FindingsOverview.tsx
+++ b/apps/app/src/app/(app)/[orgId]/frameworks/components/FindingsOverview.tsx
@@ -32,7 +32,11 @@ interface FindingWithTask extends Finding {
   task: {
     id: string;
     title: string;
-  };
+  } | null;
+  evidenceSubmission: {
+    id: string;
+    formType: string;
+  } | null;
 }
 
 function FindingsList({
@@ -55,7 +59,10 @@ function FindingsList({
                   </div>
                   <div className="flex flex-col flex-1 min-w-0">
                     <span className="text-sm font-medium text-foreground line-clamp-1">
-                      {finding.task.title}
+                      {finding.task?.title ??
+                        (finding.evidenceSubmission
+                          ? `Document: ${finding.evidenceSubmission.formType}`
+                          : 'Finding')}
                     </span>
                     <p className="text-xs text-muted-foreground mt-1 line-clamp-2">
                       {finding.content}
@@ -63,7 +70,15 @@ function FindingsList({
                   </div>
                 </div>
                 <Button asChild size="icon" variant="outline" className="shrink-0 ml-2">
-                  <Link href={`/${organizationId}/tasks/${finding.task.id}#finding-${finding.id}`}>
+                  <Link
+                    href={
+                      finding.task
+                        ? `/${organizationId}/tasks/${finding.task.id}#finding-${finding.id}`
+                        : finding.evidenceSubmission
+                          ? `/${organizationId}/documents/${finding.evidenceSubmission.formType}/submissions/${finding.evidenceSubmission.id}`
+                          : `/${organizationId}/frameworks`
+                    }
+                  >
                     <ArrowRight className="h-3 w-3" />
                   </Link>
                 </Button>
diff --git a/apps/app/src/app/(app)/[orgId]/frameworks/components/Overview.tsx b/apps/app/src/app/(app)/[orgId]/frameworks/components/Overview.tsx
index d2193cab3..09da6205c 100644
--- a/apps/app/src/app/(app)/[orgId]/frameworks/components/Overview.tsx
+++ b/apps/app/src/app/(app)/[orgId]/frameworks/components/Overview.tsx
@@ -28,11 +28,15 @@ export interface PeopleScore {
   completedMembers: number;
 }
 
-export interface FindingWithTask extends Finding {
+export interface FindingWithTarget extends Finding {
   task: {
     id: string;
     title: string;
-  };
+  } | null;
+  evidenceSubmission: {
+    id: string;
+    formType: string;
+  } | null;
 }
 
 export interface OverviewProps {
@@ -45,7 +49,7 @@ export interface OverviewProps {
   peopleScore: PeopleScore;
   currentMember: { id: string; role: string } | null;
   onboardingTriggerJobId: string | null;
-  findings: FindingWithTask[];
+  findings: FindingWithTarget[];
 }
 
 export const Overview = ({
diff --git a/apps/app/src/app/(app)/[orgId]/frameworks/page.tsx b/apps/app/src/app/(app)/[orgId]/frameworks/page.tsx
index 30fdc346d..aa5c60a99 100644
--- a/apps/app/src/app/(app)/[orgId]/frameworks/page.tsx
+++ b/apps/app/src/app/(app)/[orgId]/frameworks/page.tsx
@@ -167,6 +167,12 @@ const getOrganizationFindings = cache(async (organizationId: string) => {
           title: true,
         },
       },
+      evidenceSubmission: {
+        select: {
+          id: true,
+          formType: true,
+        },
+      },
     },
     orderBy: [{ status: 'asc' }, { createdAt: 'desc' }],
   });
diff --git a/apps/app/src/app/(app)/[orgId]/settings/portal/page.tsx b/apps/app/src/app/(app)/[orgId]/settings/portal/page.tsx
index 52e080db5..2bdb82f01 100644
--- a/apps/app/src/app/(app)/[orgId]/settings/portal/page.tsx
+++ b/apps/app/src/app/(app)/[orgId]/settings/portal/page.tsx
@@ -14,6 +14,8 @@ export default async function PortalSettingsPage({
     select: {
       deviceAgentStepEnabled: true,
       securityTrainingStepEnabled: true,
+      whistleblowerReportEnabled: true,
+      accessRequestFormEnabled: true,
     },
   });
 
@@ -21,6 +23,8 @@ export default async function PortalSettingsPage({
     <PortalSettings
       deviceAgentStepEnabled={organization?.deviceAgentStepEnabled ?? true}
       securityTrainingStepEnabled={organization?.securityTrainingStepEnabled ?? true}
+      whistleblowerReportEnabled={organization?.whistleblowerReportEnabled ?? true}
+      accessRequestFormEnabled={organization?.accessRequestFormEnabled ?? true}
     />
   );
 }
diff --git a/apps/app/src/app/(app)/[orgId]/settings/portal/portal-settings.tsx b/apps/app/src/app/(app)/[orgId]/settings/portal/portal-settings.tsx
index 73978faa6..aafe60e1a 100644
--- a/apps/app/src/app/(app)/[orgId]/settings/portal/portal-settings.tsx
+++ b/apps/app/src/app/(app)/[orgId]/settings/portal/portal-settings.tsx
@@ -2,6 +2,8 @@
 
 import { updateOrganizationDeviceAgentStepAction } from '@/actions/organization/update-organization-device-agent-step-action';
 import { updateOrganizationSecurityTrainingStepAction } from '@/actions/organization/update-organization-security-training-step-action';
+import { updateOrganizationWhistleblowerReportAction } from '@/actions/organization/update-organization-whistleblower-report-action';
+import { updateOrganizationAccessRequestFormAction } from '@/actions/organization/update-organization-access-request-form-action';
 import { SettingGroup, SettingRow, Switch } from '@trycompai/design-system';
 import { useAction } from 'next-safe-action/hooks';
 import { toast } from 'sonner';
@@ -9,11 +11,15 @@ import { toast } from 'sonner';
 interface PortalSettingsProps {
   deviceAgentStepEnabled: boolean;
   securityTrainingStepEnabled: boolean;
+  whistleblowerReportEnabled: boolean;
+  accessRequestFormEnabled: boolean;
 }
 
 export function PortalSettings({
   deviceAgentStepEnabled,
   securityTrainingStepEnabled,
+  whistleblowerReportEnabled,
+  accessRequestFormEnabled,
 }: PortalSettingsProps) {
   const updateDeviceAgentStep = useAction(updateOrganizationDeviceAgentStepAction, {
     onSuccess: () => toast.success('Device agent step setting updated'),
@@ -25,6 +31,16 @@ export function PortalSettings({
     onError: () => toast.error('Error updating security training step setting'),
   });
 
+  const updateWhistleblowerReport = useAction(updateOrganizationWhistleblowerReportAction, {
+    onSuccess: () => toast.success('Whistleblower report visibility updated'),
+    onError: () => toast.error('Error updating whistleblower report visibility'),
+  });
+
+  const updateAccessRequestForm = useAction(updateOrganizationAccessRequestFormAction, {
+    onSuccess: () => toast.success('Access request visibility updated'),
+    onError: () => toast.error('Error updating access request visibility'),
+  });
+
   return (
     <SettingGroup>
       <SettingRow
@@ -53,6 +69,32 @@ export function PortalSettings({
           disabled={updateSecurityTrainingStep.status === 'executing'}
         />
       </SettingRow>
+      <SettingRow
+        size="lg"
+        label="Show Whistleblower Report Form"
+        description="Employees can submit whistleblower reports from the employee portal."
+      >
+        <Switch
+          checked={whistleblowerReportEnabled}
+          onCheckedChange={(checked) => {
+            updateWhistleblowerReport.execute({ whistleblowerReportEnabled: checked });
+          }}
+          disabled={updateWhistleblowerReport.status === 'executing'}
+        />
+      </SettingRow>
+      <SettingRow
+        size="lg"
+        label="Show Access Request Form"
+        description="Employees can submit access requests from the employee portal."
+      >
+        <Switch
+          checked={accessRequestFormEnabled}
+          onCheckedChange={(checked) => {
+            updateAccessRequestForm.execute({ accessRequestFormEnabled: checked });
+          }}
+          disabled={updateAccessRequestForm.status === 'executing'}
+        />
+      </SettingRow>
     </SettingGroup>
   );
 }
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/findings/CreateFindingButton.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/findings/CreateFindingButton.tsx
index 8dd538b7a..7a76be27a 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/findings/CreateFindingButton.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/findings/CreateFindingButton.tsx
@@ -6,11 +6,16 @@ import { useState } from 'react';
 import { CreateFindingSheet } from './CreateFindingSheet';
 
 interface CreateFindingButtonProps {
-  taskId: string;
+  taskId?: string;
+  evidenceSubmissionId?: string;
   onSuccess?: () => void;
 }
 
-export function CreateFindingButton({ taskId, onSuccess }: CreateFindingButtonProps) {
+export function CreateFindingButton({
+  taskId,
+  evidenceSubmissionId,
+  onSuccess,
+}: CreateFindingButtonProps) {
   const [open, setOpen] = useState(false);
 
   return (
@@ -20,6 +25,7 @@ export function CreateFindingButton({ taskId, onSuccess }: CreateFindingButtonPr
       </Button>
       <CreateFindingSheet
         taskId={taskId}
+        evidenceSubmissionId={evidenceSubmissionId}
         open={open}
         onOpenChange={setOpen}
         onSuccess={onSuccess}
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/findings/CreateFindingSheet.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/findings/CreateFindingSheet.tsx
index 10ead5087..068b6e408 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/findings/CreateFindingSheet.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/findings/CreateFindingSheet.tsx
@@ -46,7 +46,8 @@ const createFindingSchema = z.object({
 });
 
 interface CreateFindingSheetProps {
-  taskId: string;
+  taskId?: string;
+  evidenceSubmissionId?: string;
   open: boolean;
   onOpenChange: (open: boolean) => void;
   onSuccess?: () => void;
@@ -54,6 +55,7 @@ interface CreateFindingSheetProps {
 
 export function CreateFindingSheet({
   taskId,
+  evidenceSubmissionId,
   open,
   onOpenChange,
   onSuccess,
@@ -102,6 +104,7 @@ export function CreateFindingSheet({
         
         await createFinding({
           taskId,
+          evidenceSubmissionId,
           type: data.type,
           templateId: templateId || undefined,
           content: data.content,
@@ -116,7 +119,7 @@ export function CreateFindingSheet({
         setIsSubmitting(false);
       }
     },
-    [createFinding, taskId, onOpenChange, form, onSuccess],
+    [createFinding, taskId, evidenceSubmissionId, onOpenChange, form, onSuccess],
   );
 
   const handleTemplateChange = useCallback(
diff --git a/apps/app/src/components/comments/CommentForm.tsx b/apps/app/src/components/comments/CommentForm.tsx
index 67b55ad47..d5b9e8c26 100644
--- a/apps/app/src/components/comments/CommentForm.tsx
+++ b/apps/app/src/components/comments/CommentForm.tsx
@@ -1,6 +1,7 @@
 'use client';
 
 import { useComments, useCommentWithAttachments } from '@/hooks/use-comments-api';
+import { useOrganizationMembers } from '@/hooks/use-organization-members';
 import { Button } from '@comp/ui/button';
 import {
   Dialog,
@@ -11,15 +12,13 @@ import {
   DialogTitle,
 } from '@comp/ui/dialog';
 import type { CommentEntityType } from '@db';
+import type { JSONContent } from '@tiptap/react';
 import { Camera, FileIcon, Loader2, Paperclip, X } from 'lucide-react';
+import { useParams, usePathname } from 'next/navigation';
 import type React from 'react';
-import { useCallback, useRef, useState } from 'react';
+import { useCallback, useMemo, useRef, useState } from 'react';
 import { toast } from 'sonner';
-import type { JSONContent } from '@tiptap/react';
 import { CommentRichTextField } from './CommentRichTextField';
-import { useOrganizationMembers } from '@/hooks/use-organization-members';
-import { useMemo } from 'react';
-import { useParams, usePathname } from 'next/navigation';
 
 interface CommentFormProps {
   entityId: string;
@@ -76,41 +75,44 @@ export function CommentForm({ entityId, entityType, organizationId }: CommentFor
     fileInputRef.current?.click();
   };
 
-  const handleFileSelect = useCallback((event: React.ChangeEvent<HTMLInputElement>) => {
-    const files = event.target.files;
-    if (!files || files.length === 0) return;
+  const handleFileSelect = useCallback(
+    (event: React.ChangeEvent<HTMLInputElement>) => {
+      const files = event.target.files;
+      if (!files || files.length === 0) return;
 
-    const newFiles = Array.from(files);
+      const newFiles = Array.from(files);
 
-    // Validate file sizes
-    const MAX_FILE_SIZE_MB = 100;
-    const MAX_FILE_SIZE_BYTES = MAX_FILE_SIZE_MB * 1024 * 1024;
+      // Validate file sizes
+      const MAX_FILE_SIZE_MB = 100;
+      const MAX_FILE_SIZE_BYTES = MAX_FILE_SIZE_MB * 1024 * 1024;
 
-    for (const file of newFiles) {
-      if (file.size > MAX_FILE_SIZE_BYTES) {
-        toast.error(`File "${file.name}" exceeds the ${MAX_FILE_SIZE_MB}MB limit.`);
+      for (const file of newFiles) {
+        if (file.size > MAX_FILE_SIZE_BYTES) {
+          toast.error(`File "${file.name}" exceeds the ${MAX_FILE_SIZE_MB}MB limit.`);
+          if (fileInputRef.current) fileInputRef.current.value = '';
+          return;
+        }
+      }
+
+      // Skip modal if we're on risks or vendors pages - directly add files
+      const isRiskPage = pathname?.includes('/risk/');
+      const isVendorPage = pathname?.includes('/vendors/');
+
+      if (isRiskPage || isVendorPage) {
+        setPendingFiles((prev) => [...prev, ...newFiles]);
+        newFiles.forEach((file) => {
+          toast.success(`File "${file.name}" ready for attachment.`);
+        });
         if (fileInputRef.current) fileInputRef.current.value = '';
         return;
       }
-    }
 
-    // Skip modal if we're on risks or vendors pages - directly add files
-    const isRiskPage = pathname?.includes('/risk/');
-    const isVendorPage = pathname?.includes('/vendors/');
-    
-    if (isRiskPage || isVendorPage) {
-      setPendingFiles((prev) => [...prev, ...newFiles]);
-      newFiles.forEach((file) => {
-        toast.success(`File "${file.name}" ready for attachment.`);
-      });
-      if (fileInputRef.current) fileInputRef.current.value = '';
-      return;
-    }
-
-    // Show modal for policies and other pages
-    setFilesToAdd(newFiles);
-    setShowReminderDialog(true);
-  }, [entityType, pathname]);
+      // Show modal for policies and other pages
+      setFilesToAdd(newFiles);
+      setShowReminderDialog(true);
+    },
+    [entityType, pathname],
+  );
 
   const handleReminderConfirm = useCallback(() => {
     setShowReminderDialog(false);
@@ -138,19 +140,19 @@ export function CommentForm({ entityId, entityType, organizationId }: CommentFor
   // Convert TipTap JSON to string for API
   const getCommentText = useCallback((content: JSONContent | null): string => {
     if (!content) return '';
-    
+
     // If it's a valid TipTap doc, convert to JSON string
     if (content.type === 'doc' && content.content) {
       return JSON.stringify(content);
     }
-    
+
     return '';
   }, []);
 
   // Check if comment has content
   const hasContent = useCallback((content: JSONContent | null): boolean => {
     if (!content || !content.content) return false;
-    
+
     // Check if there's any text content
     const hasText = content.content.some((node) => {
       if (node.type === 'paragraph' && node.content) {
@@ -163,7 +165,7 @@ export function CommentForm({ entityId, entityType, organizationId }: CommentFor
       if (node.type === 'mention') return true;
       return false;
     });
-    
+
     return hasText;
   }, []);
 
@@ -193,7 +195,6 @@ export function CommentForm({ entityId, entityType, organizationId }: CommentFor
     }
   };
 
-
   return (
     <div className="rounded-lg border border-border bg-muted/10">
       <div className="flex items-start gap-3">
@@ -211,7 +212,7 @@ export function CommentForm({ entityId, entityType, organizationId }: CommentFor
             onChange={setNewComment}
             members={mentionMembers}
             disabled={isSubmitting}
-            placeholder="Leave a comment... Mention users with @"
+            placeholder="Leave a comment (mention users with @)"
             onMentionSelect={() => setIsSelectingMention(true)}
           />
 
diff --git a/apps/app/src/components/comments/CommentRichTextField.tsx b/apps/app/src/components/comments/CommentRichTextField.tsx
index d08fd646f..0405aa3ae 100644
--- a/apps/app/src/components/comments/CommentRichTextField.tsx
+++ b/apps/app/src/components/comments/CommentRichTextField.tsx
@@ -1,17 +1,17 @@
 'use client';
 
+import { createMentionExtension, type MentionUser } from '@comp/ui/editor';
+import { defaultExtensions } from '@comp/ui/editor/extensions';
 import type { JSONContent } from '@tiptap/react';
-import { useEditor, EditorContent } from '@tiptap/react';
-import { useMemo, useEffect, useCallback } from 'react';
+import { EditorContent, useEditor } from '@tiptap/react';
 import type { CSSProperties } from 'react';
+import { useCallback, useEffect, useMemo } from 'react';
+import { useDebouncedCallback } from 'use-debounce';
 
 type EditorSizeStyle = CSSProperties & {
   '--editor-min-height': string;
   '--editor-height': string;
 };
-import { createMentionExtension, type MentionUser } from '@comp/ui/editor';
-import { useDebouncedCallback } from 'use-debounce';
-import { defaultExtensions } from '@comp/ui/editor/extensions';
 
 interface CommentRichTextFieldProps {
   value: JSONContent | null;
@@ -27,7 +27,7 @@ export function CommentRichTextField({
   onChange,
   members,
   disabled = false,
-  placeholder = 'Leave a comment... Mention users with @',
+  placeholder = 'Leave a comment (mention users with @)',
   onMentionSelect,
 }: CommentRichTextFieldProps) {
   const editorSizeStyles: EditorSizeStyle = useMemo(
@@ -42,7 +42,7 @@ export function CommentRichTextField({
   const searchMembers = useCallback(
     (query: string): MentionUser[] => {
       if (!members || members.length === 0) return [];
-      
+
       // Show first 20 members immediately when query is empty
       if (!query || query.trim() === '') {
         return members.slice(0, 20);
@@ -131,9 +131,11 @@ export function CommentRichTextField({
   }, [value, editor]);
 
   return (
-    <div className="rounded-md bg-background [&_.ProseMirror_p.is-empty::before]:text-muted-foreground/50" style={editorSizeStyles}>
+    <div
+      className="rounded-md bg-background [&_.ProseMirror_p.is-empty::before]:text-muted-foreground/50"
+      style={editorSizeStyles}
+    >
       <EditorContent editor={editor} />
     </div>
   );
 }
-
diff --git a/apps/app/src/hooks/use-findings-api.ts b/apps/app/src/hooks/use-findings-api.ts
index 470112308..88416d6e5 100644
--- a/apps/app/src/hooks/use-findings-api.ts
+++ b/apps/app/src/hooks/use-findings-api.ts
@@ -14,7 +14,8 @@ export interface Finding {
   revisionNote: string | null;
   createdAt: string;
   updatedAt: string;
-  taskId: string;
+  taskId: string | null;
+  evidenceSubmissionId: string | null;
   templateId: string | null;
   createdById: string;
   organizationId: string;
@@ -35,7 +36,13 @@ export interface Finding {
   task: {
     id: string;
     title: string;
-  };
+  } | null;
+  evidenceSubmission: {
+    id: string;
+    formType: string;
+    submittedAt: string;
+    submittedById: string | null;
+  } | null;
 }
 
 export interface FindingTemplate {
@@ -49,7 +56,8 @@ export interface FindingTemplate {
 }
 
 interface CreateFindingData {
-  taskId: string;
+  taskId?: string;
+  evidenceSubmissionId?: string;
   type?: FindingType;
   templateId?: string;
   content: string;
@@ -108,6 +116,23 @@ export function useTaskFindings(taskId: string | null, options: UseFindingsOptio
   });
 }
 
+/**
+ * Hook to fetch findings for a specific evidence submission
+ */
+export function useSubmissionFindings(
+  evidenceSubmissionId: string | null,
+  options: UseFindingsOptions = {},
+) {
+  const endpoint = evidenceSubmissionId
+    ? `/v1/findings?evidenceSubmissionId=${evidenceSubmissionId}`
+    : null;
+
+  return useApiSWR<Finding[]>(endpoint, {
+    ...options,
+    refreshInterval: options.refreshInterval ?? DEFAULT_FINDINGS_POLLING_INTERVAL,
+  });
+}
+
 /**
  * Hook to fetch all findings for an organization
  */
diff --git a/apps/app/tsconfig.json b/apps/app/tsconfig.json
index 982b58bbd..ea468e9d4 100644
--- a/apps/app/tsconfig.json
+++ b/apps/app/tsconfig.json
@@ -13,6 +13,7 @@
     "esModuleInterop": true,
     "module": "esnext",
     "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
     "resolveJsonModule": true,
     "isolatedModules": true,
     "jsx": "react-jsx",
diff --git a/apps/portal/next.config.ts b/apps/portal/next.config.ts
index 2c54853c2..ba1986a59 100644
--- a/apps/portal/next.config.ts
+++ b/apps/portal/next.config.ts
@@ -4,7 +4,12 @@ import './src/env.mjs';
 const isStandalone = process.env.NEXT_OUTPUT_STANDALONE === 'true';
 
 const config = {
-  transpilePackages: ['@trycompai/db'],
+  transpilePackages: [
+    '@trycompai/db',
+    '@trycompai/design-system',
+    '@carbon/icons-react',
+    '@comp/company',
+  ],
   images: {
     remotePatterns: [
       {
diff --git a/apps/portal/package.json b/apps/portal/package.json
index 2451904cc..ccc72cf57 100644
--- a/apps/portal/package.json
+++ b/apps/portal/package.json
@@ -1,62 +1,64 @@
 {
-  "name": "@comp/portal",
-  "version": "0.1.0",
-  "dependencies": {
-    "@aws-sdk/client-s3": "^3.859.0",
-    "@aws-sdk/s3-request-presigner": "^3.859.0",
-    "@hookform/resolvers": "^5.2.2",
-    "@prisma/client": "6.18.0",
-    "@react-email/components": "^0.0.41",
-    "@react-email/render": "^1.1.2",
-    "@t3-oss/env-nextjs": "^0.13.8",
-    "@trycompai/analytics": "workspace:*",
-    "@trycompai/db": "1.3.22",
-    "@trycompai/email": "workspace:*",
-    "@trycompai/kv": "workspace:*",
-    "@trycompai/ui": "workspace:*",
-    "@types/jszip": "^3.4.1",
-    "@upstash/ratelimit": "^2.0.5",
-    "archiver": "^7.0.1",
-    "better-auth": "^1.4.5",
-    "class-variance-authority": "^0.7.1",
-    "geist": "^1.3.1",
-    "jspdf": "^3.0.3",
-    "jszip": "^3.10.1",
-    "next": "^16.0.10",
-    "next-safe-action": "^8.0.3",
-    "next-themes": "^0.4.4",
-    "prisma": "6.18.0",
-    "react": "^19.2.3",
-    "react-dom": "^19.2.3",
-    "react-email": "^4.0.15",
-    "react-hook-form": "^7.71.1",
-    "sonner": "^2.0.5",
-    "zod": "3"
-  },
-  "devDependencies": {
-    "@tailwindcss/postcss": "^4.1.10",
-    "@types/archiver": "^6.0.3",
-    "@types/node": "^24.0.3",
-    "eslint": "^9.18.0",
-    "eslint-config-next": "15.5.2",
-    "postcss": "^8.5.4",
-    "tailwindcss": "^4.1.8",
-    "typescript": "^5.8.3"
-  },
-  "peerDependencies": {
-    "react": "^19.1.1",
-    "react-dom": "^19.1.0"
-  },
-  "private": true,
-  "scripts": {
-    "build": "next build",
-    "build:docker": "prisma generate && next build",
-    "db:generate": "bun run db:getschema && prisma generate",
-    "db:getschema": "node ../../packages/db/scripts/combine-schemas.js && cp ../../packages/db/dist/schema.prisma prisma/schema.prisma",
-    "db:migrate": "cd ../../packages/db && bunx prisma migrate dev && cd ../../apps/portal",
-    "dev": "next dev --turbopack -p 3002",
-    "lint": "eslint . && prettier --check .",
-    "prebuild": "bun run db:generate",
-    "start": "next start"
-  }
+    "name": "@comp/portal",
+    "version": "0.1.0",
+    "dependencies": {
+        "@aws-sdk/client-s3": "^3.859.0",
+        "@aws-sdk/s3-request-presigner": "^3.859.0",
+        "@hookform/resolvers": "^5.2.2",
+        "@prisma/client": "6.18.0",
+        "@react-email/components": "^0.0.41",
+        "@react-email/render": "^1.1.2",
+        "@t3-oss/env-nextjs": "^0.13.8",
+        "@comp/company": "workspace:*",
+        "@trycompai/analytics": "workspace:*",
+        "@trycompai/db": "1.3.22",
+        "@trycompai/design-system": "^1.0.43",
+        "@trycompai/email": "workspace:*",
+        "@trycompai/kv": "workspace:*",
+        "@trycompai/ui": "workspace:*",
+        "@types/jszip": "^3.4.1",
+        "@upstash/ratelimit": "^2.0.5",
+        "archiver": "^7.0.1",
+        "better-auth": "^1.4.5",
+        "class-variance-authority": "^0.7.1",
+        "geist": "^1.3.1",
+        "jspdf": "^3.0.3",
+        "jszip": "^3.10.1",
+        "next": "^16.0.10",
+        "next-safe-action": "^8.0.3",
+        "next-themes": "^0.4.4",
+        "prisma": "6.18.0",
+        "react": "^19.2.3",
+        "react-dom": "^19.2.3",
+        "react-email": "^4.0.15",
+        "react-hook-form": "^7.71.1",
+        "sonner": "^2.0.5",
+        "zod": "3"
+    },
+    "devDependencies": {
+        "@tailwindcss/postcss": "^4.1.10",
+        "@types/archiver": "^6.0.3",
+        "@types/node": "^24.0.3",
+        "eslint": "^9.18.0",
+        "eslint-config-next": "15.5.2",
+        "postcss": "^8.5.4",
+        "tailwindcss": "^4.1.8",
+        "typescript": "^5.8.3"
+    },
+    "peerDependencies": {
+        "react": "^19.1.1",
+        "react-dom": "^19.1.0"
+    },
+    "private": true,
+    "scripts": {
+        "build": "next build",
+        "build:docker": "prisma generate && next build",
+        "db:generate": "bun run db:getschema && prisma generate",
+        "db:getschema": "node ../../packages/db/scripts/combine-schemas.js && cp ../../packages/db/dist/schema.prisma prisma/schema.prisma",
+        "db:migrate": "cd ../../packages/db && bunx prisma migrate dev && cd ../../apps/portal",
+        "dev": "next dev --turbopack -p 3002",
+        "lint": "eslint . && prettier --check .",
+        "prebuild": "bun run db:generate",
+        "start": "next start"
+    }
 }
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/EmployeeTasksList.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/EmployeeTasksList.tsx
index 9c559e847..51a3ee0ec 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/EmployeeTasksList.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/EmployeeTasksList.tsx
@@ -1,9 +1,12 @@
 'use client';
 
 import { trainingVideos } from '@/lib/data/training-videos';
+import { evidenceFormDefinitionList } from '@comp/company';
 import { Accordion } from '@comp/ui/accordion';
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@comp/ui/card';
+import { Card, CardContent } from '@comp/ui/card';
 import type { EmployeeTrainingVideoCompletion, Member, Policy, PolicyVersion } from '@db';
+import { Button } from '@trycompai/design-system';
+import Link from 'next/link';
 import { CheckCircle2 } from 'lucide-react';
 import useSWR from 'swr';
 import type { FleetPolicy, Host } from '../types';
@@ -11,6 +14,8 @@ import { DeviceAgentAccordionItem } from './tasks/DeviceAgentAccordionItem';
 import { GeneralTrainingAccordionItem } from './tasks/GeneralTrainingAccordionItem';
 import { PoliciesAccordionItem } from './tasks/PoliciesAccordionItem';
 
+const portalForms = evidenceFormDefinitionList.filter((f) => f.portalAccessible);
+
 type PolicyWithVersion = Policy & {
   currentVersion?: Pick<PolicyVersion, 'id' | 'content' | 'pdfUrl' | 'version'> | null;
 };
@@ -24,6 +29,8 @@ interface EmployeeTasksListProps {
   host: Host | null;
   deviceAgentStepEnabled: boolean;
   securityTrainingStepEnabled: boolean;
+  whistleblowerReportEnabled: boolean;
+  accessRequestFormEnabled: boolean;
 }
 
 export const EmployeeTasksList = ({
@@ -35,8 +42,14 @@ export const EmployeeTasksList = ({
   host,
   deviceAgentStepEnabled,
   securityTrainingStepEnabled,
+  whistleblowerReportEnabled,
+  accessRequestFormEnabled,
 }: EmployeeTasksListProps) => {
-  const { data: response, isValidating, mutate: fetchFleetPolicies } = useSWR<{ device: Host | null; fleetPolicies: FleetPolicy[] }>(
+  const {
+    data: response,
+    isValidating,
+    mutate: fetchFleetPolicies,
+  } = useSWR<{ device: Host | null; fleetPolicies: FleetPolicy[] }>(
     `/api/fleet-policies?organizationId=${organizationId}`,
     async (url) => {
       const res = await fetch(url);
@@ -47,7 +60,7 @@ export const EmployeeTasksList = ({
       fallbackData: { device: host, fleetPolicies },
       refreshInterval: 0,
       revalidateOnFocus: false,
-      revalidateOnMount: false
+      revalidateOnMount: false,
     },
   );
 
@@ -60,7 +73,8 @@ export const EmployeeTasksList = ({
     policies.length === 0 || policies.every((p) => p.signedBy.includes(member.id));
   const hasInstalledAgent = response.device !== null;
   const allFleetPoliciesPass =
-    response.fleetPolicies.length === 0 || response.fleetPolicies.every((policy) => policy.response === 'pass');
+    response.fleetPolicies.length === 0 ||
+    response.fleetPolicies.every((policy) => policy.response === 'pass');
   const hasCompletedDeviceSetup = hasInstalledAgent && allFleetPoliciesPass;
 
   // Calculate general training completion (matching logic from GeneralTrainingAccordionItem)
@@ -84,7 +98,7 @@ export const EmployeeTasksList = ({
 
   const accordionItems = [
     {
-      title: 'Accept security policies',
+      title: 'Security Policies',
       content: <PoliciesAccordionItem policies={policies} member={member} />,
     },
     ...(deviceAgentStepEnabled
@@ -116,6 +130,11 @@ export const EmployeeTasksList = ({
         ]
       : []),
   ];
+  const visiblePortalForms = portalForms.filter((form) => {
+    if (form.type === 'whistleblower-report') return whistleblowerReportEnabled;
+    if (form.type === 'access-request') return accessRequestFormEnabled;
+    return true;
+  });
 
   const allCompleted = completedCount === accordionItems.length;
 
@@ -137,34 +156,54 @@ export const EmployeeTasksList = ({
 
   return (
     <div className="space-y-4">
-      <Card>
-        <CardHeader>
-          <CardTitle>Overview</CardTitle>
-          <CardDescription>
-            Please complete the following tasks to stay compliant and secure.
-          </CardDescription>
-        </CardHeader>
-        <CardContent className="space-y-4">
-          {/* Progress indicator */}
-          <div>
-            <div className="text-muted-foreground text-sm">
-              {completedCount} of {accordionItems.length} tasks completed
-            </div>
-            <div className="w-full bg-muted rounded-full h-2.5">
-              <div
-                className="bg-primary h-full rounded-full"
-                style={{ width: `${(completedCount / accordionItems.length) * 100}%` }}
-              ></div>
-            </div>
-          </div>
+      {/* Progress indicator */}
+      <div>
+        <div className="text-muted-foreground text-sm">
+          {completedCount} of {accordionItems.length} tasks completed
+        </div>
+        <div className="w-full bg-muted rounded-full h-2.5">
+          <div
+            className="bg-primary h-full rounded-full"
+            style={{ width: `${(completedCount / accordionItems.length) * 100}%` }}
+          ></div>
+        </div>
+      </div>
+
+      <Accordion type="single" collapsible className="space-y-3">
+        {accordionItems.map((item, idx) => (
+          <div key={item.title ?? idx}>{item.content}</div>
+        ))}
+      </Accordion>
 
-          <Accordion type="single" collapsible className="space-y-3">
-            {accordionItems.map((item, idx) => (
-              <div key={item.title ?? idx}>{item.content}</div>
-            ))}
-          </Accordion>
-        </CardContent>
-      </Card>
+      {/* Company forms */}
+      {visiblePortalForms.length > 0 && (
+        <div className="space-y-2">
+          <div className="text-xs font-medium uppercase tracking-wider text-muted-foreground">
+            Company Forms
+          </div>
+          {visiblePortalForms.map((form) => (
+            <div
+              key={form.type}
+              className="flex items-center justify-between rounded-md border border-border p-3"
+            >
+              <div>
+                <span className="text-sm font-medium">{form.title}</span>
+                <p className="text-xs text-muted-foreground">{form.description}</p>
+              </div>
+              <div className="flex items-center gap-2 shrink-0 ml-4">
+                {form.type === 'access-request' && (
+                  <Link href={`/${organizationId}/documents/${form.type}/submissions`}>
+                    <Button variant="ghost">My requests</Button>
+                  </Link>
+                )}
+                <Link href={`/${organizationId}/documents/${form.type}`}>
+                  <Button>Submit</Button>
+                </Link>
+              </div>
+            </div>
+          ))}
+        </div>
+      )}
     </div>
   );
 };
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/OrganizationDashboard.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/OrganizationDashboard.tsx
index fc5560427..8abaa3ce2 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/OrganizationDashboard.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/OrganizationDashboard.tsx
@@ -82,11 +82,13 @@ export async function OrganizationDashboard({
       organizationId={organizationId}
       policies={policies}
       trainingVideos={trainingVideos}
-      member={member} // Pass the member object down
+      member={member}
       fleetPolicies={fleetPolicies}
       host={host}
       deviceAgentStepEnabled={org.deviceAgentStepEnabled}
       securityTrainingStepEnabled={org.securityTrainingStepEnabled}
+      whistleblowerReportEnabled={org.whistleblowerReportEnabled}
+      accessRequestFormEnabled={org.accessRequestFormEnabled}
     />
   );
 }
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/AdvancedEditor.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/AdvancedEditor.tsx
index 73bb15623..53d410a87 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/AdvancedEditor.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/AdvancedEditor.tsx
@@ -19,8 +19,8 @@ const AdvancedEditor = ({ initialContent }: AdvancedEditorProps) => {
       showSaveStatus={false}
       showWordCount={false}
       showToolbar={false}
-      minHeight="500px"
-      className="max-w-screen-lg mx-auto sm:mb-[calc(20vh)]"
+      minHeight="320px"
+      className="w-full"
     />
   );
 };
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyCard.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyCard.tsx
index 55d5cc873..61fe48708 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyCard.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyCard.tsx
@@ -1,17 +1,18 @@
 'use client';
 
-import { Button } from '@comp/ui/button';
+import type { Member, Policy, PolicyVersion } from '@db';
+import type { JSONContent } from '@tiptap/react';
 import {
+  Button,
   Card,
   CardContent,
   CardDescription,
   CardFooter,
   CardHeader,
   CardTitle,
-} from '@comp/ui/card';
-import type { Member, Policy, PolicyVersion } from '@db';
-import type { JSONContent } from '@tiptap/react';
-import { ArrowRight, Check } from 'lucide-react';
+  Text,
+} from '@trycompai/design-system';
+import { ArrowRight } from '@trycompai/design-system/icons';
 import { useState } from 'react';
 import { PolicyEditor } from './PolicyEditor';
 import { PortalPdfViewer } from './PortalPdfViewer';
@@ -43,64 +44,66 @@ export function PolicyCard({ policy, onNext, onComplete, member, isLastPolicy }:
   const isPdfPolicy = policy.displayFormat === 'PDF' && effectivePdfUrl;
 
   return (
-    <Card className="relative flex max-h-[calc(100vh-450px)] w-full flex-col shadow-md">
-      {isAccepted && (
-        <div className="bg-background/80 absolute inset-0 z-10 flex items-center justify-center backdrop-blur-xs">
-          <div className="space-y-4 text-center">
-            <Check className="text-primary mx-auto h-12 w-12" />
-            <h3 className="text-xl font-semibold">Policy Accepted</h3>
-            <p className="text-muted-foreground">You have accepted this policy</p>
-            <div className="flex justify-center gap-2">
-              <Button variant="outline" onClick={() => setIsAccepted(false)} className="gap-2">
-                View Again
-              </Button>
-              {!isLastPolicy && (
-                <Button onClick={onNext} className="gap-2">
-                  Next Policy
-                  <ArrowRight className="h-4 w-4" />
+    <div className="relative">
+      <Card>
+        {isAccepted && (
+          <div className="bg-background/80 absolute inset-0 z-10 flex items-center justify-center backdrop-blur-xs">
+            <div className="space-y-4 text-center">
+              <Text weight="medium">Policy Accepted</Text>
+              <Text variant="muted">You have accepted this policy</Text>
+              <div className="flex justify-center gap-2">
+                <Button variant="outline" onClick={() => setIsAccepted(false)}>
+                  View Again
                 </Button>
+                {!isLastPolicy && (
+                  <Button onClick={onNext} iconRight={<ArrowRight size={16} />}>
+                    Next Policy
+                  </Button>
+                )}
+              </div>
+            </div>
+          </div>
+        )}
+        <CardHeader>
+          <CardTitle>{policy.name}</CardTitle>
+          <CardDescription>{policy.description}</CardDescription>
+        </CardHeader>
+        <CardContent>
+          <div className="w-full border-t border-border pt-6">
+            <div className="max-w-none">
+              {isPdfPolicy ? (
+                <PortalPdfViewer
+                  policyId={policy.id}
+                  s3Key={effectivePdfUrl}
+                  versionId={policy.currentVersion?.id}
+                />
+              ) : (
+                <PolicyEditor content={effectiveContent as JSONContent[]} />
               )}
             </div>
+            <Text variant="muted" size="sm">
+              Status: {policy.status}{' '}
+              {policy.updatedAt && (
+                <span>(Last updated: {new Date(policy.updatedAt).toLocaleDateString()})</span>
+              )}
+            </Text>
           </div>
-        </div>
-      )}
-      <CardHeader>
-        <CardTitle className="text-2xl">{policy.name}</CardTitle>
-        <CardDescription className="text-muted-foreground">{policy.description}</CardDescription>
-      </CardHeader>
-      <CardContent className="w-full flex-1 overflow-y-auto">
-        <div className="w-full border-t pt-6">
-          <div className="max-w-none">
-            {isPdfPolicy ? (
-              <PortalPdfViewer
-                policyId={policy.id}
-                s3Key={effectivePdfUrl}
-                versionId={policy.currentVersion?.id}
-              />
-            ) : (
-              <PolicyEditor content={effectiveContent as JSONContent[]} />
-            )}
+        </CardContent>
+        <CardFooter>
+          <div className="flex w-full items-center justify-between gap-2">
+            <div className="flex items-center gap-2">
+              {policy.updatedAt && (
+                <Text variant="muted" size="sm">
+                  Last updated: {new Date(policy.updatedAt).toLocaleDateString()}
+                </Text>
+              )}
+            </div>
+            <div className="flex gap-2">
+              <Button onClick={handleAccept}>Accept Policy</Button>
+            </div>
           </div>
-          <p className="text-muted-foreground mt-4 text-sm">
-            Status: {policy.status}{' '}
-            {policy.updatedAt && (
-              <span>(Last updated: {new Date(policy.updatedAt).toLocaleDateString()})</span>
-            )}
-          </p>
-        </div>
-      </CardContent>
-      <CardFooter className="flex items-center justify-between">
-        <div className="flex items-center gap-2">
-          {policy.updatedAt && (
-            <p className="text-muted-foreground text-sm">
-              Last updated: {new Date(policy.updatedAt).toLocaleDateString()}
-            </p>
-          )}
-        </div>
-        <div className="flex gap-2">
-          <Button onClick={handleAccept}>Accept Policy</Button>
-        </div>
-      </CardFooter>
-    </Card>
+        </CardFooter>
+      </Card>
+    </div>
   );
 }
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyCarousel.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyCarousel.tsx
index 6b9863cdf..6e9c048db 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyCarousel.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyCarousel.tsx
@@ -1,8 +1,8 @@
 'use client';
 
-import { Button } from '@comp/ui/button';
 import type { Member, Policy, PolicyVersion } from '@db';
-import { ChevronLeft, ChevronRight } from 'lucide-react';
+import { Button, Text } from '@trycompai/design-system';
+import { ChevronLeft, ChevronRight } from '@trycompai/design-system/icons';
 import { useAction } from 'next-safe-action/hooks';
 import { useEffect, useRef, useState } from 'react';
 import { toast } from 'sonner';
@@ -87,7 +87,7 @@ export function PolicyCarousel({
     <div className="w-full space-y-4">
       <div
         ref={scrollContainerRef}
-        className="flex snap-x snap-mandatory overflow-x-hidden scroll-smooth"
+        className="flex snap-x snap-mandatory overflow-x-auto scroll-smooth"
         onScroll={handleScroll}
       >
         {policies.map((policy) => (
@@ -110,18 +110,18 @@ export function PolicyCarousel({
           onClick={handlePrevious}
           disabled={currentIndex === 0}
         >
-          <ChevronLeft className="h-4 w-4" />
+          <ChevronLeft size={16} />
         </Button>
-        <span className="text-muted-foreground text-sm">
+        <Text variant="muted" size="sm">
           Policy {currentIndex + 1} of {policies.length}
-        </span>
+        </Text>
         <Button
           variant="outline"
           size="icon"
           onClick={handleNext}
           disabled={currentIndex === policies.length - 1}
         >
-          <ChevronRight className="h-4 w-4" />
+          <ChevronRight size={16} />
         </Button>
       </div>
     </div>
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyContainer.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyContainer.tsx
index 4fa5b0d83..6360dbed9 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyContainer.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyContainer.tsx
@@ -1,8 +1,8 @@
 'use client';
 
-import { Button } from '@comp/ui/button';
 import type { Member, Policy, PolicyVersion } from '@db';
-import { ArrowLeft } from 'lucide-react';
+import { Button, Text } from '@trycompai/design-system';
+import { ArrowLeft } from '@trycompai/design-system/icons';
 import { useState } from 'react';
 import { PolicyCarousel } from './PolicyCarousel';
 import { PolicyGrid } from './PolicyGrid';
@@ -35,13 +35,12 @@ export function PolicyContainer({ policies, member }: PolicyContainerProps) {
     return (
       <div className="space-y-4">
         <div className="flex items-center gap-4">
-          <Button variant="outline" size="sm" className="gap-2" onClick={handleBackToGrid}>
-            <ArrowLeft className="h-4 w-4" />
+          <Button variant="outline" iconLeft={<ArrowLeft size={16} />} onClick={handleBackToGrid}>
             Back to Policies
           </Button>
-          <p className="text-muted-foreground text-sm">
+          <Text variant="muted" size="sm">
             Policy {selectedPolicyIndex + 1} of {policies.length}
-          </p>
+          </Text>
         </div>
         <PolicyCarousel
           policies={policies}
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyEditor.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyEditor.tsx
index 239f45a42..009d6df7f 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyEditor.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyEditor.tsx
@@ -1,5 +1,6 @@
 'use client';
 
+import '@/styles/editor.css';
 import type { JSONContent } from '@tiptap/react';
 import { useState } from 'react';
 import AdvancedEditor from './AdvancedEditor';
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyGrid.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyGrid.tsx
index 7c69f54b5..09848ba5a 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyGrid.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyGrid.tsx
@@ -1,8 +1,7 @@
 'use client';
 
-import { Card, CardContent, CardHeader, CardTitle } from '@comp/ui/card';
 import type { Member, Policy, PolicyVersion } from '@db';
-import { Check } from 'lucide-react';
+import { Card, CardContent, CardHeader, CardTitle, Text } from '@trycompai/design-system';
 
 type PolicyWithVersion = Policy & {
   currentVersion?: Pick<PolicyVersion, 'id' | 'content' | 'pdfUrl' | 'version'> | null;
@@ -23,15 +22,13 @@ export function PolicyGrid({ policies, onPolicyClick, member }: PolicyGridProps)
     <div className="space-y-6">
       {!noPoliciesFound && allPoliciesCompleted && (
         <div className="flex w-full flex-col items-center justify-center space-y-2 py-8">
-          <h2 className="text-2xl font-semibold">All Policies Completed!</h2>
-          <p className="text-muted-foreground text-center">
-            You're all done, now your manager won't pester you!
-          </p>
+          <Text weight="medium">All Policies Completed!</Text>
+          <Text variant="muted">You're all done, now your manager won't pester you!</Text>
         </div>
       )}
       {noPoliciesFound && (
         <div className="flex w-full flex-col items-center justify-center space-y-2 py-8">
-          <p className="text-muted-foreground text-center">You don't have any policies to sign!</p>
+          <Text variant="muted">You don't have any policies to sign!</Text>
         </div>
       )}
       {!noPoliciesFound && (
@@ -39,33 +36,37 @@ export function PolicyGrid({ policies, onPolicyClick, member }: PolicyGridProps)
           {policies.map((policy, index) => {
             const isCompleted = policy.signedBy.includes(member.id);
             return (
-              <Card
+              <div
                 key={policy.id}
-                className="relative flex h-[280px] cursor-pointer flex-col transition-shadow hover:shadow-lg"
+                className="relative flex min-h-[220px] cursor-pointer flex-col transition-shadow hover:shadow-lg md:min-h-[260px]"
                 onClick={() => onPolicyClick(index)}
               >
-                {isCompleted && (
-                  <div className="bg-background/60 absolute inset-0 z-10 flex items-center justify-center backdrop-blur-[2px]">
-                    <Check className="text-primary h-12 w-12" />
-                  </div>
-                )}
-                <CardHeader>
-                  <CardTitle className="text-xl">{policy.name}</CardTitle>
-                </CardHeader>
-                <CardContent className="flex-1">
-                  <p className="text-muted-foreground line-clamp-4">{policy.description}</p>
-                  <div className="absolute right-6 bottom-6 left-6">
-                    <p className="text-muted-foreground text-sm">
-                      Status: {policy.status}
-                      {policy.updatedAt && (
-                        <span className="ml-2">
-                          (Updated: {new Date(policy.updatedAt).toLocaleDateString()})
-                        </span>
-                      )}
-                    </p>
-                  </div>
-                </CardContent>
-              </Card>
+                <Card>
+                  {isCompleted && (
+                    <div className="bg-background/60 absolute inset-0 z-10 flex items-center justify-center backdrop-blur-[2px]">
+                      <Text weight="medium">Completed</Text>
+                    </div>
+                  )}
+                  <CardHeader>
+                    <CardTitle>{policy.name}</CardTitle>
+                  </CardHeader>
+                  <CardContent>
+                    <div className="flex min-h-[120px] flex-col justify-between gap-4">
+                      <p className="text-muted-foreground line-clamp-4">{policy.description}</p>
+                      <div>
+                        <Text variant="muted" size="sm">
+                          Status: {policy.status}
+                          {policy.updatedAt && (
+                            <span className="ml-2">
+                              (Updated: {new Date(policy.updatedAt).toLocaleDateString()})
+                            </span>
+                          )}
+                        </Text>
+                      </div>
+                    </div>
+                  </CardContent>
+                </Card>
+              </div>
             );
           })}
         </div>
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyList.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyList.tsx
index 59441fe6c..9e12e8454 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyList.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PolicyList.tsx
@@ -13,9 +13,5 @@ interface PolicyListProps {
 }
 
 export function PolicyList({ policies, member }: PolicyListProps) {
-  return (
-    <div className="mx-auto w-full max-w-[1400px]">
-      <PolicyContainer policies={policies} member={member} />
-    </div>
-  );
+  return <PolicyContainer policies={policies} member={member} />;
 }
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PortalPdfViewer.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PortalPdfViewer.tsx
index 6396da781..c07193ad0 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PortalPdfViewer.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/policy/PortalPdfViewer.tsx
@@ -1,7 +1,16 @@
 'use client';
 
-import { Card, CardContent } from '@comp/ui/card';
-import { FileText, Loader2 } from 'lucide-react';
+import {
+  Card,
+  CardContent,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyMedia,
+  EmptyTitle,
+  Text,
+} from '@trycompai/design-system';
+import { Document } from '@trycompai/design-system/icons';
 import { useAction } from 'next-safe-action/hooks';
 import { useEffect, useState } from 'react';
 import { toast } from 'sonner';
@@ -41,8 +50,8 @@ export function PortalPdfViewer({ policyId, s3Key, versionId }: PortalPdfViewerP
 
   if (isLoading) {
     return (
-      <div className="flex h-[500px] w-full items-center justify-center rounded-md border">
-        <Loader2 className="h-8 w-8 animate-spin text-muted-foreground" />
+      <div className="flex min-h-[320px] w-full items-center justify-center rounded-md border border-border md:min-h-[420px]">
+        <Text variant="muted">Loading policy document...</Text>
       </div>
     );
   }
@@ -52,7 +61,7 @@ export function PortalPdfViewer({ policyId, s3Key, versionId }: PortalPdfViewerP
       <iframe
         key={signedUrl}
         src={signedUrl}
-        className="h-[500px] w-full rounded-md border"
+        className="h-[60vh] min-h-[320px] w-full rounded-md border border-border md:min-h-[420px]"
         title="Policy Document"
       />
     );
@@ -60,13 +69,19 @@ export function PortalPdfViewer({ policyId, s3Key, versionId }: PortalPdfViewerP
 
   // Fallback UI if there's no PDF or an error occurs
   return (
-    <Card className="flex h-[500px] w-full flex-col items-center justify-center">
-      <CardContent className="text-center">
-        <FileText className="mx-auto h-12 w-12 text-muted-foreground" />
-        <p className="mt-4 font-semibold">PDF Document Not Available</p>
-        <p className="text-sm text-muted-foreground">
-          This policy is stored as a PDF, but it could not be loaded.
-        </p>
+    <Card>
+      <CardContent>
+        <Empty>
+          <EmptyMedia variant="icon">
+            <Document size={24} />
+          </EmptyMedia>
+          <EmptyHeader>
+            <EmptyTitle>PDF Document Not Available</EmptyTitle>
+            <EmptyDescription>
+              This policy is stored as a PDF, but it could not be loaded.
+            </EmptyDescription>
+          </EmptyHeader>
+        </Empty>
       </CardContent>
     </Card>
   );
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/DeviceAgentAccordionItem.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/DeviceAgentAccordionItem.tsx
index 70b141776..cf3a4a7ce 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/DeviceAgentAccordionItem.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/DeviceAgentAccordionItem.tsx
@@ -7,16 +7,16 @@ import {
 } from '@/app/api/download-agent/constants';
 import { detectOSFromUserAgent, SupportedOS } from '@/utils/os';
 import { Accordion, AccordionContent, AccordionItem, AccordionTrigger } from '@comp/ui/accordion';
-import { Button } from '@comp/ui/button';
 import { Card, CardContent, CardHeader, CardTitle } from '@comp/ui/card';
 import { cn } from '@comp/ui/cn';
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@comp/ui/select';
 import type { Member } from '@db';
+import { Button } from '@trycompai/design-system';
 import { CheckCircle2, Circle, Download, Loader2, RefreshCw } from 'lucide-react';
 import { useEffect, useMemo, useState } from 'react';
 import { toast } from 'sonner';
-import { FleetPolicyItem } from './FleetPolicyItem';
 import type { FleetPolicy, Host } from '../../types';
+import { FleetPolicyItem } from './FleetPolicyItem';
 
 interface DeviceAgentAccordionItemProps {
   member: Member;
@@ -42,7 +42,10 @@ export function DeviceAgentAccordionItem({
   );
 
   const hasInstalledAgent = host !== null;
-  const failedPoliciesCount = useMemo(() => fleetPolicies.filter((policy) => policy.response !== 'pass').length, [fleetPolicies]);
+  const failedPoliciesCount = useMemo(
+    () => fleetPolicies.filter((policy) => policy.response !== 'pass').length,
+    [fleetPolicies],
+  );
 
   const isCompleted = hasInstalledAgent && failedPoliciesCount === 0;
 
@@ -144,7 +147,7 @@ export function DeviceAgentAccordionItem({
             <Circle className="text-muted-foreground h-5 w-5" />
           )}
           <span className={cn('text-base', isCompleted && 'text-muted-foreground line-through')}>
-            Download and install Comp AI Device Agent
+            Device Agent
           </span>
           {hasInstalledAgent && failedPoliciesCount > 0 && (
             <span className="text-amber-600 dark:text-amber-400 text-xs ml-auto">
@@ -183,13 +186,7 @@ export function DeviceAgentAccordionItem({
                         </SelectContent>
                       </Select>
                     )}
-                    <Button
-                      size="sm"
-                      variant="default"
-                      onClick={handleDownload}
-                      disabled={isDownloading || hasInstalledAgent}
-                      className="gap-2"
-                    >
+                    <Button onClick={handleDownload} disabled={isDownloading || hasInstalledAgent}>
                       {getButtonContent()}
                     </Button>
                   </div>
@@ -239,13 +236,11 @@ export function DeviceAgentAccordionItem({
                   <CardTitle className="text-lg">{host.computer_name}</CardTitle>
                   <Button
                     variant="ghost"
-                    size="icon"
-                    className="h-8 w-8"
                     onClick={handleRefresh}
                     disabled={isLoading}
-                    title="Refresh device information"
+                    iconLeft={<RefreshCw className={cn('h-4 w-4', isLoading && 'animate-spin')} />}
                   >
-                    <RefreshCw className={cn('h-4 w-4', isLoading && 'animate-spin')} />
+                    Refresh
                   </Button>
                 </div>
               </CardHeader>
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/FleetPolicyItem.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/FleetPolicyItem.tsx
index 1f2b5f93f..9af17492e 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/FleetPolicyItem.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/FleetPolicyItem.tsx
@@ -2,19 +2,27 @@
 
 import { useMemo, useState } from 'react';
 
-import { Button } from '@comp/ui/button';
 import { cn } from '@comp/ui/cn';
-import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@comp/ui/tooltip';
-import { CheckCircle2, HelpCircle, Image, MoreVertical, Trash, Upload, XCircle } from 'lucide-react';
 import {
   DropdownMenu,
   DropdownMenuContent,
   DropdownMenuItem,
   DropdownMenuTrigger,
 } from '@comp/ui/dropdown-menu';
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@comp/ui/tooltip';
+import { Button } from '@trycompai/design-system';
+import {
+  CheckCircle2,
+  HelpCircle,
+  Image as ImageIcon,
+  MoreVertical,
+  Trash,
+  Upload,
+  XCircle,
+} from 'lucide-react';
 import type { FleetPolicy } from '../../types';
-import { PolicyImageUploadModal } from './PolicyImageUploadModal';
 import { PolicyImagePreviewModal } from './PolicyImagePreviewModal';
+import { PolicyImageUploadModal } from './PolicyImageUploadModal';
 import { PolicyImageResetModal } from './PolicyImageResetModal';
 
 interface FleetPolicyItemProps {
@@ -35,7 +43,7 @@ export function FleetPolicyItem({ policy, organizationId, onRefresh }: FleetPoli
         return [
           {
             label: 'Preview images',
-            renderIcon: () => <Image className="mr-2 h-4 w-4" />,
+            renderIcon: () => <ImageIcon className="mr-2 h-4 w-4" />,
             onClick: () => setIsPreviewOpen(true),
           },
           {
@@ -54,8 +62,8 @@ export function FleetPolicyItem({ policy, organizationId, onRefresh }: FleetPoli
         label: 'Upload images',
         renderIcon: () => <Upload className="mr-2 h-4 w-4" />,
         onClick: () => setIsUploadOpen(true),
-      }
-    ]
+      },
+    ];
   }, [policy]);
 
   const hasActions = useMemo(() => actions.length > 0, [actions]);
@@ -74,7 +82,10 @@ export function FleetPolicyItem({ policy, organizationId, onRefresh }: FleetPoli
             <TooltipProvider>
               <Tooltip>
                 <TooltipTrigger asChild>
-                  <button type="button" className="text-muted-foreground hover:text-foreground transition-colors">
+                  <button
+                    type="button"
+                    className="text-muted-foreground hover:text-foreground transition-colors"
+                  >
                     <HelpCircle size={14} />
                   </button>
                 </TooltipTrigger>
@@ -112,11 +123,10 @@ export function FleetPolicyItem({ policy, organizationId, onRefresh }: FleetPoli
             <DropdownMenuTrigger asChild>
               <Button
                 variant="ghost"
-                size="sm"
-                className="h-8 w-8 p-0"
                 disabled={!hasActions}
+                iconLeft={<MoreVertical className="h-4 w-4" />}
               >
-                <MoreVertical className="h-4 w-4" />
+                Actions
               </Button>
             </DropdownMenuTrigger>
             <DropdownMenuContent align="end">
@@ -158,4 +168,4 @@ export function FleetPolicyItem({ policy, organizationId, onRefresh }: FleetPoli
       />
     </>
   );
-}
\ No newline at end of file
+}
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/GeneralTrainingAccordionItem.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/GeneralTrainingAccordionItem.tsx
index 8bd191937..3d79c3086 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/GeneralTrainingAccordionItem.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/GeneralTrainingAccordionItem.tsx
@@ -61,7 +61,7 @@ export function GeneralTrainingAccordionItem({
               hasCompletedGeneralTraining && 'text-muted-foreground line-through',
             )}
           >
-            Complete general security awareness training
+            Security Awareness Training
           </span>
           {hasCompletedGeneralTraining ? (
             <span className="text-muted-foreground ml-auto text-sm">Secure annually</span>
@@ -75,8 +75,8 @@ export function GeneralTrainingAccordionItem({
       <AccordionContent className="px-4 pb-4">
         <div className="space-y-4">
           <p className="text-muted-foreground text-sm">
-            Complete the general security awareness training videos to learn about best practices
-            for keeping company data secure.
+            Complete the security awareness training videos to learn about best practices for
+            keeping company data secure.
           </p>
 
           {/* Only show videos that are general training (sat- prefix) */}
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/PoliciesAccordionItem.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/PoliciesAccordionItem.tsx
index 25637a2bf..1ef20015f 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/PoliciesAccordionItem.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/PoliciesAccordionItem.tsx
@@ -2,9 +2,9 @@
 
 import { acceptAllPolicies } from '@/actions/accept-policies';
 import { AccordionContent, AccordionItem, AccordionTrigger } from '@comp/ui/accordion';
-import { Button } from '@comp/ui/button';
 import { cn } from '@comp/ui/cn';
 import type { Member, Policy, PolicyVersion } from '@db';
+import { Button } from '@trycompai/design-system';
 import { CheckCircle2, Circle, FileText } from 'lucide-react';
 import Link from 'next/link';
 import { useRouter } from 'next/navigation';
@@ -65,7 +65,7 @@ export function PoliciesAccordionItem({ policies, member }: PoliciesAccordionIte
           <span
             className={cn('text-base', hasAcceptedPolicies && 'text-muted-foreground line-through')}
           >
-            Accept security policies
+            Security Policies
           </span>
         </div>
       </AccordionTrigger>
@@ -74,7 +74,7 @@ export function PoliciesAccordionItem({ policies, member }: PoliciesAccordionIte
           {policies.length > 0 ? (
             <>
               <p className="text-muted-foreground text-sm">
-                Please review and accept the following security policies:
+                Please review and accept the following policies:
               </p>
               <div>
                 {policies.map((policy) => {
@@ -95,7 +95,6 @@ export function PoliciesAccordionItem({ policies, member }: PoliciesAccordionIte
                 })}
               </div>
               <Button
-                size="sm"
                 onClick={handleAcceptAllPolicies}
                 disabled={hasAcceptedPolicies || isAcceptingAll}
               >
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/PolicyImagePreviewModal.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/PolicyImagePreviewModal.tsx
index 4d53de2f4..a9555f4e7 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/PolicyImagePreviewModal.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/PolicyImagePreviewModal.tsx
@@ -2,13 +2,7 @@
 
 import { useEffect, useState } from 'react';
 
-import {
-  Dialog,
-  DialogContent,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle,
-} from '@comp/ui/dialog';
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@comp/ui/dialog';
 import Image from 'next/image';
 import { CarouselControls } from '../video/CarouselControls';
 
@@ -18,7 +12,11 @@ interface PolicyImagePreviewModalProps {
   images: string[];
 }
 
-export function PolicyImagePreviewModal({ open, images, onOpenChange }: PolicyImagePreviewModalProps) {
+export function PolicyImagePreviewModal({
+  open,
+  images,
+  onOpenChange,
+}: PolicyImagePreviewModalProps) {
   const [currentIndex, setCurrentIndex] = useState(0);
 
   useEffect(() => {
@@ -48,7 +46,7 @@ export function PolicyImagePreviewModal({ open, images, onOpenChange }: PolicyIm
 
           {hasImages && currentIndex >= 0 && currentIndex < images.length && (
             <>
-              <div className="overflow-hidden w-full h-[500px]">
+              <div className="h-[55vh] min-h-[280px] w-full overflow-hidden md:min-h-[420px]">
                 <Image
                   key={images[currentIndex]}
                   src={images[currentIndex]}
@@ -70,4 +68,4 @@ export function PolicyImagePreviewModal({ open, images, onOpenChange }: PolicyIm
       </DialogContent>
     </Dialog>
   );
-}
\ No newline at end of file
+}
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/video/CarouselControls.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/video/CarouselControls.tsx
index dd5660fec..b2ba431e7 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/video/CarouselControls.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/video/CarouselControls.tsx
@@ -1,4 +1,4 @@
-import { Button } from '@comp/ui/button';
+import { Button, Text } from '@trycompai/design-system';
 import { ChevronLeft, ChevronRight } from 'lucide-react';
 
 interface CarouselControlsProps {
@@ -28,9 +28,9 @@ export function CarouselControls({
         <ChevronLeft className="h-4 w-4" />
       </Button>
 
-      <div className="text-muted-foreground text-sm">
+      <Text variant="muted" size="sm">
         {currentIndex + 1} of {total}
-      </div>
+      </Text>
 
       <Button
         variant="outline"
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/video/VideoCarousel.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/video/VideoCarousel.tsx
index cf5daa5bb..e51869961 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/video/VideoCarousel.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/video/VideoCarousel.tsx
@@ -137,10 +137,6 @@ export function VideoCarousel({ videos }: VideoCarouselProps) {
             isMarkingComplete={isExecuting}
             onNext={isCurrentVideoCompleted && hasNextVideo ? goToNext : undefined}
             allVideosCompleted={allVideosCompleted} // Use local state for UI
-            onWatchAgain={() => {
-              // Reset the rewatching state if needed inside YoutubeEmbed
-              // No direct action needed here unless YoutubeEmbed needs reset
-            }}
           />
           <CarouselControls
             currentIndex={currentIndex}
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/components/video/YoutubeEmbed.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/components/video/YoutubeEmbed.tsx
index ee30171d2..50fbceddf 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/components/video/YoutubeEmbed.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/components/video/YoutubeEmbed.tsx
@@ -1,7 +1,7 @@
 'use client';
 
-import { Button } from '@comp/ui/button';
 import type { EmployeeTrainingVideoCompletion } from '@db';
+import { Button } from '@trycompai/design-system';
 import { ArrowRight, Check, Loader2 } from 'lucide-react';
 import { useState } from 'react';
 
@@ -27,7 +27,6 @@ interface YoutubeEmbedProps {
   onNext?: () => void;
   allVideosCompleted: boolean;
   isMarkingComplete: boolean;
-  onWatchAgain: () => void;
 }
 
 export function YoutubeEmbed({
@@ -37,7 +36,6 @@ export function YoutubeEmbed({
   onNext,
   allVideosCompleted,
   isMarkingComplete,
-  onWatchAgain,
 }: YoutubeEmbedProps) {
   const [isRewatching, setIsRewatching] = useState(false);
 
@@ -53,7 +51,6 @@ export function YoutubeEmbed({
             variant={isCompleted ? 'secondary' : 'default'}
             onClick={onComplete}
             disabled={isCompleted}
-            className="gap-2"
           >
             {isMarkingComplete ? (
               <>
@@ -76,13 +73,13 @@ export function YoutubeEmbed({
               <Check className="text-primary mx-auto h-12 w-12" />
               <h3 className="text-xl font-semibold">Video Completed</h3>
               <div className="flex justify-center gap-2">
-                <Button variant="outline" onClick={() => setIsRewatching(true)} className="gap-2">
+                <Button variant="outline" onClick={() => setIsRewatching(true)}>
                   Watch Again
                 </Button>
                 {onNext && (
-                  <Button onClick={onNext} className="gap-2">
+                  <Button onClick={onNext}>
                     Next Video
-                    <ArrowRight className="h-4 w-4" />
+                    <ArrowRight className="ml-2 h-4 w-4" />
                   </Button>
                 )}
               </div>
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/documents/[formType]/PortalFormClient.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/documents/[formType]/PortalFormClient.tsx
new file mode 100644
index 000000000..38528bd75
--- /dev/null
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/documents/[formType]/PortalFormClient.tsx
@@ -0,0 +1,224 @@
+'use client';
+
+import {
+  Button,
+  Field,
+  FieldGroup,
+  FieldLabel,
+  Input,
+  PageHeader,
+  Section,
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+  Stack,
+  Text,
+  Textarea,
+} from '@trycompai/design-system';
+import Link from 'next/link';
+import { useParams } from 'next/navigation';
+import { useState } from 'react';
+
+type FieldDef = {
+  key: string;
+  label: string;
+  type: string;
+  required: boolean;
+  placeholder?: string;
+  description?: string;
+  options?: ReadonlyArray<{ label: string; value: string }>;
+  accept?: string;
+};
+
+interface PortalFormClientProps {
+  formTitle: string;
+  formDescription: string;
+  fields: ReadonlyArray<FieldDef>;
+  submitAction: (formData: FormData) => Promise<void>;
+  successMessage?: boolean;
+  errorMessage?: string;
+}
+
+export function PortalFormClient({
+  formTitle,
+  formDescription,
+  fields,
+  submitAction,
+  successMessage,
+  errorMessage,
+}: PortalFormClientProps) {
+  const params = useParams<{ orgId: string }>();
+  const [selectedFiles, setSelectedFiles] = useState<Record<string, string>>({});
+
+  const isCompact = (f: FieldDef) => f.type === 'text' || f.type === 'date' || f.type === 'select';
+
+  // Sort compact fields: dates first, then the rest (matches app behavior)
+  const compactFields = (() => {
+    const compact = fields.filter(isCompact);
+    const dateFields = compact.filter((f) => f.type === 'date');
+    const nonDateFields = compact.filter((f) => f.type !== 'date');
+    return [...dateFields, ...nonDateFields];
+  })();
+
+  const fullWidthFields = fields.filter((f) => !isCompact(f));
+
+  return (
+    <Stack gap="lg">
+      <PageHeader title={`New ${formTitle} Submission`} />
+      <Text variant="muted">{formDescription}</Text>
+
+      {successMessage && (
+        <div className="rounded-md border border-green-300 bg-green-50 p-3 text-sm text-green-700 dark:border-green-800 dark:bg-green-950/30 dark:text-green-400">
+          Submission saved successfully.
+        </div>
+      )}
+
+      {errorMessage && (
+        <div className="rounded-md border border-red-300 bg-red-50 p-3 text-sm text-red-700 dark:border-red-800 dark:bg-red-950/30 dark:text-red-400">
+          {errorMessage}
+        </div>
+      )}
+
+      <Section>
+        <form action={submitAction} className="space-y-6">
+          {/* Compact fields (text, date, select) in 2-column grid */}
+          {compactFields.length > 0 && (
+            <FieldGroup>
+              <div className="grid grid-cols-1 gap-4 lg:grid-cols-2">
+                {compactFields.map((field) => (
+                  <Field key={field.key}>
+                    <FieldLabel htmlFor={field.key}>{field.label}</FieldLabel>
+                    {field.description && (
+                      <Text size="sm" variant="muted">
+                        {field.description}
+                      </Text>
+                    )}
+
+                    {field.type === 'text' && (
+                      <Input
+                        id={field.key}
+                        name={field.key}
+                        required={field.required}
+                        placeholder={field.placeholder}
+                      />
+                    )}
+
+                    {field.type === 'date' && (
+                      <Input
+                        id={field.key}
+                        name={field.key}
+                        type="date"
+                        required={field.required}
+                      />
+                    )}
+
+                    {field.type === 'select' && (
+                      <Select name={field.key} required={field.required}>
+                        <SelectTrigger>
+                          <SelectValue placeholder={`Select ${field.label.toLowerCase()}`} />
+                        </SelectTrigger>
+                        <SelectContent>
+                          {(field.options ?? []).map((option) => (
+                            <SelectItem key={option.value} value={option.value}>
+                              {option.label}
+                            </SelectItem>
+                          ))}
+                        </SelectContent>
+                      </Select>
+                    )}
+                  </Field>
+                ))}
+              </div>
+            </FieldGroup>
+          )}
+
+          {/* Full-width fields (textarea, file) */}
+          {fullWidthFields.length > 0 && (
+            <FieldGroup>
+              {fullWidthFields.map((field) => (
+                <Field key={field.key}>
+                  <FieldLabel htmlFor={field.key}>{field.label}</FieldLabel>
+                  {field.description && (
+                    <Text size="sm" variant="muted">
+                      {field.description}
+                    </Text>
+                  )}
+
+                  {field.type === 'textarea' && (
+                    <div className="space-y-3">
+                      <Textarea
+                        id={field.key}
+                        name={field.key}
+                        style={{
+                          width: '100%',
+                          maxWidth: 'none',
+                          maxHeight: '350px',
+                          minHeight: '350px',
+                        }}
+                        required={field.required}
+                        placeholder={field.placeholder}
+                        rows={12}
+                      />
+                      <p className="text-xs text-muted-foreground">
+                        10,000 character limit &bull; Markdown supported
+                      </p>
+                    </div>
+                  )}
+
+                  {field.type === 'file' && (
+                    <div className="space-y-2">
+                      <label htmlFor={field.key} className="block cursor-pointer">
+                        <div className="rounded-md border-2 border-dashed border-border bg-muted/20 p-6 text-center transition hover:bg-muted/40">
+                          <p className="text-sm font-medium text-foreground">
+                            Drop file here or click to upload
+                          </p>
+                          <p className="mt-1 text-xs text-muted-foreground">
+                            Maximum file size: 100 MB
+                          </p>
+                        </div>
+                      </label>
+                      <input
+                        id={field.key}
+                        name={field.key}
+                        type="file"
+                        required={field.required}
+                        accept={field.accept}
+                        className="sr-only"
+                        onChange={(event) => {
+                          const selectedFile = event.target.files?.[0];
+                          setSelectedFiles((current) => ({
+                            ...current,
+                            [field.key]: selectedFile?.name ?? '',
+                          }));
+                        }}
+                      />
+                      {selectedFiles[field.key] && (
+                        <Text size="sm" variant="muted">
+                          Selected: {selectedFiles[field.key]}
+                        </Text>
+                      )}
+                      <Text size="sm" variant="muted">
+                        Accepted: {field.accept ?? 'all file types'}
+                      </Text>
+                    </div>
+                  )}
+                </Field>
+              ))}
+            </FieldGroup>
+          )}
+
+          <div className="flex items-center justify-between">
+            <Link href={`/${params.orgId}`}>
+              <Button type="button" variant="ghost">
+                Cancel
+              </Button>
+            </Link>
+            <Button type="submit">Submit form</Button>
+          </div>
+        </form>
+      </Section>
+    </Stack>
+  );
+}
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/documents/[formType]/page.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/documents/[formType]/page.tsx
new file mode 100644
index 000000000..d165325da
--- /dev/null
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/documents/[formType]/page.tsx
@@ -0,0 +1,211 @@
+import { auth } from '@/app/lib/auth';
+import { env } from '@/env.mjs';
+import { db } from '@db';
+import { Breadcrumb, PageLayout } from '@trycompai/design-system';
+import { isRedirectError } from 'next/dist/client/components/redirect-error';
+import { headers as getHeaders } from 'next/headers';
+import Link from 'next/link';
+import { notFound, redirect } from 'next/navigation';
+import { evidenceFormDefinitions, evidenceFormTypeSchema } from '../forms';
+import { PortalFormClient } from './PortalFormClient';
+
+const MAX_FILE_SIZE_BYTES = 100 * 1024 * 1024;
+
+async function getJwtToken(cookieHeader: string): Promise<string | null> {
+  if (!cookieHeader) return null;
+
+  try {
+    // Use the main app's auth URL — the API validates JWTs against the main
+    // app's JWKS, so the token must be issued by the main app, not the portal.
+    const authUrl = env.APP_AUTH_URL || 'http://localhost:3000';
+    const tokenResponse = await fetch(`${authUrl}/api/auth/token`, {
+      method: 'GET',
+      headers: { Cookie: cookieHeader },
+    });
+
+    if (!tokenResponse.ok) return null;
+
+    const tokenData = await tokenResponse.json();
+    return tokenData?.token ?? null;
+  } catch (error) {
+    console.warn('Failed to get JWT token:', error);
+    return null;
+  }
+}
+
+export default async function PortalCompanyFormPage({
+  params,
+  searchParams,
+}: {
+  params: Promise<{ orgId: string; formType: string }>;
+  searchParams: Promise<{ success?: string; error?: string }>;
+}) {
+  const { orgId, formType } = await params;
+  const parsedType = evidenceFormTypeSchema.safeParse(formType);
+  if (!parsedType.success) {
+    notFound();
+  }
+
+  const formTypeValue = parsedType.data;
+  const form = evidenceFormDefinitions[formTypeValue];
+  if (!form.portalAccessible) {
+    notFound();
+  }
+
+  const organization = await db.organization.findUnique({
+    where: { id: orgId },
+    select: {
+      whistleblowerReportEnabled: true,
+      accessRequestFormEnabled: true,
+    },
+  });
+  if (!organization) {
+    notFound();
+  }
+  if (formTypeValue === 'whistleblower-report' && !organization.whistleblowerReportEnabled) {
+    notFound();
+  }
+  if (formTypeValue === 'access-request' && !organization.accessRequestFormEnabled) {
+    notFound();
+  }
+  const visibleFields = form.fields;
+  const basePath = `/${orgId}/documents/${formTypeValue}`;
+  const state = await searchParams;
+
+  async function submitAction(formData: FormData) {
+    'use server';
+
+    const reqHeaders = await getHeaders();
+    const session = await auth.api.getSession({ headers: reqHeaders });
+
+    if (!session?.user?.id) {
+      redirect('/auth');
+    }
+
+    const apiUrl = env.NEXT_PUBLIC_API_URL || 'http://localhost:3333';
+    const cookie = reqHeaders.get('cookie') ?? '';
+
+    // Get JWT token for API authentication
+    const jwtToken = await getJwtToken(cookie);
+    if (!jwtToken) {
+      redirect(`${basePath}?error=${encodeURIComponent('Failed to authenticate with API')}`);
+    }
+
+    const apiHeaders = {
+      'Content-Type': 'application/json',
+      'X-Organization-Id': orgId,
+      Authorization: `Bearer ${jwtToken}`,
+    };
+
+    try {
+      // Build the submission payload
+      const payload: Record<string, unknown> = {};
+      payload.submissionDate = new Date().toISOString();
+
+      for (const field of visibleFields) {
+        if (field.type === 'file') {
+          const raw = formData.get(field.key);
+          if (!(raw instanceof File) || raw.size === 0) {
+            if (field.required) {
+              throw new Error(`${field.label} is required`);
+            }
+            continue;
+          }
+          if (raw.size > MAX_FILE_SIZE_BYTES) {
+            throw new Error(`File exceeds the ${MAX_FILE_SIZE_BYTES / (1024 * 1024)}MB limit`);
+          }
+
+          // Upload file via API
+          const fileBuffer = Buffer.from(await raw.arrayBuffer());
+          const fileBase64 = fileBuffer.toString('base64');
+
+          const uploadRes = await fetch(`${apiUrl}/v1/evidence-forms/uploads`, {
+            method: 'POST',
+            headers: apiHeaders,
+            body: JSON.stringify({
+              formType: formTypeValue,
+              fileName: raw.name,
+              fileType: raw.type || 'application/octet-stream',
+              fileData: fileBase64,
+            }),
+          });
+
+          if (!uploadRes.ok) {
+            const errorText = await uploadRes.text();
+            throw new Error(`File upload failed: ${errorText}`);
+          }
+
+          const uploadData = await uploadRes.json();
+          payload[field.key] = uploadData;
+          continue;
+        }
+
+        const value = String(formData.get(field.key) ?? '').trim();
+        if (field.required && value.length === 0) {
+          throw new Error(`${field.label} is required`);
+        }
+        if (value.length > 0) {
+          payload[field.key] = value;
+        }
+      }
+
+      // Submit via API
+      const submitRes = await fetch(`${apiUrl}/v1/evidence-forms/${formTypeValue}/submissions`, {
+        method: 'POST',
+        headers: apiHeaders,
+        body: JSON.stringify(payload),
+      });
+
+      if (!submitRes.ok) {
+        const errorText = await submitRes.text();
+        throw new Error(`Submission failed: ${errorText}`);
+      }
+
+      redirect(`${basePath}/submissions?success=1`);
+    } catch (error) {
+      // Next.js redirect throws a special error — re-throw it
+      if (isRedirectError(error)) {
+        throw error;
+      }
+      const errorMessage = error instanceof Error ? error.message : 'Failed to submit form';
+      redirect(`${basePath}?error=${encodeURIComponent(errorMessage)}`);
+    }
+  }
+
+  // Serialize fields to plain objects for client component
+  const serializedFields = visibleFields.map((field) => ({
+    key: field.key,
+    label: field.label,
+    type: field.type,
+    required: field.required,
+    ...(field.placeholder ? { placeholder: field.placeholder } : {}),
+    ...(field.description ? { description: field.description } : {}),
+    ...(field.options
+      ? { options: field.options.map((o) => ({ label: o.label, value: o.value })) }
+      : {}),
+    ...(field.accept ? { accept: field.accept } : {}),
+  }));
+
+  return (
+    <PageLayout>
+      <Breadcrumb
+        items={[
+          {
+            label: 'Employee Portal',
+            href: `/${orgId}`,
+            props: { render: <Link href={`/${orgId}`} /> },
+          },
+          { label: form.title, isCurrent: true },
+        ]}
+      />
+      <PortalFormClient
+        formTitle={form.title}
+        formDescription={form.description}
+        fields={serializedFields}
+        submitAction={submitAction}
+        successMessage={state.success === '1'}
+        errorMessage={state.error ? decodeURIComponent(state.error) : undefined}
+      />
+    </PageLayout>
+  );
+}
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/documents/[formType]/submissions/PortalSubmissionsClient.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/documents/[formType]/submissions/PortalSubmissionsClient.tsx
new file mode 100644
index 000000000..3fd9bd420
--- /dev/null
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/documents/[formType]/submissions/PortalSubmissionsClient.tsx
@@ -0,0 +1,138 @@
+'use client';
+
+import {
+  Button,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  PageHeader,
+  Stack,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+  Text,
+} from '@trycompai/design-system';
+import Link from 'next/link';
+
+type SubmissionRow = {
+  id: string;
+  submittedAt: string;
+  status: string;
+  reviewReason: string | null;
+};
+
+interface PortalSubmissionsClientProps {
+  orgId: string;
+  formType: string;
+  formTitle: string;
+  submissions: SubmissionRow[];
+  showSuccess: boolean;
+}
+
+function StatusBadge({ status }: { status: string }) {
+  switch (status) {
+    case 'approved':
+      return (
+        <span className="inline-flex items-center rounded-full bg-green-50 px-2 py-0.5 text-xs font-medium text-green-700 dark:bg-green-950/30 dark:text-green-400">
+          Approved
+        </span>
+      );
+    case 'rejected':
+      return (
+        <span className="inline-flex items-center rounded-full bg-red-50 px-2 py-0.5 text-xs font-medium text-red-700 dark:bg-red-950/30 dark:text-red-400">
+          Rejected
+        </span>
+      );
+    default:
+      return (
+        <span className="inline-flex items-center rounded-full bg-yellow-50 px-2 py-0.5 text-xs font-medium text-yellow-700 dark:bg-yellow-950/30 dark:text-yellow-400">
+          Pending
+        </span>
+      );
+  }
+}
+
+const dateFormatter = new Intl.DateTimeFormat('en-US', {
+  month: '2-digit',
+  day: '2-digit',
+  year: 'numeric',
+});
+
+function formatDate(value: unknown): string {
+  if (typeof value !== 'string') return '—';
+  const parsed = new Date(value);
+  if (Number.isNaN(parsed.getTime())) return '—';
+  return dateFormatter.format(parsed);
+}
+
+export function PortalSubmissionsClient({
+  orgId,
+  formType,
+  formTitle,
+  submissions,
+  showSuccess,
+}: PortalSubmissionsClientProps) {
+  return (
+    <Stack gap="lg">
+      <PageHeader title={`My ${formTitle} Submissions`} />
+      <Text variant="muted">
+        View the status of your submitted {formTitle.toLowerCase()} forms.
+      </Text>
+
+      {showSuccess && (
+        <div className="rounded-md border border-green-300 bg-green-50 p-3 text-sm text-green-700 dark:border-green-800 dark:bg-green-950/30 dark:text-green-400">
+          Submission saved successfully. It is now pending review.
+        </div>
+      )}
+
+      {submissions.length === 0 ? (
+        <Empty>
+          <EmptyHeader>
+            <EmptyTitle>No submissions yet</EmptyTitle>
+            <EmptyDescription>You have no submissions for this form yet.</EmptyDescription>
+          </EmptyHeader>
+          <div className="mt-4">
+            <Link href={`/${orgId}/documents/${formType}`}>
+              <Button>Create Submission</Button>
+            </Link>
+          </div>
+        </Empty>
+      ) : (
+        <Table variant="bordered">
+          <TableHeader>
+            <TableRow>
+              <TableHead>Date</TableHead>
+              <TableHead>Status</TableHead>
+              <TableHead>Review Reason</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {submissions.map((submission) => (
+              <TableRow key={submission.id}>
+                <TableCell>{formatDate(submission.submittedAt)}</TableCell>
+                <TableCell>
+                  <StatusBadge status={submission.status} />
+                </TableCell>
+                <TableCell>
+                  <span className="text-muted-foreground text-sm">
+                    {submission.reviewReason || '—'}
+                  </span>
+                </TableCell>
+              </TableRow>
+            ))}
+          </TableBody>
+        </Table>
+      )}
+
+      <div className="flex items-center gap-3">
+        <Link href={`/${orgId}/documents/${formType}`}>
+          <Button>New Submission</Button>
+        </Link>
+      </div>
+    </Stack>
+  );
+}
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/documents/[formType]/submissions/page.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/documents/[formType]/submissions/page.tsx
new file mode 100644
index 000000000..52e4877f5
--- /dev/null
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/documents/[formType]/submissions/page.tsx
@@ -0,0 +1,151 @@
+import { auth } from '@/app/lib/auth';
+import { env } from '@/env.mjs';
+import { db } from '@db';
+import { Breadcrumb, PageLayout } from '@trycompai/design-system';
+import { headers as getHeaders } from 'next/headers';
+import Link from 'next/link';
+import { notFound, redirect } from 'next/navigation';
+import { evidenceFormDefinitions, evidenceFormTypeSchema } from '../../forms';
+import { PortalSubmissionsClient } from './PortalSubmissionsClient';
+
+type SubmissionRow = {
+  id: string;
+  formType: string;
+  submittedAt: string;
+  status: string;
+  reviewReason: string | null;
+  reviewedAt: string | null;
+  data: Record<string, unknown>;
+  reviewedBy?: {
+    name: string | null;
+    email: string;
+  } | null;
+};
+
+async function getJwtToken(cookieHeader: string): Promise<string | null> {
+  if (!cookieHeader) return null;
+
+  try {
+    const authUrl = env.APP_AUTH_URL || 'http://localhost:3000';
+    const tokenResponse = await fetch(`${authUrl}/api/auth/token`, {
+      method: 'GET',
+      headers: { Cookie: cookieHeader },
+    });
+
+    if (!tokenResponse.ok) return null;
+
+    const tokenData = await tokenResponse.json();
+    return tokenData?.token ?? null;
+  } catch {
+    return null;
+  }
+}
+
+export default async function PortalSubmissionsPage({
+  params,
+  searchParams,
+}: {
+  params: Promise<{ orgId: string; formType: string }>;
+  searchParams: Promise<{ success?: string }>;
+}) {
+  const { orgId, formType } = await params;
+  const queryParams = await searchParams;
+  const parsedType = evidenceFormTypeSchema.safeParse(formType);
+  if (!parsedType.success) {
+    notFound();
+  }
+
+  const formTypeValue = parsedType.data;
+  const form = evidenceFormDefinitions[formTypeValue];
+  if (!form.portalAccessible) {
+    notFound();
+  }
+
+  const organization = await db.organization.findUnique({
+    where: { id: orgId },
+    select: {
+      whistleblowerReportEnabled: true,
+      accessRequestFormEnabled: true,
+    },
+  });
+  if (!organization) {
+    notFound();
+  }
+  if (formTypeValue === 'whistleblower-report' && !organization.whistleblowerReportEnabled) {
+    notFound();
+  }
+  if (formTypeValue === 'access-request' && !organization.accessRequestFormEnabled) {
+    notFound();
+  }
+
+  const reqHeaders = await getHeaders();
+  const session = await auth.api.getSession({ headers: reqHeaders });
+
+  if (!session?.user?.id) {
+    redirect('/auth');
+  }
+
+  const apiUrl = env.NEXT_PUBLIC_API_URL || 'http://localhost:3333';
+  const cookie = reqHeaders.get('cookie') ?? '';
+  const jwtToken = await getJwtToken(cookie);
+
+  let submissions: SubmissionRow[] = [];
+
+  if (jwtToken) {
+    try {
+      const res = await fetch(
+        `${apiUrl}/v1/evidence-forms/my-submissions?formType=${formTypeValue}`,
+        {
+          method: 'GET',
+          headers: {
+            'Content-Type': 'application/json',
+            'X-Organization-Id': orgId,
+            Authorization: `Bearer ${jwtToken}`,
+          },
+          cache: 'no-store',
+        },
+      );
+
+      if (res.ok) {
+        submissions = await res.json();
+      }
+    } catch {
+      // Silently fail - show empty list
+    }
+  }
+
+  // Serialize only what the client component needs
+  const serializedSubmissions = submissions.map((s) => ({
+    id: s.id,
+    submittedAt: s.submittedAt,
+    status: s.status,
+    reviewReason: s.reviewReason,
+  }));
+
+  return (
+    <PageLayout>
+      <Breadcrumb
+        items={[
+          {
+            label: 'Employee Portal',
+            href: `/${orgId}`,
+            props: { render: <Link href={`/${orgId}`} /> },
+          },
+          {
+            label: form.title,
+            href: `/${orgId}/documents/${formTypeValue}`,
+            props: { render: <Link href={`/${orgId}/documents/${formTypeValue}`} /> },
+          },
+          { label: 'My Submissions', isCurrent: true },
+        ]}
+      />
+      <PortalSubmissionsClient
+        orgId={orgId}
+        formType={formTypeValue}
+        formTitle={form.title}
+        submissions={serializedSubmissions}
+        showSuccess={queryParams.success === '1'}
+      />
+    </PageLayout>
+  );
+}
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/documents/forms.ts b/apps/portal/src/app/(app)/(home)/[orgId]/documents/forms.ts
new file mode 100644
index 000000000..8e190badc
--- /dev/null
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/documents/forms.ts
@@ -0,0 +1,12 @@
+// Single source of truth: re-export from shared @comp/company package
+export {
+  evidenceFormDefinitionList,
+  evidenceFormDefinitions,
+  evidenceFormFileSchema,
+  evidenceFormSubmissionSchemaMap,
+  evidenceFormTypeSchema,
+  type EvidenceFormDefinition,
+  type EvidenceFormFieldDefinition,
+  type EvidenceFormFile,
+  type EvidenceFormType,
+} from '@comp/company';
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/page.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/page.tsx
index 4056bbebf..28848d07c 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/page.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/page.tsx
@@ -4,6 +4,7 @@ import { auth } from '@/app/lib/auth';
 import { getFleetInstance } from '@/utils/fleet';
 import type { FleetPolicyResult, Member } from '@db';
 import { db } from '@db';
+import { PageHeader, PageLayout } from '@trycompai/design-system';
 import { headers } from 'next/headers';
 import { redirect } from 'next/navigation';
 import { OrganizationDashboard } from './components/OrganizationDashboard';
@@ -57,13 +58,16 @@ export default async function OrganizationPage({ params }: { params: Promise<{ o
   const fleetData = await getFleetPolicies(member);
 
   return (
-    <OrganizationDashboard
-      key={orgId}
-      organizationId={orgId}
-      member={member}
-      fleetPolicies={fleetData.fleetPolicies}
-      host={fleetData.device}
-    />
+    <PageLayout>
+      <PageHeader title="Comp AI - Employee Portal" />
+      <OrganizationDashboard
+        key={orgId}
+        organizationId={orgId}
+        member={member}
+        fleetPolicies={fleetData.fleetPolicies}
+        host={fleetData.device}
+      />
+    </PageLayout>
   );
 }
 
@@ -111,12 +115,17 @@ const getFleetPolicies = async (
     return {
       device,
       fleetPolicies: fleetPolicies.map((policy) => {
-        const policyResult = fleetPolicyResults.find((result) => result.fleetPolicyId === policy.id);
+        const policyResult = fleetPolicyResults.find(
+          (result) => result.fleetPolicyId === policy.id,
+        );
         return {
           ...policy,
-          response: policy.response === 'pass' || policyResult?.fleetPolicyResponse === 'pass' ? 'pass' : 'fail',
+          response:
+            policy.response === 'pass' || policyResult?.fleetPolicyResponse === 'pass'
+              ? 'pass'
+              : 'fail',
           attachments: policyResult?.attachments || [],
-        }
+        };
       }),
     };
   } catch (error: any) {
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/policy/[policyId]/PolicyAcceptButton.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/policy/[policyId]/PolicyAcceptButton.tsx
index 1d049cc3b..9a0190caa 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/policy/[policyId]/PolicyAcceptButton.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/policy/[policyId]/PolicyAcceptButton.tsx
@@ -1,7 +1,7 @@
 'use client';
 
 import { acceptPolicy } from '@/actions/accept-policies';
-import { Button } from '@comp/ui/button';
+import { Button } from '@trycompai/design-system';
 import { Check } from 'lucide-react';
 import { useRouter } from 'next/navigation';
 import { useState, useTransition } from 'react';
@@ -48,16 +48,19 @@ export function PolicyAcceptButton({
 
   if (accepted) {
     return (
-      <Button disabled className="w-full">
-        <Check className="mr-2 h-4 w-4" />
-        Policy Accepted
-      </Button>
+      <div className="w-full">
+        <Button disabled iconLeft={<Check className="h-4 w-4" />}>
+          Policy Accepted
+        </Button>
+      </div>
     );
   }
 
   return (
-    <Button onClick={handleAccept} disabled={isPending} className="w-full">
-      {isPending ? 'Accepting...' : 'Accept Policy'}
-    </Button>
+    <div className="w-full">
+      <Button onClick={handleAccept} disabled={isPending}>
+        {isPending ? 'Accepting...' : 'Accept Policy'}
+      </Button>
+    </div>
   );
 }
diff --git a/apps/portal/src/app/(app)/(home)/[orgId]/policy/[policyId]/page.tsx b/apps/portal/src/app/(app)/(home)/[orgId]/policy/[policyId]/page.tsx
index 158e1648d..d817a5c2c 100644
--- a/apps/portal/src/app/(app)/(home)/[orgId]/policy/[policyId]/page.tsx
+++ b/apps/portal/src/app/(app)/(home)/[orgId]/policy/[policyId]/page.tsx
@@ -1,20 +1,28 @@
 import { auth } from '@/app/lib/auth';
+import { db } from '@db';
 import {
+  Badge,
+  Breadcrumb,
   Card,
   CardContent,
-  CardDescription,
   CardFooter,
-  CardHeader,
-  CardTitle,
-} from '@comp/ui/card';
-import { db } from '@db';
-import { ArrowLeft, Check } from 'lucide-react';
+  PageLayout,
+  Stack,
+  Text,
+} from '@trycompai/design-system';
 import { headers } from 'next/headers';
 import Link from 'next/link';
 import { redirect } from 'next/navigation';
 import { PolicyAcceptButton } from './PolicyAcceptButton';
 import PolicyViewer from './PolicyViewer';
 
+function formatPolicyStatus(status: string): string {
+  return status
+    .split('_')
+    .map((part) => part.charAt(0).toUpperCase() + part.slice(1).toLowerCase())
+    .join(' ');
+}
+
 export default async function PolicyPage({
   params,
 }: {
@@ -64,50 +72,55 @@ export default async function PolicyPage({
   const isAccepted = policy.signedBy.includes(member.id);
 
   return (
-    <div className="mx-auto max-w-6xl">
-      <div>
-        <Link href={`/${orgId}`} className="mb-4 inline-flex items-center gap-2 text-sm">
-          <ArrowLeft className="h-4 w-4" />
-          Back to Overview
-        </Link>
-      </div>
-
-      <Card className="shadow-md">
+    <PageLayout>
+      <Breadcrumb
+        items={[
+          {
+            label: 'Overview',
+            href: `/${orgId}`,
+            props: { render: <Link href={`/${orgId}`} /> },
+          },
+          { label: policy.name, isCurrent: true },
+        ]}
+      />
+      <Stack gap="md">
+        <div className="flex items-center gap-3">
+          <h1 className="text-2xl font-semibold tracking-tight">{policy.name}</h1>
+          <Badge variant="secondary">{formatPolicyStatus(policy.status)}</Badge>
+        </div>
+        {policy.description && (
+          <Text variant="muted" size="sm">
+            {policy.description}
+          </Text>
+        )}
         {isAccepted && (
-          <div className="bg-green-50 border-green-200 mb-4 flex items-center gap-2 rounded-t-xs border p-3">
-            <Check className="text-green-600 h-5 w-5" />
-            <span className="text-green-800 text-sm font-medium">
+          <div className="rounded-md border border-green-200 bg-green-50 px-4 py-4 sm:px-5 sm:py-4 dark:border-green-800 dark:bg-green-950/30">
+            <Text size="sm" weight="medium">
               You have accepted this policy
-            </span>
+            </Text>
           </div>
         )}
-        <CardHeader>
-          <CardTitle className="text-2xl">{policy.name}</CardTitle>
-          {policy.description && (
-            <CardDescription className="text-muted-foreground">
-              {policy.description}
-            </CardDescription>
-          )}
-        </CardHeader>
-        <CardContent>
-          <div className="prose max-w-none">
-            <PolicyViewer policy={policy} />
-          </div>
-          {policy.updatedAt && (
-            <p className="text-muted-foreground mt-6 text-sm">
-              Last updated: {new Date(policy.updatedAt).toLocaleDateString()}
-            </p>
-          )}
-        </CardContent>
-        <CardFooter>
-          <PolicyAcceptButton
-            policyId={policy.id}
-            memberId={member.id}
-            isAccepted={isAccepted}
-            orgId={orgId}
-          />
-        </CardFooter>
-      </Card>
-    </div>
+        <Card>
+          <CardContent>
+            <Stack gap="md">
+              <PolicyViewer policy={policy} />
+              {policy.updatedAt && (
+                <Text variant="muted" size="sm">
+                  Last updated: {new Date(policy.updatedAt).toLocaleDateString()}
+                </Text>
+              )}
+            </Stack>
+          </CardContent>
+          <CardFooter>
+            <PolicyAcceptButton
+              policyId={policy.id}
+              memberId={member.id}
+              isAccepted={isAccepted}
+              orgId={orgId}
+            />
+          </CardFooter>
+        </Card>
+      </Stack>
+    </PageLayout>
   );
 }
diff --git a/apps/portal/src/app/(app)/(home)/components/Overview.tsx b/apps/portal/src/app/(app)/(home)/components/Overview.tsx
index 19b6de364..fbc0d18db 100644
--- a/apps/portal/src/app/(app)/(home)/components/Overview.tsx
+++ b/apps/portal/src/app/(app)/(home)/components/Overview.tsx
@@ -7,7 +7,7 @@ import { redirect } from 'next/navigation';
 import { NoAccessMessage } from './NoAccessMessage';
 // Removed OrganizationSelector import
 import { auth } from '@/app/lib/auth';
-import { Card, CardContent, CardHeader, CardTitle } from '@comp/ui/card';
+import { Card, CardContent, CardHeader, CardTitle, Stack, Text } from '@trycompai/design-system';
 import Link from 'next/link';
 
 // Define the type for the member prop including the user and organization relations
@@ -66,8 +66,8 @@ export async function Overview() {
 
   // Render a dashboard for each valid membership
   return (
-    <div className="space-y-8">
-      <h1>Your Organizations</h1>
+    <Stack gap="lg">
+      <Text weight="medium">Your Organizations</Text>
       <div className="grid grid-cols-1 gap-4 md:grid-cols-2 lg:grid-cols-3">
         {validMemberships.map((member) => (
           <Link href={`/${member.organization.id}`} key={member.id}>
@@ -76,12 +76,12 @@ export async function Overview() {
                 <CardTitle>{member.organization.name}</CardTitle>
               </CardHeader>
               <CardContent>
-                <p>{member.user.name}</p>
+                <Text>{member.user.name}</Text>
               </CardContent>
             </Card>
           </Link>
         ))}
       </div>
-    </div>
+    </Stack>
   );
 }
diff --git a/apps/portal/src/app/(app)/(home)/layout.tsx b/apps/portal/src/app/(app)/(home)/layout.tsx
index 92050d399..7e5374a94 100644
--- a/apps/portal/src/app/(app)/(home)/layout.tsx
+++ b/apps/portal/src/app/(app)/(home)/layout.tsx
@@ -9,5 +9,5 @@ export default async function Layout({ children }: { children: React.ReactNode }
     return redirect('/auth');
   }
 
-  return <div className="mx-auto max-w-3xl">{children}</div>;
+  return <>{children}</>;
 }
diff --git a/apps/portal/src/app/(app)/(home)/page.tsx b/apps/portal/src/app/(app)/(home)/page.tsx
index 09b76c5d7..974682577 100644
--- a/apps/portal/src/app/(app)/(home)/page.tsx
+++ b/apps/portal/src/app/(app)/(home)/page.tsx
@@ -1,17 +1,32 @@
+import {
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  PageHeader,
+  PageLayout,
+} from '@trycompai/design-system';
 import type { Metadata } from 'next';
 import { Suspense } from 'react';
 import { Overview } from './components/Overview';
 
 export default function HomePage() {
   return (
-    <div className="space-y-6">
-      {/* Add loading states later if Overview becomes complex */}
-      <Suspense fallback={<div>Loading overview...</div>}>
-        {/* Pass searchParams to Overview */}
+    <PageLayout>
+      <PageHeader title="Employee Portal Overview" />
+      <Suspense
+        fallback={
+          <Empty>
+            <EmptyHeader>
+              <EmptyTitle>Loading overview...</EmptyTitle>
+              <EmptyDescription>Fetching your organizations and tasks.</EmptyDescription>
+            </EmptyHeader>
+          </Empty>
+        }
+      >
         <Overview />
       </Suspense>
-      {/* Other home page sections can go here */}
-    </div>
+    </PageLayout>
   );
 }
 
diff --git a/apps/portal/src/app/(app)/layout.tsx b/apps/portal/src/app/(app)/layout.tsx
index ce4d3ad67..a108cf048 100644
--- a/apps/portal/src/app/(app)/layout.tsx
+++ b/apps/portal/src/app/(app)/layout.tsx
@@ -8,20 +8,15 @@ export default async function Layout({ children }: { children: React.ReactNode }
     headers: await headers(),
   });
 
-  console.log('session', session);
-
   if (!session?.user) {
-    console.log('no session');
     redirect('/auth');
   }
 
   return (
     <div className="flex min-h-dvh">
       <div className="flex flex-1 flex-col">
-        <div className="w-full px-4 sm:px-6 lg:px-8">
-          <Header />
-        </div>
-        <main className="w-full flex-1 px-4 py-8 sm:px-6 lg:px-8">{children}</main>
+        <Header />
+        <main className="w-full min-w-0 flex-1 px-3 pt-4 sm:px-4 sm:pt-6 lg:px-6">{children}</main>
       </div>
     </div>
   );
diff --git a/apps/portal/src/app/(app)/unauthorized/page.tsx b/apps/portal/src/app/(app)/unauthorized/page.tsx
index aee37f7de..ecb132c99 100644
--- a/apps/portal/src/app/(app)/unauthorized/page.tsx
+++ b/apps/portal/src/app/(app)/unauthorized/page.tsx
@@ -1,7 +1,22 @@
+import {
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  PageLayout,
+} from '@trycompai/design-system';
+
 export default async function Unauthorized() {
   return (
-    <div>
-      <h1>We couldn't find an organization for you. Please contact your administrator.</h1>
-    </div>
+    <PageLayout>
+      <Empty>
+        <EmptyHeader>
+          <EmptyTitle>Organization not found</EmptyTitle>
+          <EmptyDescription>
+            We couldn't find an organization for your account. Please contact your administrator.
+          </EmptyDescription>
+        </EmptyHeader>
+      </Empty>
+    </PageLayout>
   );
 }
diff --git a/apps/portal/src/app/components/header.tsx b/apps/portal/src/app/components/header.tsx
index bee160bb1..bc42d7741 100644
--- a/apps/portal/src/app/components/header.tsx
+++ b/apps/portal/src/app/components/header.tsx
@@ -6,15 +6,18 @@ import { Suspense } from 'react';
 
 export async function Header() {
   return (
-    <header className="border-border bg-background/70 sticky top-0 z-10 flex items-center justify-between border-b pt-4 pb-2 backdrop-blur-xl backdrop-filter md:bg-transparent md:pb-4 md:backdrop-filter-none">
-      <Link href="/">
-        <Icons.Logo />
-      </Link>
+    <header className="border-border bg-background/70 sticky top-0 z-10 w-full border-b backdrop-blur-xl">
+      <div className="flex w-full items-center justify-between px-4 py-4 sm:px-6 lg:px-8">
+        <Link href="/" className="flex items-center gap-3">
+          <Icons.Logo />
+          <span className="text-lg font-medium">Comp AI - Employee Portal</span>
+        </Link>
 
-      <div className="flex items-center space-x-2">
-        <Suspense fallback={<Skeleton className="h-8 w-8 rounded-full" />}>
-          <UserMenu />
-        </Suspense>
+        <div className="flex items-center space-x-2">
+          <Suspense fallback={<Skeleton className="h-8 w-8 rounded-full" />}>
+            <UserMenu />
+          </Suspense>
+        </div>
       </div>
     </header>
   );
diff --git a/apps/portal/src/app/layout.tsx b/apps/portal/src/app/layout.tsx
index 0f5b82f9a..08a0eed51 100644
--- a/apps/portal/src/app/layout.tsx
+++ b/apps/portal/src/app/layout.tsx
@@ -2,7 +2,7 @@ import { auth } from '@/app/lib/auth';
 import { env } from '@/env.mjs';
 import { initializeServer } from '@comp/analytics/server';
 import { cn } from '@comp/ui/cn';
-import '@comp/ui/globals.css';
+import '@trycompai/design-system/globals.css';
 import { GeistMono } from 'geist/font/mono';
 import type { Metadata } from 'next';
 import localFont from 'next/font/local';
diff --git a/apps/portal/src/env.mjs b/apps/portal/src/env.mjs
index b023a9054..74f1759db 100644
--- a/apps/portal/src/env.mjs
+++ b/apps/portal/src/env.mjs
@@ -14,6 +14,7 @@ export const env = createEnv({
     AUTH_MICROSOFT_CLIENT_SECRET: z.string().optional(),
     AUTH_SECRET: z.string(),
     INTERNAL_API_TOKEN: z.string().optional(),
+    APP_AUTH_URL: z.string().optional(),
   },
 
   client: {
@@ -39,6 +40,7 @@ export const env = createEnv({
     AUTH_MICROSOFT_CLIENT_SECRET: process.env.AUTH_MICROSOFT_CLIENT_SECRET,
     AUTH_SECRET: process.env.AUTH_SECRET,
     INTERNAL_API_TOKEN: process.env.INTERNAL_API_TOKEN,
+    APP_AUTH_URL: process.env.APP_AUTH_URL,
   },
 
   skipValidation: !!process.env.CI || !!process.env.SKIP_ENV_VALIDATION,
diff --git a/apps/portal/src/styles/editor.css b/apps/portal/src/styles/editor.css
new file mode 100644
index 000000000..cf276db59
--- /dev/null
+++ b/apps/portal/src/styles/editor.css
@@ -0,0 +1,220 @@
+@reference "@trycompai/design-system/globals.css";
+
+/* Code block syntax highlighting */
+pre {
+  background: #0d0d0d;
+  color: #fff;
+  font-family: 'JetBrainsMono', monospace;
+  padding: 0.75rem 1rem;
+}
+
+pre code {
+  background: none;
+  color: inherit;
+  font-size: 0.8rem;
+  padding: 0;
+}
+
+pre .hljs-comment,
+pre .hljs-quote {
+  color: #616161;
+}
+
+pre .hljs-variable,
+pre .hljs-template-variable,
+pre .hljs-attribute,
+pre .hljs-tag,
+pre .hljs-name,
+pre .hljs-regexp,
+pre .hljs-link,
+pre .hljs-selector-id,
+pre .hljs-selector-class {
+  color: #f98181;
+}
+
+pre .hljs-number,
+pre .hljs-meta,
+pre .hljs-built_in,
+pre .hljs-builtin-name,
+pre .hljs-literal,
+pre .hljs-type,
+pre .hljs-params {
+  color: #fbbc88;
+}
+
+pre .hljs-string,
+pre .hljs-symbol,
+pre .hljs-bullet {
+  color: #b9f18d;
+}
+
+pre .hljs-title,
+pre .hljs-section {
+  color: #faf594;
+}
+
+pre .hljs-keyword,
+pre .hljs-selector-tag {
+  color: #70cff8;
+}
+
+pre .hljs-emphasis {
+  font-style: italic;
+}
+
+pre .hljs-strong {
+  font-weight: 700;
+}
+
+/* Base editor styles */
+.ProseMirror {
+  @apply w-full leading-relaxed;
+  height: var(--editor-height, 100%);
+  min-height: var(--editor-min-height, 350px);
+}
+
+.ProseMirror:focus {
+  @apply outline-hidden;
+}
+
+/* Typography - with proper spacing */
+.ProseMirror h1 {
+  @apply text-foreground mt-6 mb-4 text-xl font-semibold;
+}
+
+.ProseMirror h2 {
+  @apply text-foreground mt-6 mb-3 text-lg font-semibold;
+}
+
+.ProseMirror h3 {
+  @apply text-foreground mt-5 mb-2 text-base font-semibold;
+}
+
+.ProseMirror h4 {
+  @apply text-foreground mt-4 mb-2 text-sm font-semibold;
+}
+
+.ProseMirror h1:first-child,
+.ProseMirror h2:first-child,
+.ProseMirror h3:first-child,
+.ProseMirror h4:first-child {
+  @apply mt-0;
+}
+
+.ProseMirror p {
+  @apply text-foreground my-3 text-sm leading-relaxed;
+}
+
+/* Preserve empty paragraphs (new lines) */
+.ProseMirror p:empty,
+.ProseMirror p:has(> br:only-child) {
+  min-height: 1.5em;
+}
+
+/* Lists with colored bullets */
+.ProseMirror ul {
+  @apply my-4 ml-6 space-y-2;
+  list-style: none;
+}
+
+.ProseMirror ul > li {
+  @apply relative pl-4 text-sm leading-relaxed;
+}
+
+.ProseMirror ul > li::before {
+  content: '';
+  @apply bg-foreground absolute top-2 left-0 h-1.5 w-1.5 rounded-full;
+}
+
+.ProseMirror ol {
+  @apply my-4 ml-6 space-y-2;
+  list-style: none;
+  counter-reset: item;
+}
+
+.ProseMirror ol > li {
+  @apply relative pl-6 text-sm leading-relaxed;
+  counter-increment: item;
+}
+
+.ProseMirror ol > li::before {
+  content: counter(item) '.';
+  @apply text-muted-foreground absolute left-0 font-medium;
+}
+
+.ProseMirror li > p {
+  @apply m-0;
+}
+
+/* Nested lists */
+.ProseMirror ul ul,
+.ProseMirror ol ol,
+.ProseMirror ul ol,
+.ProseMirror ol ul {
+  @apply my-2;
+}
+
+/* Code blocks */
+.ProseMirror pre {
+  @apply bg-muted my-4 overflow-x-auto rounded-md p-4;
+}
+
+.ProseMirror code {
+  @apply font-mono text-sm;
+}
+
+/* Inline code */
+.ProseMirror :not(pre) > code {
+  @apply bg-muted rounded px-1.5 py-0.5;
+}
+
+/* Blockquotes */
+.ProseMirror blockquote {
+  @apply border-primary text-muted-foreground my-4 border-l-4 pl-4 italic;
+}
+
+/* Task lists */
+.ProseMirror ul[data-type='taskList'] {
+  @apply ml-0 list-none p-0;
+}
+
+.ProseMirror ul[data-type='taskList'] > li {
+  @apply flex items-start gap-2 pl-0;
+}
+
+.ProseMirror ul[data-type='taskList'] > li::before {
+  display: none;
+}
+
+/* Placeholder */
+.ProseMirror p.is-empty::before {
+  @apply text-muted-foreground;
+  content: attr(data-placeholder);
+  float: left;
+  height: 0;
+  pointer-events: none;
+}
+
+/* Tables */
+.ProseMirror table {
+  @apply border-border my-4 w-full border-collapse border;
+}
+
+.ProseMirror th {
+  @apply bg-muted text-sm font-medium;
+}
+
+.ProseMirror td,
+.ProseMirror th {
+  @apply border-border border p-3;
+}
+
+/* Links */
+.ProseMirror a {
+  @apply text-primary underline underline-offset-2;
+}
+
+/* Horizontal rule */
+.ProseMirror hr {
+  @apply border-border my-6;
+}
diff --git a/apps/portal/src/utils/s3.ts b/apps/portal/src/utils/s3.ts
index 153ef4d7b..5808da8b9 100644
--- a/apps/portal/src/utils/s3.ts
+++ b/apps/portal/src/utils/s3.ts
@@ -11,15 +11,9 @@ export const BUCKET_NAME = process.env.APP_AWS_BUCKET_NAME;
 export const APP_AWS_ORG_ASSETS_BUCKET = process.env.APP_AWS_ORG_ASSETS_BUCKET;
 
 if (!APP_AWS_ACCESS_KEY_ID || !APP_AWS_SECRET_ACCESS_KEY || !BUCKET_NAME || !APP_AWS_REGION) {
-  // Log the error in production environments
-  if (process.env.NODE_ENV === 'production') {
-    console.error('AWS S3 credentials or configuration missing in environment variables.');
-  } else {
-    // Throw in development for immediate feedback
-    throw new Error('AWS S3 credentials or configuration missing. Check environment variables.');
-  }
-  // Optionally, you could export a dummy/error client or null here
-  // depending on how you want consuming code to handle the missing config.
+  console.warn(
+    'AWS S3 credentials or configuration missing in environment variables. File upload features will be unavailable.',
+  );
 }
 
 // Create a single S3 client instance
diff --git a/apps/portal/tailwind.config.ts b/apps/portal/tailwind.config.ts
deleted file mode 100644
index d60f01c16..000000000
--- a/apps/portal/tailwind.config.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import type { Config } from 'tailwindcss';
-import baseConfig from '../../packages/ui/tailwind.config';
-
-export default {
-  content: [
-    './src/**/*.{ts,tsx}',
-    '../../packages/ui/src/**/*.{ts,tsx}',
-    '../../packages/invoice/src/**/*.{ts,tsx}',
-  ],
-  presets: [baseConfig],
-} satisfies Config;
diff --git a/apps/portal/tsconfig.json b/apps/portal/tsconfig.json
index ffedc5da5..cb1deebe0 100644
--- a/apps/portal/tsconfig.json
+++ b/apps/portal/tsconfig.json
@@ -9,6 +9,7 @@
     "esModuleInterop": true,
     "module": "esnext",
     "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
     "resolveJsonModule": true,
     "isolatedModules": true,
     "jsx": "react-jsx",
diff --git a/bun.lock b/bun.lock
index fd430dc28..9087e3c5a 100644
--- a/bun.lock
+++ b/bun.lock
@@ -79,6 +79,7 @@
         "@aws-sdk/s3-request-presigner": "^3.859.0",
         "@browserbasehq/sdk": "^2.6.0",
         "@browserbasehq/stagehand": "^3.0.5",
+        "@comp/company": "workspace:*",
         "@comp/integration-platform": "workspace:*",
         "@mendable/firecrawl-js": "^4.9.3",
         "@nestjs/common": "^11.0.1",
@@ -175,6 +176,7 @@
         "@browserbasehq/stagehand": "^3.0.5",
         "@calcom/atoms": "^1.0.102-framer",
         "@calcom/embed-react": "^1.5.3",
+        "@comp/company": "workspace:*",
         "@comp/integration-platform": "workspace:*",
         "@date-fns/tz": "^1.2.0",
         "@dnd-kit/core": "^6.3.1",
@@ -315,6 +317,7 @@
       "dependencies": {
         "@aws-sdk/client-s3": "^3.859.0",
         "@aws-sdk/s3-request-presigner": "^3.859.0",
+        "@comp/company": "workspace:*",
         "@hookform/resolvers": "^5.2.2",
         "@prisma/client": "6.18.0",
         "@react-email/components": "^0.0.41",
@@ -322,6 +325,7 @@
         "@t3-oss/env-nextjs": "^0.13.8",
         "@trycompai/analytics": "workspace:*",
         "@trycompai/db": "1.3.22",
+        "@trycompai/design-system": "^1.0.43",
         "@trycompai/email": "workspace:*",
         "@trycompai/kv": "workspace:*",
         "@trycompai/ui": "workspace:*",
@@ -371,6 +375,17 @@
         "typescript": "^5.8.3",
       },
     },
+    "packages/company": {
+      "name": "@comp/company",
+      "version": "1.0.0",
+      "dependencies": {
+        "zod": "^4.3.6",
+      },
+      "devDependencies": {
+        "tsup": "^8.5.0",
+        "typescript": "^5.8.3",
+      },
+    },
     "packages/db": {
       "name": "@trycompai/db",
       "version": "1.3.22",
@@ -954,6 +969,8 @@
 
     "@comp/app": ["@comp/app@workspace:apps/app"],
 
+    "@comp/company": ["@comp/company@workspace:packages/company"],
+
     "@comp/integration-platform": ["@comp/integration-platform@workspace:packages/integration-platform"],
 
     "@comp/portal": ["@comp/portal@workspace:apps/portal"],
diff --git a/packages/company/package.json b/packages/company/package.json
new file mode 100644
index 000000000..03b83adb3
--- /dev/null
+++ b/packages/company/package.json
@@ -0,0 +1,32 @@
+{
+    "name": "@comp/company",
+    "version": "1.0.0",
+    "dependencies": {
+        "zod": "^4.3.6"
+    },
+    "devDependencies": {
+        "tsup": "^8.5.0",
+        "typescript": "^5.8.3"
+    },
+    "exports": {
+        ".": {
+            "types": "./dist/index.d.ts",
+            "import": "./dist/index.mjs",
+            "require": "./dist/index.js"
+        }
+    },
+    "main": "./dist/index.js",
+    "module": "./dist/index.mjs",
+    "types": "./dist/index.d.ts",
+    "files": ["dist"],
+    "private": true,
+    "scripts": {
+        "build": "tsup src/index.ts --format cjs,esm --dts",
+        "clean": "rm -rf .turbo node_modules dist",
+        "dev": "tsup src/index.ts --format cjs,esm --dts --watch",
+        "format": "prettier --write .",
+        "lint": "prettier --check .",
+        "typecheck": "tsc --noEmit"
+    },
+    "sideEffects": false
+}
diff --git a/packages/company/src/evidence-forms/definitions.ts b/packages/company/src/evidence-forms/definitions.ts
new file mode 100644
index 000000000..d17c456be
--- /dev/null
+++ b/packages/company/src/evidence-forms/definitions.ts
@@ -0,0 +1,357 @@
+import { meetingFields } from './field-builders';
+import type { EvidenceFormType } from './form-types';
+import {
+  boardMeetingMinutesPlaceholder,
+  itLeadershipMinutesPlaceholder,
+  riskCommitteeMinutesPlaceholder,
+} from './minutes-placeholders';
+import type { EvidenceFormDefinition } from './types';
+
+export const evidenceFormDefinitions: Record<EvidenceFormType, EvidenceFormDefinition> = {
+  'board-meeting': {
+    type: 'board-meeting',
+    title: 'Board Meeting',
+    description:
+      "Create a company board that meets twice a year to discuss the company's direction. Conduct at least 1 meeting.",
+    category: 'Governance',
+    submissionDateMode: 'custom',
+    portalAccessible: false,
+    fields: meetingFields(boardMeetingMinutesPlaceholder),
+  },
+  'it-leadership-meeting': {
+    type: 'it-leadership-meeting',
+    title: 'IT Leadership Meeting',
+    description:
+      'Create an IT leadership committee that meets monthly to discuss tech development. Conduct at least 1 meeting.',
+    category: 'Governance',
+    submissionDateMode: 'custom',
+    portalAccessible: false,
+    fields: meetingFields(itLeadershipMinutesPlaceholder),
+  },
+  'risk-committee-meeting': {
+    type: 'risk-committee-meeting',
+    title: 'Risk Committee Meeting',
+    description:
+      'Create a risk committee that meets twice a year to discuss risks to your company. Conduct at least 1 meeting.',
+    category: 'Governance',
+    submissionDateMode: 'custom',
+    portalAccessible: false,
+    fields: meetingFields(riskCommitteeMinutesPlaceholder),
+  },
+  'access-request': {
+    type: 'access-request',
+    title: 'Access Request',
+    description: 'Track and retain user access requests with justification.',
+    category: 'Security',
+    submissionDateMode: 'custom',
+    portalAccessible: true,
+    fields: [
+      {
+        key: 'userName',
+        label: 'User Name',
+        type: 'text',
+        required: true,
+        description: 'Full name of the person requesting access',
+      },
+      {
+        key: 'accountsNeeded',
+        label: 'Accounts Needed',
+        type: 'textarea',
+        required: true,
+        description: 'Systems or platforms access is needed for',
+      },
+      {
+        key: 'permissionsNeeded',
+        label: 'Permissions Needed',
+        type: 'select',
+        required: true,
+        description: 'Level of access required',
+        options: [
+          { label: 'Read', value: 'read' },
+          { label: 'Write', value: 'write' },
+          { label: 'Admin', value: 'admin' },
+        ],
+      },
+      {
+        key: 'reasonForRequest',
+        label: 'Reason For Request',
+        type: 'textarea',
+        required: true,
+        description: 'Business justification for access request',
+      },
+      {
+        key: 'accessGrantedBy',
+        label: 'Access Granted By',
+        type: 'text',
+        required: true,
+        description: 'Name of person who approved and granted access',
+      },
+      {
+        key: 'dateAccessGranted',
+        label: 'Date Access Granted',
+        type: 'date',
+        required: true,
+        description: 'Date when access was provided',
+      },
+    ],
+  },
+  'whistleblower-report': {
+    type: 'whistleblower-report',
+    title: 'Whistleblower Report',
+    description: 'Submit an anonymous whistleblower report. Submissions are confidential.',
+    category: 'Security',
+    submissionDateMode: 'auto',
+    portalAccessible: true,
+    fields: [
+      {
+        key: 'incidentDate',
+        label: 'Incident date',
+        type: 'date',
+        required: true,
+        description: 'Date the incident occurred',
+      },
+      {
+        key: 'complaintDetails',
+        label: 'Complaint Details',
+        type: 'textarea',
+        required: true,
+        description: 'Detailed description of the complaint or concern',
+      },
+      {
+        key: 'individualsInvolved',
+        label: 'Individuals Involved',
+        type: 'textarea',
+        required: true,
+        description: 'Names or roles of people involved in the incident',
+      },
+      {
+        key: 'evidence',
+        label: 'Evidence',
+        type: 'textarea',
+        required: true,
+        description: 'Any supporting evidence or documentation',
+      },
+      {
+        key: 'evidenceFile',
+        label: 'Supporting file',
+        type: 'file',
+        required: false,
+        accept: '.pdf,.doc,.docx,.txt,.png,.jpg,.jpeg',
+        description: 'Optional file attachment to support your report',
+      },
+    ],
+  },
+  'penetration-test': {
+    type: 'penetration-test',
+    title: 'Penetration Test',
+    description:
+      'Upload a third-party penetration test report to satisfy security testing evidence requirements.',
+    category: 'Security',
+    submissionDateMode: 'custom',
+    portalAccessible: false,
+    fields: [
+      {
+        key: 'testDate',
+        label: 'Test date',
+        type: 'date',
+        required: true,
+        description: 'Date the penetration test was conducted',
+      },
+      {
+        key: 'vendorName',
+        label: 'Vendor / testing firm',
+        type: 'text',
+        required: true,
+        description: 'Name of the third-party firm that performed the test',
+      },
+      {
+        key: 'summary',
+        label: 'Summary of findings',
+        type: 'textarea',
+        required: true,
+        description: 'High-level summary of test scope, findings, and remediation status',
+      },
+      {
+        key: 'pentestReport',
+        label: 'Pentest report (PDF)',
+        type: 'file',
+        required: true,
+        accept: '.pdf',
+        description: 'Upload the full third-party penetration test report',
+      },
+    ],
+  },
+  'rbac-matrix': {
+    type: 'rbac-matrix',
+    title: 'RBAC Matrix',
+    description:
+      'Track role-based access control by documenting systems, roles, permissions scope, assignees, and approval records.',
+    category: 'Security',
+    submissionDateMode: 'custom',
+    portalAccessible: false,
+    fields: [
+      {
+        key: 'matrixRows',
+        label: 'RBAC entries',
+        type: 'matrix',
+        required: true,
+        description: 'Audit-minimum role access evidence.',
+        addRowLabel: 'Add RBAC row',
+        columns: [
+          {
+            key: 'system',
+            label: 'System',
+            required: true,
+            placeholder: 'e.g. AWS',
+          },
+          {
+            key: 'roleName',
+            label: 'Role Name',
+            required: true,
+            placeholder: 'e.g. prod:operator',
+          },
+          {
+            key: 'permissionsScope',
+            label: 'Permissions / Scope',
+            required: true,
+            placeholder: 'Assume role; read logs/metrics; no IAM:admin',
+          },
+          {
+            key: 'approvedBy',
+            label: 'Approved By',
+            required: true,
+            placeholder: 'name, role',
+          },
+          {
+            key: 'lastReviewed',
+            label: 'Last Reviewed',
+            required: true,
+            placeholder: 'YYYY-MM-DD',
+          },
+        ],
+      },
+    ],
+  },
+  'infrastructure-inventory': {
+    type: 'infrastructure-inventory',
+    title: 'Infrastructure Inventory',
+    description:
+      'Maintain an infrastructure inventory across cloud and on-prem assets with ownership, platform details, and review cadence.',
+    category: 'Security',
+    submissionDateMode: 'custom',
+    portalAccessible: false,
+    fields: [
+      {
+        key: 'inventoryRows',
+        label: 'Infrastructure assets',
+        type: 'matrix',
+        required: true,
+        description: 'Audit-minimum infrastructure evidence.',
+        addRowLabel: 'Add asset row',
+        columns: [
+          {
+            key: 'assetId',
+            label: 'Asset ID',
+            required: true,
+            placeholder: 'e.g. 001',
+          },
+          {
+            key: 'systemType',
+            label: 'System Type',
+            required: true,
+            placeholder: 'e.g. EC2 Instance',
+          },
+          {
+            key: 'environment',
+            label: 'Environment',
+            required: true,
+            placeholder: 'e.g. Production',
+          },
+          {
+            key: 'location',
+            label: 'Location',
+            placeholder: 'e.g. AWS ap-south-1 / on-prem',
+          },
+          {
+            key: 'assignedOwner',
+            label: 'Assigned Owner',
+            required: true,
+            placeholder: 'e.g. DevOps Team',
+          },
+          {
+            key: 'lastReviewed',
+            label: 'Last Reviewed',
+            required: true,
+            placeholder: 'YYYY-MM-DD',
+          },
+        ],
+      },
+    ],
+  },
+  'employee-performance-evaluation': {
+    type: 'employee-performance-evaluation',
+    title: 'Employee Performance Evaluation',
+    description: 'Capture a lightweight performance review record for audit evidence.',
+    category: 'People',
+    submissionDateMode: 'custom',
+    portalAccessible: false,
+    fields: [
+      {
+        key: 'employeeName',
+        label: 'Employee name',
+        type: 'text',
+        required: true,
+        description: 'Full name of the employee being reviewed',
+      },
+      {
+        key: 'manager',
+        label: 'Manager',
+        type: 'text',
+        required: true,
+        description: 'Name of the reviewing manager',
+      },
+      {
+        key: 'reviewPeriodTo',
+        label: 'Review period end date',
+        type: 'date',
+        required: true,
+        description: 'End date of the review period',
+      },
+      {
+        key: 'overallRating',
+        label: 'Overall Rating',
+        type: 'select',
+        required: true,
+        description: "Manager's overall performance rating",
+        options: [
+          { label: 'Needs Improvement', value: 'needs-improvement' },
+          { label: 'Meets Expectations', value: 'meets-expectations' },
+          { label: 'Exceeds Expectations', value: 'exceeds-expectations' },
+        ],
+      },
+      {
+        key: 'managerSignature',
+        label: 'Manager signature (name)',
+        type: 'text',
+        required: true,
+        description: 'Typed name of the manager as signature',
+      },
+      {
+        key: 'managerSignatureDate',
+        label: 'Manager signature date',
+        type: 'date',
+        required: true,
+        description: 'Date the manager signed the review',
+      },
+      {
+        key: 'managerComments',
+        label: 'Manager Comments',
+        type: 'textarea',
+        required: true,
+        description: "Manager's written performance feedback and observations",
+      },
+    ],
+  },
+};
+
+export const evidenceFormDefinitionList = Object.values(evidenceFormDefinitions);
diff --git a/packages/company/src/evidence-forms/field-builders.ts b/packages/company/src/evidence-forms/field-builders.ts
new file mode 100644
index 000000000..5e88960f5
--- /dev/null
+++ b/packages/company/src/evidence-forms/field-builders.ts
@@ -0,0 +1,46 @@
+import type { EvidenceFormFieldDefinition } from './types';
+
+export function meetingFields(
+  minutesPlaceholder: string,
+): ReadonlyArray<EvidenceFormFieldDefinition> {
+  return [
+    {
+      key: 'attendees',
+      label: 'Attendees',
+      type: 'text',
+      required: true,
+      description: 'Names of all meeting participants',
+      placeholder: 'e.g. Jane Doe, John Smith',
+    },
+    {
+      key: 'date',
+      label: 'Meeting date',
+      type: 'date',
+      required: true,
+      description: 'Date the meeting was held',
+    },
+    {
+      key: 'meetingMinutes',
+      label: 'Meeting minutes',
+      type: 'textarea',
+      required: true,
+      description: 'Full meeting minutes including review and approval of agenda items',
+      placeholder: minutesPlaceholder,
+    },
+    {
+      key: 'meetingMinutesApprovedBy',
+      label: 'Meeting minutes approved by',
+      type: 'text',
+      required: true,
+      description: 'Person who reviewed and approved the minutes',
+      placeholder: 'e.g. Jane Doe, CEO',
+    },
+    {
+      key: 'approvedDate',
+      label: 'Approved date',
+      type: 'date',
+      required: true,
+      description: 'Date the minutes were approved',
+    },
+  ];
+}
diff --git a/packages/company/src/evidence-forms/file-schema.ts b/packages/company/src/evidence-forms/file-schema.ts
new file mode 100644
index 000000000..b445d0cf1
--- /dev/null
+++ b/packages/company/src/evidence-forms/file-schema.ts
@@ -0,0 +1,9 @@
+import { z } from 'zod';
+
+export const evidenceFormFileSchema = z.object({
+  fileName: z.string().min(1),
+  fileKey: z.string().min(1),
+  downloadUrl: z.string().url(),
+});
+
+export type EvidenceFormFile = z.infer<typeof evidenceFormFileSchema>;
diff --git a/packages/company/src/evidence-forms/form-types.ts b/packages/company/src/evidence-forms/form-types.ts
new file mode 100644
index 000000000..21e55893e
--- /dev/null
+++ b/packages/company/src/evidence-forms/form-types.ts
@@ -0,0 +1,15 @@
+import { z } from 'zod';
+
+export const evidenceFormTypeSchema = z.enum([
+  'board-meeting',
+  'it-leadership-meeting',
+  'risk-committee-meeting',
+  'access-request',
+  'whistleblower-report',
+  'penetration-test',
+  'rbac-matrix',
+  'infrastructure-inventory',
+  'employee-performance-evaluation',
+]);
+
+export type EvidenceFormType = z.infer<typeof evidenceFormTypeSchema>;
diff --git a/packages/company/src/evidence-forms/index.ts b/packages/company/src/evidence-forms/index.ts
new file mode 100644
index 000000000..978200642
--- /dev/null
+++ b/packages/company/src/evidence-forms/index.ts
@@ -0,0 +1,7 @@
+export * from './definitions';
+export * from './field-builders';
+export * from './file-schema';
+export * from './form-types';
+export * from './minutes-placeholders';
+export * from './submission-schemas';
+export * from './types';
diff --git a/packages/company/src/evidence-forms/minutes-placeholders.ts b/packages/company/src/evidence-forms/minutes-placeholders.ts
new file mode 100644
index 000000000..2e9b9b1b7
--- /dev/null
+++ b/packages/company/src/evidence-forms/minutes-placeholders.ts
@@ -0,0 +1,115 @@
+export const boardMeetingMinutesPlaceholder = `1. Review and Approval
+- Approval of previous meeting minutes
+- Status update on action items from the last meeting
+
+2. Financial Performance and Budget
+- Review of key financial metrics: total revenue, annual recurring revenue, average monthly burn, runway
+- Discussion of financial performance against targets
+- Review and approval of organizational budgets
+
+3. Risk Management and Compliance
+- Review of Risk and Governance Executive Committee report
+- Discussion of annual risk assessment results and mitigation strategies
+- Review of internal control systems and their effectiveness
+- Compliance status and regulatory concerns
+- Cybersecurity and data protection measures
+
+4. Business Strategy and Operations
+- Review of overall organization strategy and execution
+- Discussion of short-term and long-term business objectives
+- Product roadmap and key milestones
+- Go-to-Market (GTM) strategy effectiveness
+- Competitive landscape analysis
+- Evaluation of additional resource needs (people, processes, tools, technologies)
+
+5. Human Resources and Succession Planning
+- Review of organizational structure and any proposed changes
+- Discussion on team capabilities and performance
+- Review of hiring plans and talent acquisition strategies
+- Evaluation of compensation and performance evaluation programs
+- Review and update of succession plans for key roles
+- Discussion on retaining competent individuals and fraud prevention incentives
+
+6. Business Continuity and Risk Mitigation
+- Evaluation of business contingency plans
+- Discussion of fraud and misconduct mitigation strategies
+
+7. Board Composition and Governance
+- Evaluation of board members' skills and expertise
+- Assessment of need for subcommittees, experts, or consultants
+- Discussion of any corporate governance issues or updates
+
+8. Capital Structure and Fundraising
+- Review of current capital structure
+- Discussion on fundraising needs and strategies
+- Update on cap table and any recent or planned changes
+
+9. Strategic Initiatives and Future Planning
+- Discussion on major strategic initiatives
+- Long-term vision and potential partnerships
+- Any other business or open topics
+
+Action Items:
+1. [ENTER HERE]
+
+Next Meeting:
+- Proposed date for the next board meeting: [ENTER DATE]`;
+
+export const itLeadershipMinutesPlaceholder = `1. Network Diagram
+- Review and discuss updates or changes.
+- Action items and responsible parties.
+
+2. Organization Structure
+- Review current structure.
+- Discuss any changes or updates.
+
+3. Firewall Rules
+- Review current firewall rules and configurations.
+- Identify any necessary updates or adjustments.
+- Assign action items as needed.
+
+4. Asset Registry
+- Review and update the asset registry.
+- Ensure all new assets are documented.
+
+5. Baseline Configuration
+- Review the minimum endpoint hardening requirements.
+- Discuss any updates or improvements.
+- Assign action items for implementation.
+- Review cloud infrastructure provider logs and ensure there is no unusual activity.
+
+6. New Business
+- Open floor for any new business or concerns.
+
+7. Action Items Review
+- Summarize and assign all action items discussed during the meeting.
+- Set deadlines and responsible parties for each action item.`;
+
+export const riskCommitteeMinutesPlaceholder = `1. Internal Compliance Assessment
+- Discuss any pending compliance audits.
+- Assign responsibilities for corrective actions.
+
+2. Risk Assessment
+- Review the organization-wide risk assessment.
+- Identify new risks and corrective actions needed.
+- Discuss and approve mitigation strategies.
+
+3. Opportunities for Improvement
+- Identify any opportunities for improvement in security and governance.
+
+4. Resource and Budget Review
+- Review resources and budget needs related to information security and compliance frameworks.
+- Discuss and approve budget allocations as necessary.
+
+5. Approval of New Security Measures
+- Approve new security measures needed to enhance the company's security program.
+- Discuss and approve how these security measures will be implemented.
+
+6. Fraud and Misconduct Mitigation
+- Consider various ways that fraud and misconduct can occur within the organization.
+- Discuss measures to mitigate the risk of fraud.
+- Assign responsibilities for implementing fraud prevention measures.
+
+7. Succession Planning
+- Review succession planning for key roles and personnel in the event of an emergency.
+- Discuss and update succession plans as necessary.`;
diff --git a/packages/company/src/evidence-forms/submission-schemas.ts b/packages/company/src/evidence-forms/submission-schemas.ts
new file mode 100644
index 000000000..dfb60d476
--- /dev/null
+++ b/packages/company/src/evidence-forms/submission-schemas.ts
@@ -0,0 +1,89 @@
+import { z } from 'zod';
+import { evidenceFormFileSchema } from './file-schema';
+import type { EvidenceFormType } from './form-types';
+
+const meetingDataSchema = z.object({
+  submissionDate: z.string().min(1),
+  attendees: z.string().min(1),
+  date: z.string().min(1),
+  meetingMinutes: z.string().min(1),
+  meetingMinutesApprovedBy: z.string().min(1),
+  approvedDate: z.string().min(1),
+});
+
+const accessRequestDataSchema = z.object({
+  submissionDate: z.string().min(1),
+  userName: z.string().min(1),
+  accountsNeeded: z.string().min(1),
+  permissionsNeeded: z.enum(['read', 'write', 'admin']),
+  reasonForRequest: z.string().min(1),
+  accessGrantedBy: z.string().min(1),
+  dateAccessGranted: z.string().min(1),
+});
+
+const whistleblowerReportDataSchema = z.object({
+  submissionDate: z.string().min(1),
+  incidentDate: z.string().min(1),
+  complaintDetails: z.string().min(1),
+  individualsInvolved: z.string().min(1),
+  evidence: z.string().min(1),
+  evidenceFile: evidenceFormFileSchema.optional(),
+});
+
+const penetrationTestDataSchema = z.object({
+  submissionDate: z.string().min(1),
+  testDate: z.string().min(1),
+  vendorName: z.string().min(1),
+  summary: z.string().min(1),
+  pentestReport: evidenceFormFileSchema,
+});
+
+const rbacMatrixRowSchema = z.object({
+  system: z.string().trim().min(1),
+  roleName: z.string().trim().min(1),
+  permissionsScope: z.string().trim().min(1),
+  approvedBy: z.string().trim().min(1),
+  lastReviewed: z.string().trim().min(1),
+});
+
+const rbacMatrixDataSchema = z.object({
+  submissionDate: z.string().min(1),
+  matrixRows: z.array(rbacMatrixRowSchema).min(1),
+});
+
+const infrastructureInventoryRowSchema = z.object({
+  assetId: z.string().trim().min(1),
+  systemType: z.string().trim().min(1),
+  environment: z.string().trim().min(1),
+  location: z.string().trim().optional(),
+  assignedOwner: z.string().trim().min(1),
+  lastReviewed: z.string().trim().min(1),
+});
+
+const infrastructureInventoryDataSchema = z.object({
+  submissionDate: z.string().min(1),
+  inventoryRows: z.array(infrastructureInventoryRowSchema).min(1),
+});
+
+const employeePerformanceEvaluationDataSchema = z.object({
+  submissionDate: z.string().min(1),
+  employeeName: z.string().trim().min(1),
+  manager: z.string().trim().min(1),
+  reviewPeriodTo: z.string().min(1),
+  overallRating: z.enum(['needs-improvement', 'meets-expectations', 'exceeds-expectations']),
+  managerComments: z.string().trim().min(1),
+  managerSignature: z.string().trim().min(1),
+  managerSignatureDate: z.string().min(1),
+});
+
+export const evidenceFormSubmissionSchemaMap = {
+  'board-meeting': meetingDataSchema,
+  'it-leadership-meeting': meetingDataSchema,
+  'risk-committee-meeting': meetingDataSchema,
+  'access-request': accessRequestDataSchema,
+  'whistleblower-report': whistleblowerReportDataSchema,
+  'penetration-test': penetrationTestDataSchema,
+  'rbac-matrix': rbacMatrixDataSchema,
+  'infrastructure-inventory': infrastructureInventoryDataSchema,
+  'employee-performance-evaluation': employeePerformanceEvaluationDataSchema,
+} as const satisfies Record<EvidenceFormType, z.ZodTypeAny>;
diff --git a/packages/company/src/evidence-forms/types.ts b/packages/company/src/evidence-forms/types.ts
new file mode 100644
index 000000000..424174800
--- /dev/null
+++ b/packages/company/src/evidence-forms/types.ts
@@ -0,0 +1,32 @@
+import type { EvidenceFormType } from './form-types';
+
+export type EvidenceFormMatrixColumnDefinition = {
+  key: string;
+  label: string;
+  required?: boolean;
+  placeholder?: string;
+  description?: string;
+};
+
+export type EvidenceFormFieldDefinition = {
+  key: string;
+  label: string;
+  type: 'text' | 'textarea' | 'date' | 'select' | 'file' | 'matrix';
+  required: boolean;
+  placeholder?: string;
+  description?: string;
+  options?: ReadonlyArray<{ label: string; value: string }>;
+  accept?: string;
+  columns?: ReadonlyArray<EvidenceFormMatrixColumnDefinition>;
+  addRowLabel?: string;
+};
+
+export type EvidenceFormDefinition = {
+  type: EvidenceFormType;
+  title: string;
+  description: string;
+  category: string;
+  submissionDateMode: 'custom' | 'auto';
+  portalAccessible: boolean;
+  fields: ReadonlyArray<EvidenceFormFieldDefinition>;
+};
diff --git a/packages/company/src/index.ts b/packages/company/src/index.ts
new file mode 100644
index 000000000..1b883e052
--- /dev/null
+++ b/packages/company/src/index.ts
@@ -0,0 +1 @@
+export * from './evidence-forms/index';
diff --git a/packages/company/tsconfig.json b/packages/company/tsconfig.json
new file mode 100644
index 000000000..f4551ffb2
--- /dev/null
+++ b/packages/company/tsconfig.json
@@ -0,0 +1,5 @@
+{
+  "extends": "@trycompai/tsconfig/base.json",
+  "include": ["."],
+  "exclude": ["node_modules"]
+}
diff --git a/packages/db/prisma/migrations/20260212142142_add_evidence_submissions/migration.sql b/packages/db/prisma/migrations/20260212142142_add_evidence_submissions/migration.sql
new file mode 100644
index 000000000..cded20fac
--- /dev/null
+++ b/packages/db/prisma/migrations/20260212142142_add_evidence_submissions/migration.sql
@@ -0,0 +1,25 @@
+-- CreateTable
+CREATE TABLE "EvidenceSubmission" (
+    "id" TEXT NOT NULL DEFAULT generate_prefixed_cuid('evs'::text),
+    "organizationId" TEXT NOT NULL,
+    "formType" TEXT NOT NULL,
+    "submittedById" TEXT,
+    "submittedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "data" JSONB NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "EvidenceSubmission_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "EvidenceSubmission_organizationId_formType_submittedAt_idx" ON "EvidenceSubmission"("organizationId", "formType", "submittedAt");
+
+-- CreateIndex
+CREATE INDEX "EvidenceSubmission_organizationId_formType_idx" ON "EvidenceSubmission"("organizationId", "formType");
+
+-- AddForeignKey
+ALTER TABLE "EvidenceSubmission" ADD CONSTRAINT "EvidenceSubmission_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "EvidenceSubmission" ADD CONSTRAINT "EvidenceSubmission_submittedById_fkey" FOREIGN KEY ("submittedById") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
diff --git a/packages/db/prisma/migrations/20260212180647_add_evidence_review_fields/migration.sql b/packages/db/prisma/migrations/20260212180647_add_evidence_review_fields/migration.sql
new file mode 100644
index 000000000..bf22b3c9e
--- /dev/null
+++ b/packages/db/prisma/migrations/20260212180647_add_evidence_review_fields/migration.sql
@@ -0,0 +1,11 @@
+-- AlterTable
+ALTER TABLE "EvidenceSubmission" ADD COLUMN     "reviewReason" TEXT,
+ADD COLUMN     "reviewedAt" TIMESTAMP(3),
+ADD COLUMN     "reviewedById" TEXT,
+ADD COLUMN     "status" TEXT NOT NULL DEFAULT 'pending';
+
+-- CreateIndex
+CREATE INDEX "EvidenceSubmission_submittedById_status_idx" ON "EvidenceSubmission"("submittedById", "status");
+
+-- AddForeignKey
+ALTER TABLE "EvidenceSubmission" ADD CONSTRAINT "EvidenceSubmission_reviewedById_fkey" FOREIGN KEY ("reviewedById") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
diff --git a/packages/db/prisma/migrations/20260213132000_add_portal_form_visibility_settings/migration.sql b/packages/db/prisma/migrations/20260213132000_add_portal_form_visibility_settings/migration.sql
new file mode 100644
index 000000000..2866d817d
--- /dev/null
+++ b/packages/db/prisma/migrations/20260213132000_add_portal_form_visibility_settings/migration.sql
@@ -0,0 +1,3 @@
+-- AlterTable
+ALTER TABLE "Organization" ADD COLUMN "whistleblowerReportEnabled" BOOLEAN NOT NULL DEFAULT true;
+ALTER TABLE "Organization" ADD COLUMN "accessRequestFormEnabled" BOOLEAN NOT NULL DEFAULT true;
diff --git a/packages/db/prisma/migrations/20260213141447_add_document_findings_target/migration.sql b/packages/db/prisma/migrations/20260213141447_add_document_findings_target/migration.sql
new file mode 100644
index 000000000..3d161a217
--- /dev/null
+++ b/packages/db/prisma/migrations/20260213141447_add_document_findings_target/migration.sql
@@ -0,0 +1,9 @@
+-- AlterTable
+ALTER TABLE "Finding" ADD COLUMN     "evidenceSubmissionId" TEXT,
+ALTER COLUMN "taskId" DROP NOT NULL;
+
+-- CreateIndex
+CREATE INDEX "Finding_evidenceSubmissionId_idx" ON "Finding"("evidenceSubmissionId");
+
+-- AddForeignKey
+ALTER TABLE "Finding" ADD CONSTRAINT "Finding_evidenceSubmissionId_fkey" FOREIGN KEY ("evidenceSubmissionId") REFERENCES "EvidenceSubmission"("id") ON DELETE CASCADE ON UPDATE CASCADE;
diff --git a/packages/db/prisma/schema/auth.prisma b/packages/db/prisma/schema/auth.prisma
index f248ff189..5c03a92b8 100644
--- a/packages/db/prisma/schema/auth.prisma
+++ b/packages/db/prisma/schema/auth.prisma
@@ -18,6 +18,8 @@ model User {
   members            Member[]
   sessions           Session[]
   fleetPolicyResults FleetPolicyResult[]
+  evidenceSubmissions EvidenceSubmission[] @relation("EvidenceSubmitter")
+  evidenceReviews     EvidenceSubmission[] @relation("EvidenceReviewer")
 
   @@unique([email])
 }
diff --git a/packages/db/prisma/schema/evidence-submission.prisma b/packages/db/prisma/schema/evidence-submission.prisma
new file mode 100644
index 000000000..a0ce09698
--- /dev/null
+++ b/packages/db/prisma/schema/evidence-submission.prisma
@@ -0,0 +1,23 @@
+model EvidenceSubmission {
+  id             String   @id @default(dbgenerated("generate_prefixed_cuid('evs'::text)"))
+  organizationId String
+  formType       String
+  submittedById  String?
+  submittedAt    DateTime @default(now())
+  data           Json
+  status         String   @default("pending")
+  reviewedById   String?
+  reviewedAt     DateTime?
+  reviewReason   String?
+  createdAt      DateTime @default(now())
+  updatedAt      DateTime @updatedAt
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  submittedBy  User?        @relation("EvidenceSubmitter", fields: [submittedById], references: [id], onDelete: SetNull)
+  reviewedBy   User?        @relation("EvidenceReviewer", fields: [reviewedById], references: [id], onDelete: SetNull)
+  findings     Finding[]
+
+  @@index([organizationId, formType, submittedAt])
+  @@index([organizationId, formType])
+  @@index([submittedById, status])
+}
diff --git a/packages/db/prisma/schema/finding.prisma b/packages/db/prisma/schema/finding.prisma
index c7cc94eaa..2d95f75d4 100644
--- a/packages/db/prisma/schema/finding.prisma
+++ b/packages/db/prisma/schema/finding.prisma
@@ -33,8 +33,10 @@ model Finding {
   updatedAt DateTime @updatedAt
 
   // Relationships
-  taskId         String
-  task           Task             @relation(fields: [taskId], references: [id], onDelete: Cascade)
+  taskId         String?
+  task           Task?            @relation(fields: [taskId], references: [id], onDelete: Cascade)
+  evidenceSubmissionId String?
+  evidenceSubmission   EvidenceSubmission? @relation(fields: [evidenceSubmissionId], references: [id], onDelete: Cascade)
   templateId     String?
   template       FindingTemplate? @relation(fields: [templateId], references: [id])
   createdById    String
@@ -43,5 +45,6 @@ model Finding {
   organization   Organization     @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   @@index([taskId])
+  @@index([evidenceSubmissionId])
   @@index([organizationId, status])
 }
diff --git a/packages/db/prisma/schema/organization.prisma b/packages/db/prisma/schema/organization.prisma
index 45cbce5b5..93a804ace 100644
--- a/packages/db/prisma/schema/organization.prisma
+++ b/packages/db/prisma/schema/organization.prisma
@@ -13,6 +13,8 @@ model Organization {
   evidenceApprovalEnabled         Boolean     @default(false)
   deviceAgentStepEnabled          Boolean     @default(true)
   securityTrainingStepEnabled     Boolean     @default(true)
+  whistleblowerReportEnabled      Boolean     @default(true)
+  accessRequestFormEnabled        Boolean     @default(true)
 
   // FleetDM
   fleetDmLabelId        Int?
@@ -36,6 +38,7 @@ model Organization {
   taskItems                          TaskItem[]
   comments                           Comment[]
   attachments                        Attachment[]
+  evidenceSubmissions                EvidenceSubmission[]
   trust                              Trust[]
   context                            Context[]
   secrets                            Secret[]
diff --git a/packages/docs/openapi.json b/packages/docs/openapi.json
index 7eb1ee6d1..ae966a17f 100644
--- a/packages/docs/openapi.json
+++ b/packages/docs/openapi.json
@@ -11614,13 +11614,23 @@
           },
           {
             "name": "taskId",
-            "required": true,
+            "required": false,
             "in": "query",
             "description": "Task ID to get findings for",
             "schema": {
               "example": "tsk_abc123",
               "type": "string"
             }
+          },
+          {
+            "name": "evidenceSubmissionId",
+            "required": false,
+            "in": "query",
+            "description": "Evidence submission ID to get findings for",
+            "schema": {
+              "example": "evs_abc123",
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -15823,6 +15833,404 @@
           "Org Chart"
         ]
       }
+    },
+    "/v1/evidence-forms": {
+      "get": {
+        "description": "List all available pre-built evidence forms",
+        "operationId": "EvidenceFormsController_listForms_v1",
+        "parameters": [
+          {
+            "name": "X-Organization-Id",
+            "in": "header",
+            "description": "Organization ID (required for session auth, optional for API key auth)",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": ""
+          }
+        },
+        "security": [
+          {
+            "apikey": []
+          }
+        ],
+        "summary": "List evidence forms",
+        "tags": [
+          "Evidence Forms"
+        ]
+      }
+    },
+    "/v1/evidence-forms/statuses": {
+      "get": {
+        "description": "Returns the latest submission date per form type for the active organization",
+        "operationId": "EvidenceFormsController_getFormStatuses_v1",
+        "parameters": [
+          {
+            "name": "X-Organization-Id",
+            "in": "header",
+            "description": "Organization ID (required for session auth, optional for API key auth)",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": ""
+          }
+        },
+        "security": [
+          {
+            "apikey": []
+          }
+        ],
+        "summary": "Get submission statuses for all forms",
+        "tags": [
+          "Evidence Forms"
+        ]
+      }
+    },
+    "/v1/evidence-forms/my-submissions": {
+      "get": {
+        "description": "Returns all evidence form submissions by the authenticated user for the active organization",
+        "operationId": "EvidenceFormsController_getMySubmissions_v1",
+        "parameters": [
+          {
+            "name": "X-Organization-Id",
+            "in": "header",
+            "description": "Organization ID (required for session auth, optional for API key auth)",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "formType",
+            "required": true,
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": ""
+          }
+        },
+        "security": [
+          {
+            "apikey": []
+          }
+        ],
+        "summary": "Get current user submissions",
+        "tags": [
+          "Evidence Forms"
+        ]
+      }
+    },
+    "/v1/evidence-forms/my-submissions/pending-count": {
+      "get": {
+        "description": "Returns the count of pending evidence submissions for the authenticated user",
+        "operationId": "EvidenceFormsController_getPendingSubmissionCount_v1",
+        "parameters": [
+          {
+            "name": "X-Organization-Id",
+            "in": "header",
+            "description": "Organization ID (required for session auth, optional for API key auth)",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": ""
+          }
+        },
+        "security": [
+          {
+            "apikey": []
+          }
+        ],
+        "summary": "Get pending submission count for current user",
+        "tags": [
+          "Evidence Forms"
+        ]
+      }
+    },
+    "/v1/evidence-forms/{formType}": {
+      "get": {
+        "description": "Fetch a specific form definition with submissions for the active organization",
+        "operationId": "EvidenceFormsController_getFormWithSubmissions_v1",
+        "parameters": [
+          {
+            "name": "X-Organization-Id",
+            "in": "header",
+            "description": "Organization ID (required for session auth, optional for API key auth)",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "formType",
+            "required": true,
+            "in": "path",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "search",
+            "required": true,
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "limit",
+            "required": true,
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "offset",
+            "required": true,
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": ""
+          }
+        },
+        "security": [
+          {
+            "apikey": []
+          }
+        ],
+        "summary": "Get form definition and submissions",
+        "tags": [
+          "Evidence Forms"
+        ]
+      }
+    },
+    "/v1/evidence-forms/{formType}/submissions/{submissionId}": {
+      "get": {
+        "description": "Fetch one evidence form submission for the active organization",
+        "operationId": "EvidenceFormsController_getSubmission_v1",
+        "parameters": [
+          {
+            "name": "X-Organization-Id",
+            "in": "header",
+            "description": "Organization ID (required for session auth, optional for API key auth)",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "formType",
+            "required": true,
+            "in": "path",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "submissionId",
+            "required": true,
+            "in": "path",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": ""
+          }
+        },
+        "security": [
+          {
+            "apikey": []
+          }
+        ],
+        "summary": "Get a single submission",
+        "tags": [
+          "Evidence Forms"
+        ]
+      }
+    },
+    "/v1/evidence-forms/{formType}/submissions": {
+      "post": {
+        "description": "Create a new organization-scoped evidence form submission using Zod-validated payloads",
+        "operationId": "EvidenceFormsController_submitForm_v1",
+        "parameters": [
+          {
+            "name": "X-Organization-Id",
+            "in": "header",
+            "description": "Organization ID (required for session auth, optional for API key auth)",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "formType",
+            "required": true,
+            "in": "path",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "201": {
+            "description": ""
+          }
+        },
+        "security": [
+          {
+            "apikey": []
+          }
+        ],
+        "summary": "Submit evidence form entry",
+        "tags": [
+          "Evidence Forms"
+        ]
+      }
+    },
+    "/v1/evidence-forms/{formType}/submissions/{submissionId}/review": {
+      "patch": {
+        "description": "Approve or reject an evidence form submission with an optional reason",
+        "operationId": "EvidenceFormsController_reviewSubmission_v1",
+        "parameters": [
+          {
+            "name": "X-Organization-Id",
+            "in": "header",
+            "description": "Organization ID (required for session auth, optional for API key auth)",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "formType",
+            "required": true,
+            "in": "path",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "submissionId",
+            "required": true,
+            "in": "path",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": ""
+          }
+        },
+        "security": [
+          {
+            "apikey": []
+          }
+        ],
+        "summary": "Review a submission",
+        "tags": [
+          "Evidence Forms"
+        ]
+      }
+    },
+    "/v1/evidence-forms/uploads": {
+      "post": {
+        "description": "Upload a file for evidence form fields and return file metadata for submission payload",
+        "operationId": "EvidenceFormsController_uploadFile_v1",
+        "parameters": [
+          {
+            "name": "X-Organization-Id",
+            "in": "header",
+            "description": "Organization ID (required for session auth, optional for API key auth)",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "201": {
+            "description": ""
+          }
+        },
+        "security": [
+          {
+            "apikey": []
+          }
+        ],
+        "summary": "Upload evidence form file",
+        "tags": [
+          "Evidence Forms"
+        ]
+      }
+    },
+    "/v1/evidence-forms/{formType}/export.csv": {
+      "get": {
+        "description": "Export all form submissions for an organization as CSV",
+        "operationId": "EvidenceFormsController_exportCsv_v1",
+        "parameters": [
+          {
+            "name": "X-Organization-Id",
+            "in": "header",
+            "description": "Organization ID (required for session auth, optional for API key auth)",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "formType",
+            "required": true,
+            "in": "path",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": ""
+          }
+        },
+        "security": [
+          {
+            "apikey": []
+          }
+        ],
+        "summary": "Export form submissions to CSV",
+        "tags": [
+          "Evidence Forms"
+        ]
+      }
     }
   },
   "info": {
@@ -18761,6 +19169,11 @@
             "description": "Task ID this finding is associated with",
             "example": "tsk_abc123"
           },
+          "evidenceSubmissionId": {
+            "type": "string",
+            "description": "Evidence submission ID this finding is associated with",
+            "example": "evs_abc123"
+          },
           "type": {
             "type": "string",
             "description": "Type of finding (SOC 2 or ISO 27001)",
@@ -18783,7 +19196,6 @@
           }
         },
         "required": [
-          "taskId",
           "type",
           "content"
         ]