diff --git a/apps/console/src/hooks/graph/EvidenceGraph.ts b/apps/console/src/hooks/graph/EvidenceGraph.ts
index a7bfee726..1418eb4ed 100644
--- a/apps/console/src/hooks/graph/EvidenceGraph.ts
+++ b/apps/console/src/hooks/graph/EvidenceGraph.ts
@@ -5,9 +5,12 @@ export const evidenceFileQuery = graphql`
     node(id: $evidenceId) {
       ... on Evidence {
         id
-        mimeType
-        filename
-        fileUrl
+        file {
+            mimeType
+            fileName
+            size
+            downloadUrl
+        }
       }
     }
   }
diff --git a/apps/console/src/hooks/graph/__generated__/EvidenceGraphFileQuery.graphql.ts b/apps/console/src/hooks/graph/__generated__/EvidenceGraphFileQuery.graphql.ts
index efbf0c457..d0257b410 100644
--- a/apps/console/src/hooks/graph/__generated__/EvidenceGraphFileQuery.graphql.ts
+++ b/apps/console/src/hooks/graph/__generated__/EvidenceGraphFileQuery.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<0c4d6a4bd477e15ae3c627cf338a99dd>>
+ * @generated SignedSource<<843df409ed1ee9ba19760921dbd6e8df>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -14,10 +14,13 @@ export type EvidenceGraphFileQuery$variables = {
 };
 export type EvidenceGraphFileQuery$data = {
   readonly node: {
-    readonly fileUrl?: string | null | undefined;
-    readonly filename?: string;
+    readonly file?: {
+      readonly downloadUrl: string;
+      readonly fileName: string;
+      readonly mimeType: string;
+      readonly size: any;
+    } | null | undefined;
     readonly id?: string;
-    readonly mimeType?: string;
   };
 };
 export type EvidenceGraphFileQuery = {
@@ -58,14 +61,21 @@ v4 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
-  "name": "filename",
+  "name": "fileName",
   "storageKey": null
 },
 v5 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
-  "name": "fileUrl",
+  "name": "size",
+  "storageKey": null
+},
+v6 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "downloadUrl",
   "storageKey": null
 };
 return {
@@ -87,9 +97,21 @@ return {
             "kind": "InlineFragment",
             "selections": [
               (v2/*: any*/),
-              (v3/*: any*/),
-              (v4/*: any*/),
-              (v5/*: any*/)
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "File",
+                "kind": "LinkedField",
+                "name": "file",
+                "plural": false,
+                "selections": [
+                  (v3/*: any*/),
+                  (v4/*: any*/),
+                  (v5/*: any*/),
+                  (v6/*: any*/)
+                ],
+                "storageKey": null
+              }
             ],
             "type": "Evidence",
             "abstractKey": null
@@ -126,9 +148,22 @@ return {
           {
             "kind": "InlineFragment",
             "selections": [
-              (v3/*: any*/),
-              (v4/*: any*/),
-              (v5/*: any*/)
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "File",
+                "kind": "LinkedField",
+                "name": "file",
+                "plural": false,
+                "selections": [
+                  (v3/*: any*/),
+                  (v4/*: any*/),
+                  (v5/*: any*/),
+                  (v6/*: any*/),
+                  (v2/*: any*/)
+                ],
+                "storageKey": null
+              }
             ],
             "type": "Evidence",
             "abstractKey": null
@@ -139,16 +174,16 @@ return {
     ]
   },
   "params": {
-    "cacheID": "db46f9bf993514c7bc89845e6d6459f8",
+    "cacheID": "780e108a52d2fcbde6653de5d2ee058b",
     "id": null,
     "metadata": {},
     "name": "EvidenceGraphFileQuery",
     "operationKind": "query",
-    "text": "query EvidenceGraphFileQuery(\n  $evidenceId: ID!\n) {\n  node(id: $evidenceId) {\n    __typename\n    ... on Evidence {\n      id\n      mimeType\n      filename\n      fileUrl\n    }\n    id\n  }\n}\n"
+    "text": "query EvidenceGraphFileQuery(\n  $evidenceId: ID!\n) {\n  node(id: $evidenceId) {\n    __typename\n    ... on Evidence {\n      id\n      file {\n        mimeType\n        fileName\n        size\n        downloadUrl\n        id\n      }\n    }\n    id\n  }\n}\n"
   }
 };
 })();
 
-(node as any).hash = "3c9aa6ff338d2380a7a03b8ea61e83e0";
+(node as any).hash = "186386e82f82feb9c5b5a54f9d937903";
 
 export default node;
diff --git a/apps/console/src/hooks/graph/__generated__/MeasureGraphNodeQuery.graphql.ts b/apps/console/src/hooks/graph/__generated__/MeasureGraphNodeQuery.graphql.ts
index 94920b3e0..1338faeef 100644
--- a/apps/console/src/hooks/graph/__generated__/MeasureGraphNodeQuery.graphql.ts
+++ b/apps/console/src/hooks/graph/__generated__/MeasureGraphNodeQuery.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<074d65be2a59b6b8284ff6be0f75707d>>
+ * @generated SignedSource<<1f413a42110dae78274cf3250fa4db4e>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -594,22 +594,34 @@ return {
                           {
                             "alias": null,
                             "args": null,
-                            "kind": "ScalarField",
-                            "name": "filename",
-                            "storageKey": null
-                          },
-                          {
-                            "alias": null,
-                            "args": null,
-                            "kind": "ScalarField",
-                            "name": "mimeType",
-                            "storageKey": null
-                          },
-                          {
-                            "alias": null,
-                            "args": null,
-                            "kind": "ScalarField",
-                            "name": "size",
+                            "concreteType": "File",
+                            "kind": "LinkedField",
+                            "name": "file",
+                            "plural": false,
+                            "selections": [
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "fileName",
+                                "storageKey": null
+                              },
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "mimeType",
+                                "storageKey": null
+                              },
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "size",
+                                "storageKey": null
+                              },
+                              (v2/*: any*/)
+                            ],
                             "storageKey": null
                           },
                           {
@@ -660,12 +672,12 @@ return {
     ]
   },
   "params": {
-    "cacheID": "6146a6fada0328c7b69652646212be05",
+    "cacheID": "d20815cee9ca8dec2e09fcefdd54a68a",
     "id": null,
     "metadata": {},
     "name": "MeasureGraphNodeQuery",
     "operationKind": "query",
-    "text": "query MeasureGraphNodeQuery(\n  $measureId: ID!\n) {\n  node(id: $measureId) {\n    __typename\n    ... on Measure {\n      id\n      name\n      description\n      state\n      category\n      evidencesInfos: evidences(first: 0) {\n        totalCount\n      }\n      risksInfos: risks(first: 0) {\n        totalCount\n      }\n      tasksInfos: tasks(first: 0) {\n        totalCount\n      }\n      controlsInfos: controls(first: 0) {\n        totalCount\n      }\n      ...MeasureRisksTabFragment\n      ...MeasureTasksTabFragment\n      ...MeasureControlsTabFragment\n      ...MeasureFormDialogMeasureFragment\n      ...MeasureEvidencesTabFragment\n    }\n    id\n  }\n}\n\nfragment LinkedControlsCardFragment on Control {\n  id\n  name\n  sectionTitle\n  framework {\n    id\n    name\n  }\n}\n\nfragment LinkedRisksCardFragment on Risk {\n  id\n  name\n  inherentRiskScore\n  residualRiskScore\n}\n\nfragment MeasureControlsTabFragment on Measure {\n  id\n  controls(first: 20) {\n    edges {\n      node {\n        id\n        ...LinkedControlsCardFragment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n}\n\nfragment MeasureEvidencesTabFragment on Measure {\n  id\n  evidences(first: 50) {\n    edges {\n      node {\n        id\n        filename\n        mimeType\n        ...MeasureEvidencesTabFragment_evidence\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n}\n\nfragment MeasureEvidencesTabFragment_evidence on Evidence {\n  id\n  filename\n  size\n  type\n  createdAt\n  mimeType\n}\n\nfragment MeasureFormDialogMeasureFragment on Measure {\n  id\n  description\n  name\n  category\n  state\n}\n\nfragment MeasureRisksTabFragment on Measure {\n  id\n  risks(first: 100) {\n    edges {\n      node {\n        id\n        ...LinkedRisksCardFragment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n    }\n  }\n}\n\nfragment MeasureTasksTabFragment on Measure {\n  tasks(first: 100) {\n    edges {\n      node {\n        id\n        name\n        state\n        description\n        ...TaskFormDialogFragment\n        assignedTo {\n          id\n          fullName\n        }\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n    }\n  }\n}\n\nfragment TaskFormDialogFragment on Task {\n  id\n  description\n  name\n  state\n  timeEstimate\n  deadline\n  assignedTo {\n    id\n  }\n  measure {\n    id\n  }\n}\n"
+    "text": "query MeasureGraphNodeQuery(\n  $measureId: ID!\n) {\n  node(id: $measureId) {\n    __typename\n    ... on Measure {\n      id\n      name\n      description\n      state\n      category\n      evidencesInfos: evidences(first: 0) {\n        totalCount\n      }\n      risksInfos: risks(first: 0) {\n        totalCount\n      }\n      tasksInfos: tasks(first: 0) {\n        totalCount\n      }\n      controlsInfos: controls(first: 0) {\n        totalCount\n      }\n      ...MeasureRisksTabFragment\n      ...MeasureTasksTabFragment\n      ...MeasureControlsTabFragment\n      ...MeasureFormDialogMeasureFragment\n      ...MeasureEvidencesTabFragment\n    }\n    id\n  }\n}\n\nfragment LinkedControlsCardFragment on Control {\n  id\n  name\n  sectionTitle\n  framework {\n    id\n    name\n  }\n}\n\nfragment LinkedRisksCardFragment on Risk {\n  id\n  name\n  inherentRiskScore\n  residualRiskScore\n}\n\nfragment MeasureControlsTabFragment on Measure {\n  id\n  controls(first: 20) {\n    edges {\n      node {\n        id\n        ...LinkedControlsCardFragment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n}\n\nfragment MeasureEvidencesTabFragment on Measure {\n  id\n  evidences(first: 50) {\n    edges {\n      node {\n        id\n        file {\n          fileName\n          mimeType\n          size\n          id\n        }\n        ...MeasureEvidencesTabFragment_evidence\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n}\n\nfragment MeasureEvidencesTabFragment_evidence on Evidence {\n  id\n  file {\n    fileName\n    mimeType\n    size\n    id\n  }\n  type\n  createdAt\n}\n\nfragment MeasureFormDialogMeasureFragment on Measure {\n  id\n  description\n  name\n  category\n  state\n}\n\nfragment MeasureRisksTabFragment on Measure {\n  id\n  risks(first: 100) {\n    edges {\n      node {\n        id\n        ...LinkedRisksCardFragment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n    }\n  }\n}\n\nfragment MeasureTasksTabFragment on Measure {\n  tasks(first: 100) {\n    edges {\n      node {\n        id\n        name\n        state\n        description\n        ...TaskFormDialogFragment\n        assignedTo {\n          id\n          fullName\n        }\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n    }\n  }\n}\n\nfragment TaskFormDialogFragment on Task {\n  id\n  description\n  name\n  state\n  timeEstimate\n  deadline\n  assignedTo {\n    id\n  }\n  measure {\n    id\n  }\n}\n"
   }
 };
 })();
diff --git a/apps/console/src/hooks/graph/__generated__/VendorGraphNodeQuery.graphql.ts b/apps/console/src/hooks/graph/__generated__/VendorGraphNodeQuery.graphql.ts
index c48553457..c132831e8 100644
--- a/apps/console/src/hooks/graph/__generated__/VendorGraphNodeQuery.graphql.ts
+++ b/apps/console/src/hooks/graph/__generated__/VendorGraphNodeQuery.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<d72032da6df08b84ce9c7ec87b950d08>>
+ * @generated SignedSource<<fdfadfbc4f5fdecf5f70a8c92d3ded88>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -145,7 +145,7 @@ v13 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
-  "name": "fileUrl",
+  "name": "fileName",
   "storageKey": null
 },
 v14 = {
@@ -229,14 +229,14 @@ v23 = {
 },
 v24 = [
   (v3/*: any*/),
+  (v13/*: any*/),
   {
     "alias": null,
     "args": null,
     "kind": "ScalarField",
-    "name": "fileName",
+    "name": "fileUrl",
     "storageKey": null
   },
-  (v13/*: any*/),
   {
     "alias": null,
     "args": null,
@@ -500,12 +500,31 @@ return {
                             "name": "reportName",
                             "storageKey": null
                           },
-                          (v13/*: any*/),
                           {
                             "alias": null,
                             "args": null,
-                            "kind": "ScalarField",
-                            "name": "fileSize",
+                            "concreteType": "File",
+                            "kind": "LinkedField",
+                            "name": "file",
+                            "plural": false,
+                            "selections": [
+                              (v13/*: any*/),
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "mimeType",
+                                "storageKey": null
+                              },
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "size",
+                                "storageKey": null
+                              },
+                              (v3/*: any*/)
+                            ],
                             "storageKey": null
                           },
                           (v9/*: any*/)
@@ -791,12 +810,12 @@ return {
     ]
   },
   "params": {
-    "cacheID": "4a112f861864990f5022d279ba8d43d4",
+    "cacheID": "faee4f059ef9baab46d5f2420e36bb60",
     "id": null,
     "metadata": {},
     "name": "VendorGraphNodeQuery",
     "operationKind": "query",
-    "text": "query VendorGraphNodeQuery(\n  $vendorId: ID!\n  $organizationId: ID!\n) {\n  node(id: $vendorId) {\n    __typename\n    ... on Vendor {\n      id\n      snapshotId\n      name\n      websiteUrl\n      ...useVendorFormFragment\n      ...VendorComplianceTabFragment\n      ...VendorContactsTabFragment\n      ...VendorServicesTabFragment\n      ...VendorRiskAssessmentTabFragment\n      ...VendorOverviewTabBusinessAssociateAgreementFragment\n      ...VendorOverviewTabDataPrivacyAgreementFragment\n    }\n    id\n  }\n  viewer {\n    user {\n      id\n      people(organizationId: $organizationId) {\n        id\n      }\n    }\n    id\n  }\n}\n\nfragment VendorComplianceTabFragment on Vendor {\n  complianceReports(first: 50) {\n    edges {\n      node {\n        id\n        ...VendorComplianceTabFragment_report\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment VendorComplianceTabFragment_report on VendorComplianceReport {\n  id\n  reportDate\n  validUntil\n  reportName\n  fileUrl\n  fileSize\n}\n\nfragment VendorContactsTabFragment on Vendor {\n  contacts(first: 50) {\n    edges {\n      node {\n        id\n        ...VendorContactsTabFragment_contact\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment VendorContactsTabFragment_contact on VendorContact {\n  id\n  fullName\n  email\n  phone\n  role\n  createdAt\n  updatedAt\n}\n\nfragment VendorOverviewTabBusinessAssociateAgreementFragment on Vendor {\n  businessAssociateAgreement {\n    id\n    fileName\n    fileUrl\n    validFrom\n    validUntil\n    createdAt\n  }\n}\n\nfragment VendorOverviewTabDataPrivacyAgreementFragment on Vendor {\n  dataPrivacyAgreement {\n    id\n    fileName\n    fileUrl\n    validFrom\n    validUntil\n    createdAt\n  }\n}\n\nfragment VendorRiskAssessmentTabFragment on Vendor {\n  id\n  riskAssessments(first: 50) {\n    edges {\n      node {\n        id\n        ...VendorRiskAssessmentTabFragment_assessment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      hasNextPage\n      endCursor\n      hasPreviousPage\n      startCursor\n    }\n  }\n}\n\nfragment VendorRiskAssessmentTabFragment_assessment on VendorRiskAssessment {\n  id\n  createdAt\n  expiresAt\n  dataSensitivity\n  businessImpact\n  notes\n}\n\nfragment VendorServicesTabFragment on Vendor {\n  services(first: 50) {\n    edges {\n      node {\n        id\n        ...VendorServicesTabFragment_service\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment VendorServicesTabFragment_service on VendorService {\n  id\n  name\n  description\n  createdAt\n  updatedAt\n}\n\nfragment useVendorFormFragment on Vendor {\n  id\n  name\n  description\n  category\n  statusPageUrl\n  termsOfServiceUrl\n  privacyPolicyUrl\n  serviceLevelAgreementUrl\n  dataProcessingAgreementUrl\n  websiteUrl\n  legalName\n  headquarterAddress\n  certifications\n  countries\n  securityPageUrl\n  trustPageUrl\n  businessOwner {\n    id\n  }\n  securityOwner {\n    id\n  }\n}\n"
+    "text": "query VendorGraphNodeQuery(\n  $vendorId: ID!\n  $organizationId: ID!\n) {\n  node(id: $vendorId) {\n    __typename\n    ... on Vendor {\n      id\n      snapshotId\n      name\n      websiteUrl\n      ...useVendorFormFragment\n      ...VendorComplianceTabFragment\n      ...VendorContactsTabFragment\n      ...VendorServicesTabFragment\n      ...VendorRiskAssessmentTabFragment\n      ...VendorOverviewTabBusinessAssociateAgreementFragment\n      ...VendorOverviewTabDataPrivacyAgreementFragment\n    }\n    id\n  }\n  viewer {\n    user {\n      id\n      people(organizationId: $organizationId) {\n        id\n      }\n    }\n    id\n  }\n}\n\nfragment VendorComplianceTabFragment on Vendor {\n  complianceReports(first: 50) {\n    edges {\n      node {\n        id\n        ...VendorComplianceTabFragment_report\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment VendorComplianceTabFragment_report on VendorComplianceReport {\n  id\n  reportDate\n  validUntil\n  reportName\n  file {\n    fileName\n    mimeType\n    size\n    id\n  }\n}\n\nfragment VendorContactsTabFragment on Vendor {\n  contacts(first: 50) {\n    edges {\n      node {\n        id\n        ...VendorContactsTabFragment_contact\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment VendorContactsTabFragment_contact on VendorContact {\n  id\n  fullName\n  email\n  phone\n  role\n  createdAt\n  updatedAt\n}\n\nfragment VendorOverviewTabBusinessAssociateAgreementFragment on Vendor {\n  businessAssociateAgreement {\n    id\n    fileName\n    fileUrl\n    validFrom\n    validUntil\n    createdAt\n  }\n}\n\nfragment VendorOverviewTabDataPrivacyAgreementFragment on Vendor {\n  dataPrivacyAgreement {\n    id\n    fileName\n    fileUrl\n    validFrom\n    validUntil\n    createdAt\n  }\n}\n\nfragment VendorRiskAssessmentTabFragment on Vendor {\n  id\n  riskAssessments(first: 50) {\n    edges {\n      node {\n        id\n        ...VendorRiskAssessmentTabFragment_assessment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      hasNextPage\n      endCursor\n      hasPreviousPage\n      startCursor\n    }\n  }\n}\n\nfragment VendorRiskAssessmentTabFragment_assessment on VendorRiskAssessment {\n  id\n  createdAt\n  expiresAt\n  dataSensitivity\n  businessImpact\n  notes\n}\n\nfragment VendorServicesTabFragment on Vendor {\n  services(first: 50) {\n    edges {\n      node {\n        id\n        ...VendorServicesTabFragment_service\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment VendorServicesTabFragment_service on VendorService {\n  id\n  name\n  description\n  createdAt\n  updatedAt\n}\n\nfragment useVendorFormFragment on Vendor {\n  id\n  name\n  description\n  category\n  statusPageUrl\n  termsOfServiceUrl\n  privacyPolicyUrl\n  serviceLevelAgreementUrl\n  dataProcessingAgreementUrl\n  websiteUrl\n  legalName\n  headquarterAddress\n  certifications\n  countries\n  securityPageUrl\n  trustPageUrl\n  businessOwner {\n    id\n  }\n  securityOwner {\n    id\n  }\n}\n"
   }
 };
 })();
diff --git a/apps/console/src/pages/organizations/measures/dialog/EvidenceDownloadDialog.tsx b/apps/console/src/pages/organizations/measures/dialog/EvidenceDownloadDialog.tsx
index c935fda8f..a75cdc1cf 100644
--- a/apps/console/src/pages/organizations/measures/dialog/EvidenceDownloadDialog.tsx
+++ b/apps/console/src/pages/organizations/measures/dialog/EvidenceDownloadDialog.tsx
@@ -50,7 +50,7 @@ function DownloadLink({ evidenceId, onClose }: Props) {
   const evidence = data.node;
 
   useEffect(() => {
-    downloadFile(evidence.fileUrl, evidence.filename ?? "evidence");
+    downloadFile(evidence.file?.downloadUrl, evidence.file?.fileName ?? "evidence");
     onClose();
   }, [evidence]);
 
diff --git a/apps/console/src/pages/organizations/measures/dialog/EvidencePreviewDialog.tsx b/apps/console/src/pages/organizations/measures/dialog/EvidencePreviewDialog.tsx
index 19297ff6c..31d5d19a9 100644
--- a/apps/console/src/pages/organizations/measures/dialog/EvidencePreviewDialog.tsx
+++ b/apps/console/src/pages/organizations/measures/dialog/EvidencePreviewDialog.tsx
@@ -75,13 +75,13 @@ function EvidencePreviewContent({
   const { __ } = useTranslate();
   const { toast } = useToast();
   const isUriFile =
-    evidence.mimeType === "text/uri-list" || evidence.mimeType === "text/uri";
+    evidence.file?.mimeType === "text/uri-list" || evidence.file?.mimeType === "text/uri";
   useEffect(() => {
     if (!isUriFile) {
       return;
     }
     const abortController = new AbortController();
-    fetchUrlFromUriFile(evidence.fileUrl ?? "", {
+    fetchUrlFromUriFile(evidence.file?.downloadUrl ?? "", {
       signal: abortController.signal,
     })
       .then((url) => {
@@ -101,9 +101,9 @@ function EvidencePreviewContent({
     return () => {
       abortController.abort();
     };
-  }, [evidence.fileUrl, isUriFile]);
+  }, [evidence.file?.downloadUrl, isUriFile]);
 
-  if (!evidence.fileUrl) {
+  if (!evidence.file?.downloadUrl) {
     return null;
   }
 
@@ -115,22 +115,22 @@ function EvidencePreviewContent({
     );
   }
 
-  if (evidence.mimeType?.startsWith("image/")) {
+  if (evidence.file.mimeType?.startsWith("image/")) {
     return (
       <img
-        src={evidence.fileUrl}
-        alt={evidence.filename}
+        src={evidence.file.downloadUrl}
+        alt={evidence.file.fileName}
         className="max-h-[70vh] object-contain"
       />
     );
   }
 
-  if (evidence.mimeType?.includes("pdf")) {
+  if (evidence.file.mimeType?.includes("pdf")) {
     return (
       <iframe
-        src={evidence.fileUrl}
+        src={evidence.file.downloadUrl}
         className="w-full h-[70vh]"
-        title={evidence.filename}
+        title={evidence.file.fileName}
       />
     );
   }
@@ -141,10 +141,10 @@ function EvidencePreviewContent({
       <p className="text-txt-secondary text-center">
         {__("Preview not available for this file type") +
           " " +
-          evidence.mimeType}
+          evidence.file.mimeType}
       </p>
       <Button asChild variant="secondary" icon={IconArrowInbox}>
-        <a href={evidence.fileUrl} target="_blank">
+        <a href={evidence.file.downloadUrl} target="_blank">
           {__("Download File")}
         </a>
       </Button>
diff --git a/apps/console/src/pages/organizations/measures/dialog/__generated__/CreateEvidenceDialogUploadMutation.graphql.ts b/apps/console/src/pages/organizations/measures/dialog/__generated__/CreateEvidenceDialogUploadMutation.graphql.ts
index 62f224074..573e779f5 100644
--- a/apps/console/src/pages/organizations/measures/dialog/__generated__/CreateEvidenceDialogUploadMutation.graphql.ts
+++ b/apps/console/src/pages/organizations/measures/dialog/__generated__/CreateEvidenceDialogUploadMutation.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<9297f85591b8ab4723a207f6db6a27f6>>
+ * @generated SignedSource<<3ed9b93b29f7a5117adbb33ad359f34e>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -148,15 +148,34 @@ return {
                   {
                     "alias": null,
                     "args": null,
-                    "kind": "ScalarField",
-                    "name": "filename",
-                    "storageKey": null
-                  },
-                  {
-                    "alias": null,
-                    "args": null,
-                    "kind": "ScalarField",
-                    "name": "size",
+                    "concreteType": "File",
+                    "kind": "LinkedField",
+                    "name": "file",
+                    "plural": false,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "fileName",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "mimeType",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "size",
+                        "storageKey": null
+                      },
+                      (v3/*: any*/)
+                    ],
                     "storageKey": null
                   },
                   {
@@ -172,13 +191,6 @@ return {
                     "kind": "ScalarField",
                     "name": "createdAt",
                     "storageKey": null
-                  },
-                  {
-                    "alias": null,
-                    "args": null,
-                    "kind": "ScalarField",
-                    "name": "mimeType",
-                    "storageKey": null
                   }
                 ],
                 "storageKey": null
@@ -208,12 +220,12 @@ return {
     ]
   },
   "params": {
-    "cacheID": "5206b6576cacb45f5b42305bb1bb7df1",
+    "cacheID": "4224b79c60bb9be5f4768da436659656",
     "id": null,
     "metadata": {},
     "name": "CreateEvidenceDialogUploadMutation",
     "operationKind": "mutation",
-    "text": "mutation CreateEvidenceDialogUploadMutation(\n  $input: UploadMeasureEvidenceInput!\n) {\n  uploadMeasureEvidence(input: $input) {\n    evidenceEdge {\n      node {\n        id\n        ...MeasureEvidencesTabFragment_evidence\n      }\n    }\n  }\n}\n\nfragment MeasureEvidencesTabFragment_evidence on Evidence {\n  id\n  filename\n  size\n  type\n  createdAt\n  mimeType\n}\n"
+    "text": "mutation CreateEvidenceDialogUploadMutation(\n  $input: UploadMeasureEvidenceInput!\n) {\n  uploadMeasureEvidence(input: $input) {\n    evidenceEdge {\n      node {\n        id\n        ...MeasureEvidencesTabFragment_evidence\n      }\n    }\n  }\n}\n\nfragment MeasureEvidencesTabFragment_evidence on Evidence {\n  id\n  file {\n    fileName\n    mimeType\n    size\n    id\n  }\n  type\n  createdAt\n}\n"
   }
 };
 })();
diff --git a/apps/console/src/pages/organizations/measures/tabs/MeasureEvidencesTab.tsx b/apps/console/src/pages/organizations/measures/tabs/MeasureEvidencesTab.tsx
index 48f8bfee5..07eb8dcea 100644
--- a/apps/console/src/pages/organizations/measures/tabs/MeasureEvidencesTab.tsx
+++ b/apps/console/src/pages/organizations/measures/tabs/MeasureEvidencesTab.tsx
@@ -56,8 +56,11 @@ export const evidencesFragment = graphql`
       edges {
         node {
           id
-          filename
-          mimeType
+          file {
+              fileName
+              mimeType
+              size
+          }
           ...MeasureEvidencesTabFragment_evidence
         }
       }
@@ -68,11 +71,13 @@ export const evidencesFragment = graphql`
 export const evidenceFragment = graphql`
   fragment MeasureEvidencesTabFragment_evidence on Evidence {
     id
-    filename
-    size
+    file {
+        fileName
+        mimeType
+        size
+    }
     type
     createdAt
-    mimeType
   }
 `;
 
@@ -150,7 +155,7 @@ export default function MeasureEvidencesTab() {
             navigate(baseUrl);
           }}
           evidenceId={evidence.id}
-          filename={evidence.filename}
+          filename={evidence.file?.fileName || ""}
         />
       )}
       {!isSnapshotMode && (
@@ -207,7 +212,7 @@ function EvidenceRow(props: {
           __(
             'This will permanently delete the evidence "%s". This action cannot be undone.'
           ),
-          evidence.filename
+          evidence.file?.fileName
         ),
       }
     );
@@ -226,9 +231,9 @@ function EvidenceRow(props: {
         />
       )}
       <Tr to={evidenceUrl}>
-        <Td>{evidence.filename}</Td>
-        <Td>{fileType(__, evidence)}</Td>
-        <Td>{fileSize(__, evidence.size)}</Td>
+        <Td>{evidence.file?.fileName}</Td>
+        <Td>{fileType(__, {type: evidence.type, mimeType: evidence.file?.mimeType || ''})}</Td>
+        <Td>{fileSize(__, evidence.file?.size || 0)}</Td>
         <Td>{formatDate(evidence.createdAt)}</Td>
         <Td noLink>
           {!props.hideActions && (
diff --git a/apps/console/src/pages/organizations/measures/tabs/__generated__/MeasureEvidencesTabFragment.graphql.ts b/apps/console/src/pages/organizations/measures/tabs/__generated__/MeasureEvidencesTabFragment.graphql.ts
index a2ac00cf4..a8be09b4d 100644
--- a/apps/console/src/pages/organizations/measures/tabs/__generated__/MeasureEvidencesTabFragment.graphql.ts
+++ b/apps/console/src/pages/organizations/measures/tabs/__generated__/MeasureEvidencesTabFragment.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<6c96b0b565302f1ec1601561087b30bd>>
+ * @generated SignedSource<<95a549108a1a26ccfaf2d8aae42cea73>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -15,9 +15,12 @@ export type MeasureEvidencesTabFragment$data = {
     readonly __id: string;
     readonly edges: ReadonlyArray<{
       readonly node: {
-        readonly filename: string;
+        readonly file: {
+          readonly fileName: string;
+          readonly mimeType: string;
+          readonly size: any;
+        } | null | undefined;
         readonly id: string;
-        readonly mimeType: string;
         readonly " $fragmentSpreads": FragmentRefs<"MeasureEvidencesTabFragment_evidence">;
       };
     }>;
@@ -140,15 +143,33 @@ return {
                 {
                   "alias": null,
                   "args": null,
-                  "kind": "ScalarField",
-                  "name": "filename",
-                  "storageKey": null
-                },
-                {
-                  "alias": null,
-                  "args": null,
-                  "kind": "ScalarField",
-                  "name": "mimeType",
+                  "concreteType": "File",
+                  "kind": "LinkedField",
+                  "name": "file",
+                  "plural": false,
+                  "selections": [
+                    {
+                      "alias": null,
+                      "args": null,
+                      "kind": "ScalarField",
+                      "name": "fileName",
+                      "storageKey": null
+                    },
+                    {
+                      "alias": null,
+                      "args": null,
+                      "kind": "ScalarField",
+                      "name": "mimeType",
+                      "storageKey": null
+                    },
+                    {
+                      "alias": null,
+                      "args": null,
+                      "kind": "ScalarField",
+                      "name": "size",
+                      "storageKey": null
+                    }
+                  ],
                   "storageKey": null
                 },
                 {
@@ -236,6 +257,6 @@ return {
 };
 })();
 
-(node as any).hash = "8e97649ca88af04aa1184e68a126cc36";
+(node as any).hash = "c80a159cbb4ac8b8855875eff00d1255";
 
 export default node;
diff --git a/apps/console/src/pages/organizations/measures/tabs/__generated__/MeasureEvidencesTabFragment_evidence.graphql.ts b/apps/console/src/pages/organizations/measures/tabs/__generated__/MeasureEvidencesTabFragment_evidence.graphql.ts
index af33fe884..5a10e828f 100644
--- a/apps/console/src/pages/organizations/measures/tabs/__generated__/MeasureEvidencesTabFragment_evidence.graphql.ts
+++ b/apps/console/src/pages/organizations/measures/tabs/__generated__/MeasureEvidencesTabFragment_evidence.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<60897aba5bbafb70288358e56b0a442a>>
+ * @generated SignedSource<<0fb98c755d9aacac0ef1d508af9e7edc>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -13,10 +13,12 @@ export type EvidenceType = "FILE" | "LINK";
 import { FragmentRefs } from "relay-runtime";
 export type MeasureEvidencesTabFragment_evidence$data = {
   readonly createdAt: any;
-  readonly filename: string;
+  readonly file: {
+    readonly fileName: string;
+    readonly mimeType: string;
+    readonly size: any;
+  } | null | undefined;
   readonly id: string;
-  readonly mimeType: string;
-  readonly size: number;
   readonly type: EvidenceType;
   readonly " $fragmentType": "MeasureEvidencesTabFragment_evidence";
 };
@@ -41,15 +43,33 @@ const node: ReaderFragment = {
     {
       "alias": null,
       "args": null,
-      "kind": "ScalarField",
-      "name": "filename",
-      "storageKey": null
-    },
-    {
-      "alias": null,
-      "args": null,
-      "kind": "ScalarField",
-      "name": "size",
+      "concreteType": "File",
+      "kind": "LinkedField",
+      "name": "file",
+      "plural": false,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "fileName",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "mimeType",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "size",
+          "storageKey": null
+        }
+      ],
       "storageKey": null
     },
     {
@@ -65,19 +85,12 @@ const node: ReaderFragment = {
       "kind": "ScalarField",
       "name": "createdAt",
       "storageKey": null
-    },
-    {
-      "alias": null,
-      "args": null,
-      "kind": "ScalarField",
-      "name": "mimeType",
-      "storageKey": null
     }
   ],
   "type": "Evidence",
   "abstractKey": null
 };
 
-(node as any).hash = "4b3289f3cb9d29cb48f1a370d943cd0e";
+(node as any).hash = "441ff1dd2dd62fea27050c5f550b27ea";
 
 export default node;
diff --git a/apps/console/src/pages/organizations/measures/tabs/__generated__/MeasureEvidencesTabQuery.graphql.ts b/apps/console/src/pages/organizations/measures/tabs/__generated__/MeasureEvidencesTabQuery.graphql.ts
index 6c959f6ad..6050c4793 100644
--- a/apps/console/src/pages/organizations/measures/tabs/__generated__/MeasureEvidencesTabQuery.graphql.ts
+++ b/apps/console/src/pages/organizations/measures/tabs/__generated__/MeasureEvidencesTabQuery.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<b2d32283d91e7ef9da2eeda3c789867f>>
+ * @generated SignedSource<<b182b11e656579608aba8fb03faa0ef6>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -215,22 +215,34 @@ return {
                           {
                             "alias": null,
                             "args": null,
-                            "kind": "ScalarField",
-                            "name": "filename",
-                            "storageKey": null
-                          },
-                          {
-                            "alias": null,
-                            "args": null,
-                            "kind": "ScalarField",
-                            "name": "mimeType",
-                            "storageKey": null
-                          },
-                          {
-                            "alias": null,
-                            "args": null,
-                            "kind": "ScalarField",
-                            "name": "size",
+                            "concreteType": "File",
+                            "kind": "LinkedField",
+                            "name": "file",
+                            "plural": false,
+                            "selections": [
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "fileName",
+                                "storageKey": null
+                              },
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "mimeType",
+                                "storageKey": null
+                              },
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "size",
+                                "storageKey": null
+                              },
+                              (v12/*: any*/)
+                            ],
                             "storageKey": null
                           },
                           {
@@ -336,16 +348,16 @@ return {
     ]
   },
   "params": {
-    "cacheID": "9899e64b590ff4c76ca994845611d77a",
+    "cacheID": "45ba257dabcf1cc7dd4aa05b699c280e",
     "id": null,
     "metadata": {},
     "name": "MeasureEvidencesTabQuery",
     "operationKind": "query",
-    "text": "query MeasureEvidencesTabQuery(\n  $after: CursorKey = null\n  $before: CursorKey = null\n  $first: Int = 50\n  $last: Int = null\n  $order: EvidenceOrder = null\n  $id: ID!\n) {\n  node(id: $id) {\n    __typename\n    ...MeasureEvidencesTabFragment_16fISc\n    id\n  }\n}\n\nfragment MeasureEvidencesTabFragment_16fISc on Measure {\n  id\n  evidences(first: $first, after: $after, last: $last, before: $before, orderBy: $order) {\n    edges {\n      node {\n        id\n        filename\n        mimeType\n        ...MeasureEvidencesTabFragment_evidence\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n}\n\nfragment MeasureEvidencesTabFragment_evidence on Evidence {\n  id\n  filename\n  size\n  type\n  createdAt\n  mimeType\n}\n"
+    "text": "query MeasureEvidencesTabQuery(\n  $after: CursorKey = null\n  $before: CursorKey = null\n  $first: Int = 50\n  $last: Int = null\n  $order: EvidenceOrder = null\n  $id: ID!\n) {\n  node(id: $id) {\n    __typename\n    ...MeasureEvidencesTabFragment_16fISc\n    id\n  }\n}\n\nfragment MeasureEvidencesTabFragment_16fISc on Measure {\n  id\n  evidences(first: $first, after: $after, last: $last, before: $before, orderBy: $order) {\n    edges {\n      node {\n        id\n        file {\n          fileName\n          mimeType\n          size\n          id\n        }\n        ...MeasureEvidencesTabFragment_evidence\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n}\n\nfragment MeasureEvidencesTabFragment_evidence on Evidence {\n  id\n  file {\n    fileName\n    mimeType\n    size\n    id\n  }\n  type\n  createdAt\n}\n"
   }
 };
 })();
 
-(node as any).hash = "8e97649ca88af04aa1184e68a126cc36";
+(node as any).hash = "c80a159cbb4ac8b8855875eff00d1255";
 
 export default node;
diff --git a/apps/console/src/pages/organizations/vendors/dialogs/__generated__/ImportAssessmentDialogMutation.graphql.ts b/apps/console/src/pages/organizations/vendors/dialogs/__generated__/ImportAssessmentDialogMutation.graphql.ts
index 2ec2de604..c239bc0a2 100644
--- a/apps/console/src/pages/organizations/vendors/dialogs/__generated__/ImportAssessmentDialogMutation.graphql.ts
+++ b/apps/console/src/pages/organizations/vendors/dialogs/__generated__/ImportAssessmentDialogMutation.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<22e7411298e2df9b5f5eae17bb0a510f>>
+ * @generated SignedSource<<f851ea2f7b0fa09f081a26967bb7766e>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -371,15 +371,34 @@ return {
                           {
                             "alias": null,
                             "args": null,
-                            "kind": "ScalarField",
-                            "name": "fileUrl",
-                            "storageKey": null
-                          },
-                          {
-                            "alias": null,
-                            "args": null,
-                            "kind": "ScalarField",
-                            "name": "fileSize",
+                            "concreteType": "File",
+                            "kind": "LinkedField",
+                            "name": "file",
+                            "plural": false,
+                            "selections": [
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "fileName",
+                                "storageKey": null
+                              },
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "mimeType",
+                                "storageKey": null
+                              },
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "size",
+                                "storageKey": null
+                              },
+                              (v2/*: any*/)
+                            ],
                             "storageKey": null
                           },
                           (v7/*: any*/)
@@ -523,12 +542,12 @@ return {
     ]
   },
   "params": {
-    "cacheID": "0cb0f301c3022d933fd9ee0d6319d3e4",
+    "cacheID": "d0d8cc2e128b7a7b31f5e9c86e427a7f",
     "id": null,
     "metadata": {},
     "name": "ImportAssessmentDialogMutation",
     "operationKind": "mutation",
-    "text": "mutation ImportAssessmentDialogMutation(\n  $input: AssessVendorInput!\n) {\n  assessVendor(input: $input) {\n    vendor {\n      id\n      name\n      websiteUrl\n      ...useVendorFormFragment\n      ...VendorComplianceTabFragment\n      ...VendorRiskAssessmentTabFragment\n    }\n  }\n}\n\nfragment VendorComplianceTabFragment on Vendor {\n  complianceReports(first: 50) {\n    edges {\n      node {\n        id\n        ...VendorComplianceTabFragment_report\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment VendorComplianceTabFragment_report on VendorComplianceReport {\n  id\n  reportDate\n  validUntil\n  reportName\n  fileUrl\n  fileSize\n}\n\nfragment VendorRiskAssessmentTabFragment on Vendor {\n  id\n  riskAssessments(first: 50) {\n    edges {\n      node {\n        id\n        ...VendorRiskAssessmentTabFragment_assessment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      hasNextPage\n      endCursor\n      hasPreviousPage\n      startCursor\n    }\n  }\n}\n\nfragment VendorRiskAssessmentTabFragment_assessment on VendorRiskAssessment {\n  id\n  createdAt\n  expiresAt\n  dataSensitivity\n  businessImpact\n  notes\n}\n\nfragment useVendorFormFragment on Vendor {\n  id\n  name\n  description\n  category\n  statusPageUrl\n  termsOfServiceUrl\n  privacyPolicyUrl\n  serviceLevelAgreementUrl\n  dataProcessingAgreementUrl\n  websiteUrl\n  legalName\n  headquarterAddress\n  certifications\n  countries\n  securityPageUrl\n  trustPageUrl\n  businessOwner {\n    id\n  }\n  securityOwner {\n    id\n  }\n}\n"
+    "text": "mutation ImportAssessmentDialogMutation(\n  $input: AssessVendorInput!\n) {\n  assessVendor(input: $input) {\n    vendor {\n      id\n      name\n      websiteUrl\n      ...useVendorFormFragment\n      ...VendorComplianceTabFragment\n      ...VendorRiskAssessmentTabFragment\n    }\n  }\n}\n\nfragment VendorComplianceTabFragment on Vendor {\n  complianceReports(first: 50) {\n    edges {\n      node {\n        id\n        ...VendorComplianceTabFragment_report\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment VendorComplianceTabFragment_report on VendorComplianceReport {\n  id\n  reportDate\n  validUntil\n  reportName\n  file {\n    fileName\n    mimeType\n    size\n    id\n  }\n}\n\nfragment VendorRiskAssessmentTabFragment on Vendor {\n  id\n  riskAssessments(first: 50) {\n    edges {\n      node {\n        id\n        ...VendorRiskAssessmentTabFragment_assessment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      hasNextPage\n      endCursor\n      hasPreviousPage\n      startCursor\n    }\n  }\n}\n\nfragment VendorRiskAssessmentTabFragment_assessment on VendorRiskAssessment {\n  id\n  createdAt\n  expiresAt\n  dataSensitivity\n  businessImpact\n  notes\n}\n\nfragment useVendorFormFragment on Vendor {\n  id\n  name\n  description\n  category\n  statusPageUrl\n  termsOfServiceUrl\n  privacyPolicyUrl\n  serviceLevelAgreementUrl\n  dataProcessingAgreementUrl\n  websiteUrl\n  legalName\n  headquarterAddress\n  certifications\n  countries\n  securityPageUrl\n  trustPageUrl\n  businessOwner {\n    id\n  }\n  securityOwner {\n    id\n  }\n}\n"
   }
 };
 })();
diff --git a/apps/console/src/pages/organizations/vendors/tabs/VendorComplianceTab.tsx b/apps/console/src/pages/organizations/vendors/tabs/VendorComplianceTab.tsx
index e3cc3d900..b03e569fa 100644
--- a/apps/console/src/pages/organizations/vendors/tabs/VendorComplianceTab.tsx
+++ b/apps/console/src/pages/organizations/vendors/tabs/VendorComplianceTab.tsx
@@ -55,8 +55,11 @@ const complianceReportFragment = graphql`
     reportDate
     validUntil
     reportName
-    fileUrl
-    fileSize
+    file {
+          fileName
+          mimeType
+          size
+    }
   }
 `;
 
@@ -208,7 +211,7 @@ function ReportRow(props: ReportRowProps) {
       <Td>{report.reportName}</Td>
       <Td>{formatDate(report.reportDate)}</Td>
       <Td>{formatDate(report.validUntil)}</Td>
-      <Td>{fileSize(__, report.fileSize)}</Td>
+      <Td>{fileSize(__, report.file?.size)}</Td>
       {!props.isSnapshotMode && (
         <Td width={50} className="text-end">
           <ActionDropdown>
diff --git a/apps/console/src/pages/organizations/vendors/tabs/__generated__/ComplianceReportListQuery.graphql.ts b/apps/console/src/pages/organizations/vendors/tabs/__generated__/ComplianceReportListQuery.graphql.ts
index 58eba5b49..ac17527d5 100644
--- a/apps/console/src/pages/organizations/vendors/tabs/__generated__/ComplianceReportListQuery.graphql.ts
+++ b/apps/console/src/pages/organizations/vendors/tabs/__generated__/ComplianceReportListQuery.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<10fdd09e95fc5f2995b91c73cf9fb945>>
+ * @generated SignedSource<<5fd3a3293bd92112440eef3fd292fdc1>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -236,15 +236,34 @@ return {
                           {
                             "alias": null,
                             "args": null,
-                            "kind": "ScalarField",
-                            "name": "fileUrl",
-                            "storageKey": null
-                          },
-                          {
-                            "alias": null,
-                            "args": null,
-                            "kind": "ScalarField",
-                            "name": "fileSize",
+                            "concreteType": "File",
+                            "kind": "LinkedField",
+                            "name": "file",
+                            "plural": false,
+                            "selections": [
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "fileName",
+                                "storageKey": null
+                              },
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "mimeType",
+                                "storageKey": null
+                              },
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "size",
+                                "storageKey": null
+                              },
+                              (v12/*: any*/)
+                            ],
                             "storageKey": null
                           },
                           (v11/*: any*/)
@@ -336,12 +355,12 @@ return {
     ]
   },
   "params": {
-    "cacheID": "c819e002dfe9f20004fb5bfb4f95b143",
+    "cacheID": "594e7edf24b110430566c9a21d1b5d29",
     "id": null,
     "metadata": {},
     "name": "ComplianceReportListQuery",
     "operationKind": "query",
-    "text": "query ComplianceReportListQuery(\n  $after: CursorKey = null\n  $before: CursorKey = null\n  $first: Int = 50\n  $last: Int = null\n  $order: VendorComplianceReportOrder = null\n  $id: ID!\n) {\n  node(id: $id) {\n    __typename\n    ...VendorComplianceTabFragment_16fISc\n    id\n  }\n}\n\nfragment VendorComplianceTabFragment_16fISc on Vendor {\n  complianceReports(first: $first, after: $after, last: $last, before: $before, orderBy: $order) {\n    edges {\n      node {\n        id\n        ...VendorComplianceTabFragment_report\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment VendorComplianceTabFragment_report on VendorComplianceReport {\n  id\n  reportDate\n  validUntil\n  reportName\n  fileUrl\n  fileSize\n}\n"
+    "text": "query ComplianceReportListQuery(\n  $after: CursorKey = null\n  $before: CursorKey = null\n  $first: Int = 50\n  $last: Int = null\n  $order: VendorComplianceReportOrder = null\n  $id: ID!\n) {\n  node(id: $id) {\n    __typename\n    ...VendorComplianceTabFragment_16fISc\n    id\n  }\n}\n\nfragment VendorComplianceTabFragment_16fISc on Vendor {\n  complianceReports(first: $first, after: $after, last: $last, before: $before, orderBy: $order) {\n    edges {\n      node {\n        id\n        ...VendorComplianceTabFragment_report\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment VendorComplianceTabFragment_report on VendorComplianceReport {\n  id\n  reportDate\n  validUntil\n  reportName\n  file {\n    fileName\n    mimeType\n    size\n    id\n  }\n}\n"
   }
 };
 })();
diff --git a/apps/console/src/pages/organizations/vendors/tabs/__generated__/VendorComplianceTabFragment_report.graphql.ts b/apps/console/src/pages/organizations/vendors/tabs/__generated__/VendorComplianceTabFragment_report.graphql.ts
index 4a4fa9831..18001decf 100644
--- a/apps/console/src/pages/organizations/vendors/tabs/__generated__/VendorComplianceTabFragment_report.graphql.ts
+++ b/apps/console/src/pages/organizations/vendors/tabs/__generated__/VendorComplianceTabFragment_report.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<4c861a832ad2f79bd9d6ddcc364f6898>>
+ * @generated SignedSource<<8cf7478142bb658e6c8d189652bbdfea>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -11,8 +11,11 @@
 import { ReaderFragment } from 'relay-runtime';
 import { FragmentRefs } from "relay-runtime";
 export type VendorComplianceTabFragment_report$data = {
-  readonly fileSize: any;
-  readonly fileUrl: string;
+  readonly file: {
+    readonly fileName: string;
+    readonly mimeType: string;
+    readonly size: any;
+  } | null | undefined;
   readonly id: string;
   readonly reportDate: any;
   readonly reportName: string;
@@ -61,15 +64,33 @@ const node: ReaderFragment = {
     {
       "alias": null,
       "args": null,
-      "kind": "ScalarField",
-      "name": "fileUrl",
-      "storageKey": null
-    },
-    {
-      "alias": null,
-      "args": null,
-      "kind": "ScalarField",
-      "name": "fileSize",
+      "concreteType": "File",
+      "kind": "LinkedField",
+      "name": "file",
+      "plural": false,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "fileName",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "mimeType",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "size",
+          "storageKey": null
+        }
+      ],
       "storageKey": null
     }
   ],
@@ -77,6 +98,6 @@ const node: ReaderFragment = {
   "abstractKey": null
 };
 
-(node as any).hash = "92ad78c9e4b4add9b1f622485d81a6ff";
+(node as any).hash = "18f52de61577c8b1c61784d2404c24ae";
 
 export default node;
diff --git a/apps/console/src/pages/organizations/vendors/tabs/__generated__/VendorComplianceTabUploadReportMutation.graphql.ts b/apps/console/src/pages/organizations/vendors/tabs/__generated__/VendorComplianceTabUploadReportMutation.graphql.ts
index b23b32ae5..0973e10e8 100644
--- a/apps/console/src/pages/organizations/vendors/tabs/__generated__/VendorComplianceTabUploadReportMutation.graphql.ts
+++ b/apps/console/src/pages/organizations/vendors/tabs/__generated__/VendorComplianceTabUploadReportMutation.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<6093b0bc54fa90962376639ec87fa149>>
+ * @generated SignedSource<<68f2a5a67287a554c3f45ddfc856b6ea>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -172,15 +172,34 @@ return {
                   {
                     "alias": null,
                     "args": null,
-                    "kind": "ScalarField",
-                    "name": "fileUrl",
-                    "storageKey": null
-                  },
-                  {
-                    "alias": null,
-                    "args": null,
-                    "kind": "ScalarField",
-                    "name": "fileSize",
+                    "concreteType": "File",
+                    "kind": "LinkedField",
+                    "name": "file",
+                    "plural": false,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "fileName",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "mimeType",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "size",
+                        "storageKey": null
+                      },
+                      (v3/*: any*/)
+                    ],
                     "storageKey": null
                   }
                 ],
@@ -211,12 +230,12 @@ return {
     ]
   },
   "params": {
-    "cacheID": "fb9be687deba8567502e207b0969b2b5",
+    "cacheID": "193fdb014a3493e0b0d56a96309afae3",
     "id": null,
     "metadata": {},
     "name": "VendorComplianceTabUploadReportMutation",
     "operationKind": "mutation",
-    "text": "mutation VendorComplianceTabUploadReportMutation(\n  $input: UploadVendorComplianceReportInput!\n) {\n  uploadVendorComplianceReport(input: $input) {\n    vendorComplianceReportEdge {\n      node {\n        id\n        ...VendorComplianceTabFragment_report\n      }\n    }\n  }\n}\n\nfragment VendorComplianceTabFragment_report on VendorComplianceReport {\n  id\n  reportDate\n  validUntil\n  reportName\n  fileUrl\n  fileSize\n}\n"
+    "text": "mutation VendorComplianceTabUploadReportMutation(\n  $input: UploadVendorComplianceReportInput!\n) {\n  uploadVendorComplianceReport(input: $input) {\n    vendorComplianceReportEdge {\n      node {\n        id\n        ...VendorComplianceTabFragment_report\n      }\n    }\n  }\n}\n\nfragment VendorComplianceTabFragment_report on VendorComplianceReport {\n  id\n  reportDate\n  validUntil\n  reportName\n  file {\n    fileName\n    mimeType\n    size\n    id\n  }\n}\n"
   }
 };
 })();
diff --git a/pkg/coredata/evidence.go b/pkg/coredata/evidence.go
index 792112702..842a02799 100644
--- a/pkg/coredata/evidence.go
+++ b/pkg/coredata/evidence.go
@@ -28,20 +28,17 @@ import (
 
 type (
 	Evidence struct {
-		ID          gid.GID       `db:"id"`
-		MeasureID   gid.GID       `db:"measure_id"`
-		TaskID      *gid.GID      `db:"task_id"`
-		State       EvidenceState `db:"state"`
-		ReferenceID string        `db:"reference_id"`
-		Type        EvidenceType  `db:"type"`
-		ObjectKey   string        `db:"object_key"`
-		MimeType    string        `db:"mime_type"`
-		Size        uint64        `db:"size"`
-		Filename    string        `db:"filename"`
-		URL         string        `db:"url"`
-		Description string        `db:"description"`
-		CreatedAt   time.Time     `db:"created_at"`
-		UpdatedAt   time.Time     `db:"updated_at"`
+		ID             gid.GID       `db:"id"`
+		MeasureID      gid.GID       `db:"measure_id"`
+		TaskID         *gid.GID      `db:"task_id"`
+		State          EvidenceState `db:"state"`
+		ReferenceID    string        `db:"reference_id"`
+		Type           EvidenceType  `db:"type"`
+		URL            string        `db:"url"`
+		EvidenceFileId *gid.GID      `db:"evidence_file_id"`
+		Description    string        `db:"description"`
+		CreatedAt      time.Time     `db:"created_at"`
+		UpdatedAt      time.Time     `db:"updated_at"`
 	}
 
 	Evidences []*Evidence
@@ -69,13 +66,10 @@ INSERT INTO
         measure_id,
         task_id,
         reference_id,
-        object_key,
-        mime_type,
-        size,
         state,
         type,
-        filename,
         url,
+        evidence_file_id,
         description,
         created_at,
         updated_at
@@ -86,13 +80,10 @@ VALUES (
     @measure_id,
     @task_id,
     @reference_id,
-    @object_key,
-    @mime_type,
-    @size,
     @state,
     @type,
-    @filename,
     @url,
+    @evidence_file_id,
     @description,
     @created_at,
     @updated_at
@@ -105,21 +96,18 @@ WHERE evidences.state = 'REQUESTED';
 `
 
 	args := pgx.StrictNamedArgs{
-		"tenant_id":    scope.GetTenantID(),
-		"evidence_id":  e.ID,
-		"measure_id":   e.MeasureID,
-		"task_id":      e.TaskID,
-		"reference_id": e.ReferenceID,
-		"object_key":   e.ObjectKey,
-		"mime_type":    e.MimeType,
-		"size":         e.Size,
-		"filename":     e.Filename,
-		"created_at":   e.CreatedAt,
-		"updated_at":   e.UpdatedAt,
-		"state":        e.State,
-		"type":         e.Type,
-		"url":          e.URL,
-		"description":  e.Description,
+		"tenant_id":        scope.GetTenantID(),
+		"evidence_id":      e.ID,
+		"measure_id":       e.MeasureID,
+		"task_id":          e.TaskID,
+		"reference_id":     e.ReferenceID,
+		"evidence_file_id": e.EvidenceFileId,
+		"created_at":       e.CreatedAt,
+		"updated_at":       e.UpdatedAt,
+		"state":            e.State,
+		"type":             e.Type,
+		"url":              e.URL,
+		"description":      e.Description,
 	}
 	_, err := conn.Exec(ctx, q, args)
 	return err
@@ -138,13 +126,10 @@ INSERT INTO
         measure_id,
         task_id,
         reference_id,
-        object_key,
-        mime_type,
-        size,
         state,
         type,
-        filename,
         url,
+        evidence_file_id,
         description,
         created_at,
         updated_at
@@ -155,13 +140,10 @@ VALUES (
     @measure_id,
     @task_id,
     @reference_id,
-    @object_key,
-    @mime_type,
-    @size,
     @state,
     @type,
-    @filename,
     @url,
+    @evidence_file_id,
     @description,
     @created_at,
     @updated_at
@@ -169,21 +151,18 @@ VALUES (
 `
 
 	args := pgx.StrictNamedArgs{
-		"tenant_id":    scope.GetTenantID(),
-		"evidence_id":  e.ID,
-		"measure_id":   e.MeasureID,
-		"task_id":      e.TaskID,
-		"reference_id": e.ReferenceID,
-		"object_key":   e.ObjectKey,
-		"mime_type":    e.MimeType,
-		"size":         e.Size,
-		"filename":     e.Filename,
-		"created_at":   e.CreatedAt,
-		"updated_at":   e.UpdatedAt,
-		"state":        e.State,
-		"type":         e.Type,
-		"url":          e.URL,
-		"description":  e.Description,
+		"tenant_id":        scope.GetTenantID(),
+		"evidence_id":      e.ID,
+		"measure_id":       e.MeasureID,
+		"task_id":          e.TaskID,
+		"reference_id":     e.ReferenceID,
+		"evidence_file_id": e.EvidenceFileId,
+		"created_at":       e.CreatedAt,
+		"updated_at":       e.UpdatedAt,
+		"state":            e.State,
+		"type":             e.Type,
+		"url":              e.URL,
+		"description":      e.Description,
 	}
 	_, err := conn.Exec(ctx, q, args)
 	return err
@@ -203,11 +182,8 @@ SELECT
     reference_id,
     state,
     type,
-    object_key,
-    mime_type,
-    size,
-    filename,
     url,
+    evidence_file_id,
     description,
     created_at,
     updated_at
@@ -286,11 +262,8 @@ SELECT
 	reference_id,
 	state,
 	type,
-	object_key,
-	mime_type,
-	size,
-	filename,
 	url,
+	evidence_file_id,
 	description,
 	created_at,
 	updated_at
@@ -370,11 +343,8 @@ SELECT
     reference_id,
     state,
     type,
-    object_key,
-    mime_type,
-    size,
-    filename,
     url,
+    evidence_file_id,
     description,
     created_at,
     updated_at
@@ -418,10 +388,7 @@ UPDATE
 SET
 	type = @type,
 	state = @state,
-	object_key = @object_key,
-	mime_type = @mime_type,
-	size = @size,
-	filename = @filename,
+	evidence_file_id = @evidence_file_id,
 	url = @url,
 	description = @description,
 	updated_at = @updated_at
@@ -433,16 +400,13 @@ WHERE
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
 	args := pgx.StrictNamedArgs{
-		"evidence_id": e.ID,
-		"type":        e.Type,
-		"state":       e.State,
-		"object_key":  e.ObjectKey,
-		"mime_type":   e.MimeType,
-		"size":        e.Size,
-		"filename":    e.Filename,
-		"url":         e.URL,
-		"description": e.Description,
-		"updated_at":  e.UpdatedAt,
+		"evidence_id":      e.ID,
+		"type":             e.Type,
+		"state":            e.State,
+		"evidence_file_id": e.EvidenceFileId,
+		"url":              e.URL,
+		"description":      e.Description,
+		"updated_at":       e.UpdatedAt,
 	}
 	maps.Copy(args, scope.SQLArguments())
 
@@ -454,13 +418,14 @@ func (e Evidence) Delete(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
-) error {
+) (*string, error) {
 	q := `
 DELETE FROM
     evidences
 WHERE
-	%s
+    %s
     AND id = @evidence_id
+RETURNING evidence_file_id;
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
@@ -468,6 +433,23 @@ WHERE
 	args := pgx.StrictNamedArgs{"evidence_id": e.ID}
 	maps.Copy(args, scope.SQLArguments())
 
-	_, err := conn.Exec(ctx, q, args)
-	return err
+	var evidenceFileId *gid.GID
+	err := conn.QueryRow(ctx, q, args).Scan(&evidenceFileId)
+
+	if err != nil {
+		return nil, fmt.Errorf("failed to delete evidence: %w", err)
+	}
+
+	if evidenceFileId != nil {
+		var err error
+		var fileKey *string
+		file := &File{ID: *evidenceFileId}
+		if fileKey, err = file.HardDelete(ctx, conn, scope); err != nil {
+			return nil, fmt.Errorf("failed to hard delete evidence file: %w", err)
+		}
+		return fileKey, nil
+
+	}
+
+	return nil, err
 }
diff --git a/pkg/coredata/file.go b/pkg/coredata/file.go
index b9378f1a3..2836a99bc 100644
--- a/pkg/coredata/file.go
+++ b/pkg/coredata/file.go
@@ -135,3 +135,39 @@ VALUES (
 	_, err := conn.Exec(ctx, q, args)
 	return err
 }
+
+func (f File) SoftDelete(ctx context.Context, conn pg.Conn, scope Scoper) error {
+	q := `
+UPDATE files
+SET deleted_at = NOW()
+WHERE %s
+    AND id = @file_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"file_id": f.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+
+	return err
+}
+
+func (f File) HardDelete(ctx context.Context, conn pg.Conn, scope Scoper) (*string, error) {
+	q := `
+DELETE FROM files
+WHERE %s
+    AND id = @file_id
+RETURNING file_key
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+	args := pgx.StrictNamedArgs{"file_id": f.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	var vcrFileKey *string
+	err := conn.QueryRow(ctx, q, args).Scan(&vcrFileKey)
+
+	return vcrFileKey, err
+}
diff --git a/pkg/coredata/migrations/20251003T132724Z.sql b/pkg/coredata/migrations/20251003T132724Z.sql
new file mode 100644
index 000000000..a34fb7a34
--- /dev/null
+++ b/pkg/coredata/migrations/20251003T132724Z.sql
@@ -0,0 +1,41 @@
+ALTER TABLE evidences
+    ADD COLUMN evidence_file_id text;
+
+/* 10 is for FileEntityType */
+WITH
+    evidence_files AS (
+        SELECT
+            e.id as evidence_id,
+            generate_gid(decode_base64_unpadded(e.tenant_id), 25) as file_id,
+            e.tenant_id,
+            'probod' as bucket_name,
+            e.mime_type,
+            e.filename,
+            e.object_key,
+            e.size,
+            e.created_at,
+            e.updated_at
+        FROM evidences e
+    ),
+    inserted_files AS (
+        INSERT INTO files (id, tenant_id, bucket_name, mime_type, file_name, file_key, file_size, created_at, updated_at)
+            SELECT file_id, tenant_id, bucket_name, mime_type, filename, object_key::uuid, size, created_at, updated_at
+            FROM evidence_files
+            RETURNING id, tenant_id
+    )
+
+SELECT ef.evidence_id, ef.file_id
+INTO TEMP TABLE file_evidence_mapping
+FROM evidence_files ef;
+
+UPDATE evidences
+SET evidence_file_id = fm.file_id
+FROM file_evidence_mapping fm
+WHERE evidences.id = fm.evidence_id;
+
+
+ALTER TABLE evidences
+    ALTER COLUMN filename DROP NOT NULL,
+    ALTER COLUMN mime_type DROP NOT NULL,
+    ALTER COLUMN size DROP NOT NULL,
+    ALTER COLUMN oject_key DROP NOT NULL;
diff --git a/pkg/coredata/migrations/20251003T151644Z.sql b/pkg/coredata/migrations/20251003T151644Z.sql
new file mode 100644
index 000000000..047a4d10c
--- /dev/null
+++ b/pkg/coredata/migrations/20251003T151644Z.sql
@@ -0,0 +1,41 @@
+ALTER TABLE
+    vendor_compliance_reports
+    ADD COLUMN report_file_id text
+    REFERENCES files(id)
+    ON UPDATE CASCADE
+    ON DELETE RESTRICT;
+
+WITH
+    /* 25 is for FileEntityType */
+    vcr_files AS (
+        SELECT
+            vcr.id as report_id,
+            generate_gid(decode_base64_unpadded(vcr.tenant_id), 25) as file_id,
+            vcr.tenant_id,
+            'probod' as bucket_name,
+            'application/pdf' as mime_type,
+            vcr.report_name,
+            vcr.file_key,
+            vcr.file_size,
+            vcr.created_at,
+            vcr.updated_at
+        FROM vendor_compliance_reports vcr
+    ),
+    inserted_files AS (
+        INSERT INTO files (id, tenant_id, bucket_name, mime_type, file_name, file_key, file_size, created_at, updated_at)
+            SELECT file_id, tenant_id, bucket_name, mime_type, report_name, file_key::uuid, file_size, created_at, updated_at
+            FROM vcr_files
+            RETURNING id, tenant_id
+    )
+SELECT vf.report_id, vf.file_id
+INTO TEMP TABLE file_vcr_mapping
+FROM vcr_files vf;
+
+UPDATE vendor_compliance_reports
+SET report_file_id = fv.file_id
+FROM file_vcr_mapping fv
+WHERE vendor_compliance_reports.id = fv.report_id;
+
+ALTER TABLE vendor_compliance_reports
+    ALTER COLUMN file_key DROP NOT NULL,
+    ALTER COLUMN file_size DROP NOT NULL;
diff --git a/pkg/coredata/migrations/20251006T133729Z.sql b/pkg/coredata/migrations/20251006T133729Z.sql
new file mode 100644
index 000000000..47e5ee0f1
--- /dev/null
+++ b/pkg/coredata/migrations/20251006T133729Z.sql
@@ -0,0 +1,7 @@
+ALTER TABLE
+    evidences
+    ADD CONSTRAINT fk_evidence_file
+    FOREIGN KEY (evidence_file_id)
+    REFERENCES files(id)
+    ON UPDATE CASCADE
+    ON DELETE RESTRICT;
diff --git a/pkg/coredata/vendor_compliance_report.go b/pkg/coredata/vendor_compliance_report.go
index 4b8f28561..87dfc7ff6 100644
--- a/pkg/coredata/vendor_compliance_report.go
+++ b/pkg/coredata/vendor_compliance_report.go
@@ -28,17 +28,16 @@ import (
 
 type (
 	VendorComplianceReport struct {
-		ID         gid.GID
-		VendorID   gid.GID
-		ReportDate time.Time
-		ValidUntil *time.Time
-		ReportName string
-		FileKey    string
-		FileSize   int64
-		SnapshotID *gid.GID
-		SourceID   *gid.GID
-		CreatedAt  time.Time
-		UpdatedAt  time.Time
+		ID           gid.GID
+		VendorID     gid.GID
+		ReportDate   time.Time
+		ValidUntil   *time.Time
+		ReportName   string
+		ReportFileId *gid.GID
+		SnapshotID   *gid.GID
+		SourceID     *gid.GID
+		CreatedAt    time.Time
+		UpdatedAt    time.Time
 	}
 
 	VendorComplianceReports []*VendorComplianceReport
@@ -69,8 +68,7 @@ SELECT
 	report_date,
 	valid_until,
 	report_name,
-	file_key,
-	file_size,
+	report_file_id,
 	snapshot_id,
 	source_id,
 	created_at,
@@ -117,8 +115,7 @@ SELECT
 	report_date,
 	valid_until,
 	report_name,
-	file_key,
-	file_size,
+	report_file_id,
 	snapshot_id,
 	source_id,
 	created_at,
@@ -165,8 +162,7 @@ INSERT INTO
 		report_date,
 		valid_until,
 		report_name,
-		file_key,
-		file_size,
+		report_file_id,
 		created_at,
 		updated_at
 	)
@@ -177,23 +173,21 @@ VALUES (
 	@report_date,
 	@valid_until,
 	@report_name,
-	@file_key,
-	@file_size,
+	@report_file_id,
 	@created_at,
 	@updated_at
 )
 `
 	args := pgx.NamedArgs{
-		"id":          vcr.ID,
-		"tenant_id":   scope.GetTenantID(),
-		"vendor_id":   vcr.VendorID,
-		"report_date": vcr.ReportDate,
-		"valid_until": vcr.ValidUntil,
-		"report_name": vcr.ReportName,
-		"file_key":    vcr.FileKey,
-		"file_size":   vcr.FileSize,
-		"created_at":  vcr.CreatedAt,
-		"updated_at":  vcr.UpdatedAt,
+		"id":             vcr.ID,
+		"tenant_id":      scope.GetTenantID(),
+		"vendor_id":      vcr.VendorID,
+		"report_date":    vcr.ReportDate,
+		"valid_until":    vcr.ValidUntil,
+		"report_name":    vcr.ReportName,
+		"report_file_id": vcr.ReportFileId,
+		"created_at":     vcr.CreatedAt,
+		"updated_at":     vcr.UpdatedAt,
 	}
 
 	_, err := conn.Exec(ctx, q, args)
@@ -213,6 +207,7 @@ WHERE
 	%s
 	AND id = @id
 	AND snapshot_id IS NULL
+RETURNING report_file_id
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
@@ -220,8 +215,20 @@ WHERE
 	args := pgx.StrictNamedArgs{"id": vcr.ID}
 	maps.Copy(args, scope.SQLArguments())
 
-	_, err := conn.Exec(ctx, q, args)
-	return err
+	var vcrFileId *gid.GID
+	err := conn.QueryRow(ctx, q, args).Scan(&vcrFileId)
+
+	if err != nil {
+		return fmt.Errorf("failed to delete vendor compliance report: %w", err)
+	}
+
+	if vcrFileId != nil {
+		file := &File{ID: *vcrFileId}
+		if err = file.SoftDelete(ctx, conn, scope); err != nil {
+			return fmt.Errorf("failed to soft delete vendor compliance file: %w", err)
+		}
+	}
+	return nil
 }
 
 func (vcrs VendorComplianceReports) InsertVendorSnapshots(
@@ -247,8 +254,7 @@ INSERT INTO vendor_compliance_reports (
 	report_date,
 	valid_until,
 	report_name,
-	file_key,
-	file_size,
+	report_file_id,
 	created_at,
 	updated_at
 )
@@ -261,8 +267,7 @@ SELECT
 	vcr.report_date,
 	vcr.valid_until,
 	vcr.report_name,
-	vcr.file_key,
-	vcr.file_size,
+	vcr.report_file_id,
 	vcr.created_at,
 	vcr.updated_at
 FROM vendor_compliance_reports vcr
diff --git a/pkg/filevalidation/validator.go b/pkg/filevalidation/validator.go
index de2e8b28b..478628c61 100644
--- a/pkg/filevalidation/validator.go
+++ b/pkg/filevalidation/validator.go
@@ -65,6 +65,7 @@ var FileTypes = []FileType{
 	{MimeType: "text/plain", Extensions: []string{".txt"}, Category: CategoryText},
 	{MimeType: "text/x-log", Extensions: []string{".log"}, Category: CategoryText},
 	{MimeType: "text/uri-list", Extensions: []string{".uri"}, Category: CategoryText},
+	{MimeType: "text/uri-list; charset=utf-8", Extensions: []string{".uri"}, Category: CategoryText},
 
 	// Image types
 	{MimeType: "image/jpeg", Extensions: []string{".jpg", ".jpeg"}, Category: CategoryImage},
diff --git a/pkg/probo/evidence_service.go b/pkg/probo/evidence_service.go
index 70a68ee50..8cd052847 100644
--- a/pkg/probo/evidence_service.go
+++ b/pkg/probo/evidence_service.go
@@ -15,17 +15,10 @@
 package probo
 
 import (
-	"bytes"
 	"context"
 	"fmt"
-	"io"
-	"mime"
-	"net/url"
-	"path/filepath"
 	"time"
 
-	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/getprobo/probo/pkg/coredata"
 	"github.com/getprobo/probo/pkg/filevalidation"
 	"github.com/getprobo/probo/pkg/gid"
@@ -40,36 +33,10 @@ type (
 		fileValidator *filevalidation.FileValidator
 	}
 
-	File struct {
-		Content     io.Reader
-		Filename    string
-		Size        int64
-		ContentType string
-	}
-
-	RequestEvidenceRequest struct {
-		MeasureID   *gid.GID
-		TaskID      *gid.GID
-		Type        coredata.EvidenceType
-		Name        string
-		Description string
-	}
-
-	FulfilledEvidenceRequest struct {
-		EvidenceID gid.GID
-		File       io.Reader
-		URL        *string
-		Filename   *string
-	}
-
-	UploadTaskEvidenceRequest struct {
-		TaskID gid.GID
-		File   File
-	}
-
 	UploadMeasureEvidenceRequest struct {
 		MeasureID gid.GID
-		File      File
+		URL       *string
+		File      FileUpload
 	}
 )
 
@@ -82,256 +49,8 @@ func (s EvidenceService) Get(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(conn pg.Conn) error {
-			return evidence.LoadByID(ctx, conn, s.svc.scope, evidenceID)
-		},
-	)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return evidence, nil
-}
-
-func (s EvidenceService) Request(
-	ctx context.Context,
-	req RequestEvidenceRequest,
-) (*coredata.Evidence, error) {
-	evidenceID := gid.New(s.svc.scope.GetTenantID(), coredata.EvidenceEntityType)
-	now := time.Now()
-
-	evidence := &coredata.Evidence{
-		ID:          evidenceID,
-		State:       coredata.EvidenceStateRequested,
-		Type:        req.Type,
-		Filename:    req.Name,
-		Description: req.Description,
-		CreatedAt:   now,
-		UpdatedAt:   now,
-	}
-
-	err := s.svc.pg.WithTx(
-		ctx,
-		func(conn pg.Conn) error {
-			task := &coredata.Task{}
-			if req.TaskID != nil {
-				if err := task.LoadByID(ctx, conn, s.svc.scope, *req.TaskID); err != nil {
-					return fmt.Errorf("cannot load task: %w", err)
-				}
-
-				if task.MeasureID == nil {
-					return fmt.Errorf("task %q has no measure", req.TaskID)
-				}
-
-				evidence.TaskID = req.TaskID
-				evidence.MeasureID = *task.MeasureID
-			} else if req.MeasureID != nil {
-				evidence.MeasureID = *req.MeasureID
-			} else {
-				return fmt.Errorf("measure id or task id is required")
-			}
-
-			return evidence.Insert(ctx, conn, s.svc.scope)
-		},
-	)
-
-	if err != nil {
-		return nil, fmt.Errorf("cannot insert evidence: %w", err)
-	}
-
-	return evidence, nil
-}
-
-func (s EvidenceService) Fulfill(
-	ctx context.Context,
-	req FulfilledEvidenceRequest,
-) (*coredata.Evidence, error) {
-	evidence := &coredata.Evidence{}
-
-	err := s.svc.pg.WithTx(
-		ctx,
-		func(conn pg.Conn) error {
-			if err := evidence.LoadByID(ctx, conn, s.svc.scope, req.EvidenceID); err != nil {
-				return fmt.Errorf("cannot load evidence: %w", err)
-			}
-
-			measure := &coredata.Measure{}
-			if err := measure.LoadByID(ctx, conn, s.svc.scope, evidence.MeasureID); err != nil {
-				return fmt.Errorf("cannot load measure: %w", err)
-			}
-
-			evidence.State = coredata.EvidenceStateFulfilled
-
-			if req.File != nil {
-				evidence.Type = coredata.EvidenceTypeFile
-
-				var fileSize int64
-				var fileContent io.ReadSeeker
-
-				if seeker, ok := req.File.(io.Seeker); ok {
-					size, err := seeker.Seek(0, io.SeekEnd)
-					if err != nil {
-						return fmt.Errorf("cannot determine file size: %w", err)
-					}
-
-					_, err = seeker.Seek(0, io.SeekStart)
-					if err != nil {
-						return fmt.Errorf("cannot reset file position: %w", err)
-					}
-					fileSize = size
-					fileContent = req.File.(io.ReadSeeker)
-				} else {
-					buf, err := io.ReadAll(req.File)
-					if err != nil {
-						return fmt.Errorf("cannot read file: %w", err)
-					}
-					fileSize = int64(len(buf))
-					fileContent = bytes.NewReader(buf)
-				}
-
-				contentType := "application/octet-stream"
-				if req.Filename != nil {
-					evidence.Filename = *req.Filename
-					if detectedType := mime.TypeByExtension(filepath.Ext(*req.Filename)); detectedType != "" {
-						contentType = detectedType
-					}
-				}
-
-				if err := s.fileValidator.Validate(evidence.Filename, contentType, fileSize); err != nil {
-					return err
-				}
-
-				objectKey, err := uuid.NewV7()
-				if err != nil {
-					return fmt.Errorf("cannot generate object key: %w", err)
-				}
-
-				_, err = s.svc.s3.PutObject(ctx, &s3.PutObjectInput{
-					Bucket:      aws.String(s.svc.bucket),
-					Key:         aws.String(objectKey.String()),
-					Body:        fileContent,
-					ContentType: aws.String(contentType),
-					Metadata: map[string]string{
-						"type":            "evidence",
-						"evidence-id":     req.EvidenceID.String(),
-						"organization-id": measure.OrganizationID.String(),
-					},
-				})
-				if err != nil {
-					return fmt.Errorf("cannot upload file to S3: %w", err)
-				}
-
-				headOutput, err := s.svc.s3.HeadObject(ctx, &s3.HeadObjectInput{
-					Bucket: aws.String(s.svc.bucket),
-					Key:    aws.String(objectKey.String()),
-				})
-				if err != nil {
-					return fmt.Errorf("cannot get object metadata: %w", err)
-				}
-
-				evidence.ObjectKey = objectKey.String()
-				evidence.MimeType = contentType
-				evidence.Size = uint64(*headOutput.ContentLength)
-			} else if req.URL != nil {
-				evidence.Type = coredata.EvidenceTypeLink
-				evidence.URL = *req.URL
-			}
-
-			evidence.UpdatedAt = time.Now()
-
-			return evidence.Update(ctx, conn, s.svc.scope)
-		},
-	)
-
-	if err != nil {
-		return nil, fmt.Errorf("cannot update evidence: %w", err)
-	}
-
-	return evidence, nil
-}
-
-func (s EvidenceService) UploadTaskEvidence(
-	ctx context.Context,
-	req UploadTaskEvidenceRequest,
-) (*coredata.Evidence, error) {
-	now := time.Now()
-	evidenceID := gid.New(s.svc.scope.GetTenantID(), coredata.EvidenceEntityType)
-
-	referenceID, err := uuid.NewV4()
-	if err != nil {
-		return nil, fmt.Errorf("cannot generate reference id: %w", err)
-	}
-
-	evidence := &coredata.Evidence{
-		ID:          evidenceID,
-		TaskID:      &req.TaskID,
-		State:       coredata.EvidenceStateFulfilled,
-		ReferenceID: "custom-evidence-" + referenceID.String(),
-		Type:        coredata.EvidenceTypeFile,
-		Filename:    req.File.Filename,
-		CreatedAt:   now,
-		UpdatedAt:   now,
-	}
-
-	if req.File.ContentType == "" {
-		req.File.ContentType = "application/octet-stream"
-	}
-
-	if err := s.fileValidator.Validate(req.File.Filename, req.File.ContentType, req.File.Size); err != nil {
-		return nil, err
-	}
-
-	var measureOrganizationID gid.GID
-
-	err = s.svc.pg.WithTx(
-		ctx,
-		func(conn pg.Conn) error {
-			task := &coredata.Task{}
-
-			if err := task.LoadByID(ctx, conn, s.svc.scope, req.TaskID); err != nil {
-				return fmt.Errorf("cannot load task %q: %w", req.TaskID, err)
-			}
-
-			if task.MeasureID == nil {
-				return fmt.Errorf("task %q has no measure", req.TaskID)
-			}
-
-			measure := &coredata.Measure{}
-			if err := measure.LoadByID(ctx, conn, s.svc.scope, *task.MeasureID); err != nil {
-				return fmt.Errorf("cannot load measure: %w", err)
-			}
-			measureOrganizationID = measure.OrganizationID
-
-			objectKey, err := uuid.NewV7()
-			if err != nil {
-				return fmt.Errorf("cannot generate object key: %w", err)
-			}
-
-			_, err = s.svc.s3.PutObject(
-				ctx,
-				&s3.PutObjectInput{
-					Bucket:      aws.String(s.svc.bucket),
-					Key:         aws.String(objectKey.String()),
-					Body:        req.File.Content,
-					ContentType: aws.String(req.File.ContentType),
-					Metadata: map[string]string{
-						"type":            "evidence",
-						"evidence-id":     evidenceID.String(),
-						"organization-id": measureOrganizationID.String(),
-					},
-				},
-			)
-			if err != nil {
-				return fmt.Errorf("cannot upload file to S3: %w", err)
-			}
-
-			evidence.ObjectKey = objectKey.String()
-			evidence.MimeType = req.File.ContentType
-			evidence.Size = uint64(req.File.Size)
-			evidence.MeasureID = *task.MeasureID
-
-			if err := evidence.Insert(ctx, conn, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot insert evidence: %w", err)
+			if err := evidence.LoadByID(ctx, conn, s.svc.scope, evidenceID); err != nil {
+				return fmt.Errorf("cannot load evidence %w", err)
 			}
 
 			return nil
@@ -339,8 +58,7 @@ func (s EvidenceService) UploadTaskEvidence(
 	)
 
 	if err != nil {
-		// TODO try do delete file from s3 if it's a file type
-		return nil, err
+		return nil, fmt.Errorf("cannot load evidence: %w", err)
 	}
 
 	return evidence, nil
@@ -364,53 +82,37 @@ func (s EvidenceService) UploadMeasureEvidence(
 		State:       coredata.EvidenceStateFulfilled,
 		ReferenceID: "custom-evidence-" + referenceID.String(),
 		Type:        coredata.EvidenceTypeFile,
-		Filename:    req.File.Filename,
 		CreatedAt:   now,
 		UpdatedAt:   now,
 	}
 
-	if req.File.ContentType == "" {
-		req.File.ContentType = "application/octet-stream"
-	}
-
-	if err := s.fileValidator.Validate(req.File.Filename, req.File.ContentType, req.File.Size); err != nil {
-		return nil, err
-	}
-
 	err = s.svc.pg.WithTx(
 		ctx,
 		func(conn pg.Conn) error {
 			measure := &coredata.Measure{}
+			var file *coredata.File
+			var err error
+
+			file, err = s.svc.Files.UploadAndSaveFile(
+				ctx,
+				s.fileValidator,
+				map[string]string{
+					"type":            "evidence",
+					"evidence-id":     evidenceID.String(),
+					"organization-id": measure.OrganizationID.String(),
+				},
+				&req.File)
+
+			if err != nil {
+				return fmt.Errorf("cannot upload or file: %w", err)
+			}
+
+			evidence.EvidenceFileId = &file.ID
+
 			if err := measure.LoadByID(ctx, conn, s.svc.scope, req.MeasureID); err != nil {
 				return fmt.Errorf("cannot load measure %q: %w", req.MeasureID, err)
 			}
 
-			objectKey, err := uuid.NewV7()
-			if err != nil {
-				return fmt.Errorf("cannot generate object key: %w", err)
-			}
-
-			_, err = s.svc.s3.PutObject(
-				ctx,
-				&s3.PutObjectInput{
-					Bucket:      aws.String(s.svc.bucket),
-					Key:         aws.String(objectKey.String()),
-					Body:        req.File.Content,
-					ContentType: aws.String(req.File.ContentType),
-					Metadata: map[string]string{
-						"type":            "evidence",
-						"evidence-id":     evidenceID.String(),
-						"organization-id": measure.OrganizationID.String(),
-					},
-				},
-			)
-			if err != nil {
-				return fmt.Errorf("cannot upload file to S3: %w", err)
-			}
-
-			evidence.ObjectKey = objectKey.String()
-			evidence.MimeType = req.File.ContentType
-			evidence.Size = uint64(req.File.Size)
 			evidence.MeasureID = req.MeasureID
 
 			if err := evidence.Insert(ctx, conn, s.svc.scope); err != nil {
@@ -429,43 +131,6 @@ func (s EvidenceService) UploadMeasureEvidence(
 	return evidence, nil
 }
 
-func (s EvidenceService) GenerateFileURL(
-	ctx context.Context,
-	evidenceID gid.GID,
-	expiresIn time.Duration,
-) (*string, error) {
-	evidence, err := s.Get(ctx, evidenceID)
-	if err != nil {
-		return nil, fmt.Errorf("cannot get evidence: %w", err)
-	}
-
-	if evidence.Type == coredata.EvidenceTypeLink {
-		return nil, fmt.Errorf("cannot generate file URL for link type evidence")
-	}
-
-	presignClient := s3.NewPresignClient(s.svc.s3)
-
-	// Use RFC 6266/5987 encoding for filename with UTF-8 support
-	encodedFilename := url.QueryEscape(evidence.Filename)
-	contentDisposition := fmt.Sprintf("attachment; filename=\"%s\"; filename*=UTF-8''%s",
-		encodedFilename, encodedFilename)
-
-	presignedReq, err := presignClient.PresignGetObject(ctx, &s3.GetObjectInput{
-		Bucket:                     aws.String(s.svc.bucket),
-		Key:                        aws.String(evidence.ObjectKey),
-		ResponseCacheControl:       aws.String("max-age=3600, public"),
-		ResponseContentType:        aws.String(evidence.MimeType),
-		ResponseContentDisposition: aws.String(contentDisposition),
-	}, func(opts *s3.PresignOptions) {
-		opts.Expires = expiresIn
-	})
-	if err != nil {
-		return nil, fmt.Errorf("cannot presign GetObject request: %w", err)
-	}
-
-	return &presignedReq.URL, nil
-}
-
 func (s EvidenceService) CountForMeasureID(
 	ctx context.Context,
 	measureID gid.GID,
@@ -581,9 +246,15 @@ func (s *EvidenceService) Delete(
 	return s.svc.pg.WithTx(
 		ctx,
 		func(conn pg.Conn) error {
-			if err := evidence.Delete(ctx, conn, s.svc.scope); err != nil {
+			var fileKey *string
+			var err error
+
+			if fileKey, err = evidence.Delete(ctx, conn, s.svc.scope); err != nil {
 				return fmt.Errorf("cannot delete evidence: %w", err)
 			}
+			if err = s.svc.Files.DeleteFileFromS3(ctx, *fileKey); err != nil {
+				return err
+			}
 
 			return nil
 		},
diff --git a/pkg/probo/file_service.go b/pkg/probo/file_service.go
new file mode 100644
index 000000000..04651159c
--- /dev/null
+++ b/pkg/probo/file_service.go
@@ -0,0 +1,187 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package probo
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/filevalidation"
+	"github.com/getprobo/probo/pkg/gid"
+	"go.gearno.de/crypto/uuid"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	FileService struct {
+		svc *TenantService
+	}
+
+	File struct {
+		Content     io.Reader
+		Filename    string
+		Size        int64
+		ContentType string
+	}
+
+	FileUpload struct {
+		Content     io.Reader
+		Filename    string
+		Size        int64
+		ContentType string
+	}
+)
+
+func (s FileService) Get(
+	ctx context.Context,
+	fileID gid.GID,
+) (*coredata.File, error) {
+	file := &coredata.File{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := file.LoadByID(ctx, conn, s.svc.scope, fileID); err != nil {
+				return fmt.Errorf("cannot load file %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, fmt.Errorf("cannot load file: %w", err)
+	}
+
+	return file, nil
+}
+
+func (s FileService) UploadAndSaveFile(
+	ctx context.Context,
+	fileValidator *filevalidation.FileValidator,
+	s3Metadata map[string]string,
+	req *FileUpload) (*coredata.File, error) {
+	objectKey, err := uuid.NewV7()
+	if err != nil {
+		return nil, fmt.Errorf("cannot generate object key: %w", err)
+	}
+
+	mimeType := req.ContentType
+	if mimeType == "" {
+		mimeType = "application/octet-stream"
+	}
+
+	if err := fileValidator.Validate(req.Filename, mimeType, req.Size); err != nil {
+		return nil, fmt.Errorf("cannot validate file: %w", err)
+	}
+
+	_, err = s.svc.s3.PutObject(ctx, &s3.PutObjectInput{
+		Bucket:      &s.svc.bucket,
+		Key:         aws.String(objectKey.String()),
+		Body:        req.Content,
+		Metadata:    s3Metadata,
+		ContentType: aws.String(mimeType),
+	})
+	if err != nil {
+		return nil, fmt.Errorf("cannot upload file to S3: %w", err)
+	}
+
+	headOutput, err := s.svc.s3.HeadObject(ctx, &s3.HeadObjectInput{
+		Bucket: aws.String(s.svc.bucket),
+		Key:    aws.String(objectKey.String()),
+	})
+	if err != nil {
+		return nil, fmt.Errorf("cannot get object metadata: %w", err)
+	}
+
+	now := time.Now()
+
+	fileID := gid.New(s.svc.scope.GetTenantID(), coredata.FileEntityType)
+	var file *coredata.File
+
+	err = s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+
+			file = &coredata.File{
+				ID:         fileID,
+				BucketName: s.svc.bucket,
+				MimeType:   mimeType,
+				FileName:   req.Filename,
+				FileKey:    objectKey.String(),
+				FileSize:   *headOutput.ContentLength,
+				CreatedAt:  now,
+				UpdatedAt:  now,
+			}
+
+			if err := file.Insert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert file: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return file, nil
+}
+
+func (s FileService) DeleteFileFromS3(ctx context.Context, fileKey string) error {
+	_, err := s.svc.s3.DeleteObject(ctx, &s3.DeleteObjectInput{
+		Bucket: aws.String(s.svc.bucket),
+		Key:    aws.String(fileKey),
+	})
+	if err != nil {
+		return fmt.Errorf("failed to delete object from S3: %w", err)
+	}
+
+	return nil
+}
+
+func (s FileService) GenerateFileTempURL(
+	ctx context.Context,
+	fileID gid.GID,
+	expiresIn time.Duration,
+) (string, error) {
+	file, err := s.Get(ctx, fileID)
+	if err != nil {
+		return "", fmt.Errorf("cannot get file: %w", err)
+	}
+
+	presignClient := s3.NewPresignClient(s.svc.s3)
+
+	presignedReq, err := presignClient.PresignGetObject(ctx, &s3.GetObjectInput{
+		Bucket:                     aws.String(s.svc.bucket),
+		Key:                        aws.String(file.FileKey),
+		ResponseCacheControl:       aws.String("max-age=3600, public"),
+		ResponseContentType:        aws.String(file.MimeType),
+		ResponseContentDisposition: aws.String(fmt.Sprintf("attachment; filename=\"%s\"", file.FileName)),
+	}, func(opts *s3.PresignOptions) {
+		opts.Expires = expiresIn
+	})
+	if err != nil {
+		return "", fmt.Errorf("cannot presign GetObject request: %w", err)
+	}
+
+	return presignedReq.URL, nil
+}
diff --git a/pkg/probo/framework_service.go b/pkg/probo/framework_service.go
index 227d425f1..c610cccfc 100644
--- a/pkg/probo/framework_service.go
+++ b/pkg/probo/framework_service.go
@@ -223,15 +223,20 @@ func (s FrameworkService) Export(
 					for _, evidence := range evidences {
 						if evidence.Type != coredata.EvidenceTypeFile ||
 							evidence.State != coredata.EvidenceStateFulfilled ||
-							evidence.ObjectKey == "" {
+							evidence.EvidenceFileId == nil {
 							continue
 						}
 
+						evidence_file := &coredata.File{}
+						if err := evidence_file.LoadByID(ctx, conn, s.svc.scope, *evidence.EvidenceFileId); err != nil {
+							return fmt.Errorf("cannot load evidence file: %w", err)
+						}
+
 						object, err := s.svc.s3.GetObject(
 							ctx,
 							&s3.GetObjectInput{
 								Bucket: aws.String(s.svc.bucket),
-								Key:    aws.String(evidence.ObjectKey),
+								Key:    aws.String(evidence_file.FileKey),
 							},
 						)
 						if err != nil {
@@ -239,7 +244,7 @@ func (s FrameworkService) Export(
 						}
 						defer object.Body.Close()
 
-						w, err := archive.Create(fmt.Sprintf("%s/%s/%s/%s", framework.Name, control.SectionTitle, measure.Name, evidence.Filename))
+						w, err := archive.Create(fmt.Sprintf("%s/%s/%s/%s", framework.Name, control.SectionTitle, measure.Name, evidence_file.FileName))
 						if err != nil {
 							return fmt.Errorf("cannot create evidence in archive: %w", err)
 						}
diff --git a/pkg/probo/service.go b/pkg/probo/service.go
index b36482082..3558b3d2b 100644
--- a/pkg/probo/service.go
+++ b/pkg/probo/service.go
@@ -94,6 +94,7 @@ type (
 		Snapshots                         *SnapshotService
 		ContinualImprovements             *ContinualImprovementService
 		ProcessingActivities              *ProcessingActivityService
+		Files                             *FileService
 	}
 )
 
@@ -175,7 +176,7 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	}
 	tenantService.Controls = &ControlService{svc: tenantService}
 	tenantService.Risks = &RiskService{svc: tenantService}
-	tenantService.VendorComplianceReports = &VendorComplianceReportService{svc: tenantService}
+	tenantService.VendorComplianceReports = &VendorComplianceReportService{svc: tenantService, fileValidator: filevalidation.NewValidator(filevalidation.CategoryDocument)}
 	tenantService.VendorBusinessAssociateAgreements = &VendorBusinessAssociateAgreementService{svc: tenantService}
 	tenantService.VendorContacts = &VendorContactService{svc: tenantService}
 	tenantService.VendorDataPrivacyAgreements = &VendorDataPrivacyAgreementService{svc: tenantService}
@@ -193,6 +194,7 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	tenantService.Snapshots = &SnapshotService{svc: tenantService}
 	tenantService.ContinualImprovements = &ContinualImprovementService{svc: tenantService}
 	tenantService.ProcessingActivities = &ProcessingActivityService{svc: tenantService}
+	tenantService.Files = &FileService{svc: tenantService}
 	return tenantService
 }
 
diff --git a/pkg/probo/vendor_compliance_report_service.go b/pkg/probo/vendor_compliance_report_service.go
index e58c4fcbd..d775e86a8 100644
--- a/pkg/probo/vendor_compliance_report_service.go
+++ b/pkg/probo/vendor_compliance_report_service.go
@@ -17,28 +17,23 @@ package probo
 import (
 	"context"
 	"fmt"
-	"io"
-	"mime"
-	"net/url"
-	"path/filepath"
 	"time"
 
-	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/filevalidation"
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/page"
-	"go.gearno.de/crypto/uuid"
 	"go.gearno.de/kit/pg"
 )
 
 type (
 	VendorComplianceReportService struct {
-		svc *TenantService
+		svc           *TenantService
+		fileValidator *filevalidation.FileValidator
 	}
 
 	VendorComplianceReportCreateRequest struct {
-		File       io.Reader
+		File       FileUpload
 		ReportDate time.Time
 		ValidUntil *time.Time
 		ReportName string
@@ -71,61 +66,43 @@ func (s VendorComplianceReportService) Upload(
 	vendorID gid.GID,
 	req *VendorComplianceReportCreateRequest,
 ) (*coredata.VendorComplianceReport, error) {
-	objectKey, err := uuid.NewV7()
+	vendor, err := s.svc.Vendors.Get(ctx, vendorID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot generate object key: %w", err)
+		return nil, fmt.Errorf("cannot get vendor: %w", err)
 	}
 
-	var vendorComplianceReport *coredata.VendorComplianceReport
+	f, err := s.svc.Files.UploadAndSaveFile(
+		ctx,
+		s.fileValidator,
+		map[string]string{
+			"type":            "vendor-compliance-report",
+			"vendor-id":       vendorID.String(),
+			"organization-id": vendor.OrganizationID.String(),
+		},
+		&req.File)
 
-	err = s.svc.pg.WithTx(
+	if err != nil {
+		return nil, err
+	}
+
+	now := time.Now()
+
+	vendorComplianceReportID := gid.New(s.svc.scope.GetTenantID(), coredata.VendorComplianceReportEntityType)
+
+	vendorComplianceReport := &coredata.VendorComplianceReport{
+		ID:           vendorComplianceReportID,
+		VendorID:     vendorID,
+		ReportDate:   req.ReportDate,
+		ValidUntil:   req.ValidUntil,
+		ReportName:   req.ReportName,
+		ReportFileId: &f.ID,
+		CreatedAt:    now,
+		UpdatedAt:    now,
+	}
+
+	err = s.svc.pg.WithConn(
 		ctx,
 		func(conn pg.Conn) error {
-			vendor := &coredata.Vendor{}
-			if err := vendor.LoadByID(ctx, conn, s.svc.scope, vendorID); err != nil {
-				return fmt.Errorf("cannot load vendor: %w", err)
-			}
-
-			mimeType := mime.TypeByExtension(filepath.Ext(req.ReportName))
-
-			_, err := s.svc.s3.PutObject(ctx, &s3.PutObjectInput{
-				Bucket:      &s.svc.bucket,
-				Key:         aws.String(objectKey.String()),
-				Body:        req.File,
-				ContentType: &mimeType,
-				Metadata: map[string]string{
-					"type":            "vendor-compliance-report",
-					"vendor-id":       vendorID.String(),
-					"organization-id": vendor.OrganizationID.String(),
-				},
-			})
-			if err != nil {
-				return fmt.Errorf("cannot upload file to S3: %w", err)
-			}
-
-			headOutput, err := s.svc.s3.HeadObject(ctx, &s3.HeadObjectInput{
-				Bucket: aws.String(s.svc.bucket),
-				Key:    aws.String(objectKey.String()),
-			})
-			if err != nil {
-				return fmt.Errorf("cannot get object metadata: %w", err)
-			}
-
-			now := time.Now()
-			vendorComplianceReportID := gid.New(s.svc.scope.GetTenantID(), coredata.VendorComplianceReportEntityType)
-
-			vendorComplianceReport = &coredata.VendorComplianceReport{
-				ID:         vendorComplianceReportID,
-				VendorID:   vendorID,
-				ReportDate: req.ReportDate,
-				ValidUntil: req.ValidUntil,
-				ReportName: req.ReportName,
-				FileKey:    objectKey.String(),
-				FileSize:   *headOutput.ContentLength,
-				CreatedAt:  now,
-				UpdatedAt:  now,
-			}
-
 			return vendorComplianceReport.Insert(ctx, conn, s.svc.scope)
 		},
 	)
@@ -157,38 +134,6 @@ func (s VendorComplianceReportService) Get(
 	return vendorComplianceReport, nil
 }
 
-func (s VendorComplianceReportService) GenerateFileURL(
-	ctx context.Context,
-	vendorComplianceReportID gid.GID,
-	expiresIn time.Duration,
-) (string, error) {
-	vendorComplianceReport, err := s.Get(ctx, vendorComplianceReportID)
-	if err != nil {
-		return "", fmt.Errorf("cannot get vendor compliance report: %w", err)
-	}
-
-	presignClient := s3.NewPresignClient(s.svc.s3)
-
-	// Use RFC 6266/5987 encoding for filename with UTF-8 support
-	encodedFilename := url.QueryEscape(vendorComplianceReport.ReportName)
-	contentDisposition := fmt.Sprintf("attachment; filename=\"%s\"; filename*=UTF-8''%s",
-		encodedFilename, encodedFilename)
-
-	presignedReq, err := presignClient.PresignGetObject(ctx, &s3.GetObjectInput{
-		Bucket:                     aws.String(s.svc.bucket),
-		Key:                        aws.String(vendorComplianceReport.FileKey),
-		ResponseCacheControl:       aws.String("max-age=3600, public"),
-		ResponseContentDisposition: aws.String(contentDisposition),
-	}, func(opts *s3.PresignOptions) {
-		opts.Expires = expiresIn
-	})
-	if err != nil {
-		return "", fmt.Errorf("cannot presign GetObject request: %w", err)
-	}
-
-	return presignedReq.URL, nil
-}
-
 func (s VendorComplianceReportService) Delete(
 	ctx context.Context,
 	vendorComplianceReportID gid.GID,
@@ -198,7 +143,11 @@ func (s VendorComplianceReportService) Delete(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(conn pg.Conn) error {
-			return vendorComplianceReport.Delete(ctx, conn, s.svc.scope)
+			if err := vendorComplianceReport.Delete(ctx, conn, s.svc.scope); err != nil {
+				return err
+			}
+
+			return nil
 		},
 	)
 
diff --git a/pkg/server/api/console/v1/schema.graphql b/pkg/server/api/console/v1/schema.graphql
index 67e3cabfa..d81721d58 100644
--- a/pkg/server/api/console/v1/schema.graphql
+++ b/pkg/server/api/console/v1/schema.graphql
@@ -1755,8 +1755,7 @@ type VendorComplianceReport implements Node {
   reportDate: Datetime!
   validUntil: Datetime
   reportName: String!
-  fileUrl: String! @goField(forceResolver: true)
-  fileSize: BigInt!
+  file: File @goField(forceResolver: true)
   createdAt: Datetime!
   updatedAt: Datetime!
 }
@@ -1944,12 +1943,10 @@ type Task implements Node {
 
 type Evidence implements Node {
   id: ID!
-  fileUrl: String @goField(forceResolver: true)
-  mimeType: String!
   size: Int!
   state: EvidenceState!
   type: EvidenceType!
-  filename: String!
+  file: File @goField(forceResolver: true)
   url: String
   description: String!
 
@@ -2590,6 +2587,16 @@ type SnapshotEdge {
   node: Snapshot!
 }
 
+type File {
+    id: ID!
+    mimeType: String!
+    fileName: String!
+    size: BigInt!
+    downloadUrl: String! @goField(forceResolver: true)
+    createdAt: Datetime!
+    updatedAt: Datetime!
+}
+
 # Root Types
 type Query {
   node(id: ID!): Node!
@@ -2751,12 +2758,7 @@ type Mutation {
   ): DeleteRiskObligationMappingPayload!
 
   # Evidence mutations
-  requestEvidence(input: RequestEvidenceInput!): RequestEvidencePayload!
-  fulfillEvidence(input: FulfillEvidenceInput!): FulfillEvidencePayload!
   deleteEvidence(input: DeleteEvidenceInput!): DeleteEvidencePayload!
-  uploadTaskEvidence(
-    input: UploadTaskEvidenceInput!
-  ): UploadTaskEvidencePayload!
   uploadMeasureEvidence(
     input: UploadMeasureEvidenceInput!
   ): UploadMeasureEvidencePayload!
@@ -4142,19 +4144,10 @@ type CancelSignatureRequestPayload {
   deletedDocumentVersionSignatureId: ID!
 }
 
-type UploadTaskEvidencePayload {
-  evidenceEdge: EvidenceEdge!
-}
-
 type UploadMeasureEvidencePayload {
   evidenceEdge: EvidenceEdge!
 }
 
-input UploadTaskEvidenceInput {
-  taskId: ID!
-  file: Upload!
-}
-
 input UploadMeasureEvidenceInput {
   measureId: ID!
   file: Upload!
diff --git a/pkg/server/api/console/v1/schema/schema.go b/pkg/server/api/console/v1/schema/schema.go
index d967a4548..6ae248369 100644
--- a/pkg/server/api/console/v1/schema/schema.go
+++ b/pkg/server/api/console/v1/schema/schema.go
@@ -61,6 +61,7 @@ type ResolverRoot interface {
 	DocumentVersionSignature() DocumentVersionSignatureResolver
 	Evidence() EvidenceResolver
 	EvidenceConnection() EvidenceConnectionResolver
+	File() FileResolver
 	Framework() FrameworkResolver
 	FrameworkConnection() FrameworkConnectionResolver
 	Measure() MeasureResolver
@@ -639,11 +640,9 @@ type ComplexityRoot struct {
 	Evidence struct {
 		CreatedAt   func(childComplexity int) int
 		Description func(childComplexity int) int
-		FileURL     func(childComplexity int) int
-		Filename    func(childComplexity int) int
+		File        func(childComplexity int) int
 		ID          func(childComplexity int) int
 		Measure     func(childComplexity int) int
-		MimeType    func(childComplexity int) int
 		Size        func(childComplexity int) int
 		State       func(childComplexity int) int
 		Task        func(childComplexity int) int
@@ -671,6 +670,16 @@ type ComplexityRoot struct {
 		ExportJobID func(childComplexity int) int
 	}
 
+	File struct {
+		CreatedAt   func(childComplexity int) int
+		DownloadURL func(childComplexity int) int
+		FileName    func(childComplexity int) int
+		ID          func(childComplexity int) int
+		MimeType    func(childComplexity int) int
+		Size        func(childComplexity int) int
+		UpdatedAt   func(childComplexity int) int
+	}
+
 	Framework struct {
 		Controls     func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) int
 		CreatedAt    func(childComplexity int) int
@@ -817,7 +826,6 @@ type ComplexityRoot struct {
 		DeleteVendorService                    func(childComplexity int, input types.DeleteVendorServiceInput) int
 		ExportDocumentVersionPDF               func(childComplexity int, input types.ExportDocumentVersionPDFInput) int
 		ExportFramework                        func(childComplexity int, input types.ExportFrameworkInput) int
-		FulfillEvidence                        func(childComplexity int, input types.FulfillEvidenceInput) int
 		GenerateDocumentChangelog              func(childComplexity int, input types.GenerateDocumentChangelogInput) int
 		GenerateFrameworkStateOfApplicability  func(childComplexity int, input types.GenerateFrameworkStateOfApplicabilityInput) int
 		ImportFramework                        func(childComplexity int, input types.ImportFrameworkInput) int
@@ -825,7 +833,6 @@ type ComplexityRoot struct {
 		InviteUser                             func(childComplexity int, input types.InviteUserInput) int
 		PublishDocumentVersion                 func(childComplexity int, input types.PublishDocumentVersionInput) int
 		RemoveUser                             func(childComplexity int, input types.RemoveUserInput) int
-		RequestEvidence                        func(childComplexity int, input types.RequestEvidenceInput) int
 		RequestSignature                       func(childComplexity int, input types.RequestSignatureInput) int
 		SendSigningNotifications               func(childComplexity int, input types.SendSigningNotificationsInput) int
 		UnassignTask                           func(childComplexity int, input types.UnassignTaskInput) int
@@ -855,7 +862,6 @@ type ComplexityRoot struct {
 		UpdateVendorService                    func(childComplexity int, input types.UpdateVendorServiceInput) int
 		UploadAuditReport                      func(childComplexity int, input types.UploadAuditReportInput) int
 		UploadMeasureEvidence                  func(childComplexity int, input types.UploadMeasureEvidenceInput) int
-		UploadTaskEvidence                     func(childComplexity int, input types.UploadTaskEvidenceInput) int
 		UploadTrustCenterNda                   func(childComplexity int, input types.UploadTrustCenterNDAInput) int
 		UploadVendorBusinessAssociateAgreement func(childComplexity int, input types.UploadVendorBusinessAssociateAgreementInput) int
 		UploadVendorComplianceReport           func(childComplexity int, input types.UploadVendorComplianceReportInput) int
@@ -1346,10 +1352,6 @@ type ComplexityRoot struct {
 		EvidenceEdge func(childComplexity int) int
 	}
 
-	UploadTaskEvidencePayload struct {
-		EvidenceEdge func(childComplexity int) int
-	}
-
 	UploadTrustCenterNDAPayload struct {
 		TrustCenter func(childComplexity int) int
 	}
@@ -1433,8 +1435,7 @@ type ComplexityRoot struct {
 
 	VendorComplianceReport struct {
 		CreatedAt  func(childComplexity int) int
-		FileSize   func(childComplexity int) int
-		FileURL    func(childComplexity int) int
+		File       func(childComplexity int) int
 		ID         func(childComplexity int) int
 		ReportDate func(childComplexity int) int
 		ReportName func(childComplexity int) int
@@ -1614,7 +1615,7 @@ type DocumentVersionSignatureResolver interface {
 	SignedBy(ctx context.Context, obj *types.DocumentVersionSignature) (*types.People, error)
 }
 type EvidenceResolver interface {
-	FileURL(ctx context.Context, obj *types.Evidence) (*string, error)
+	File(ctx context.Context, obj *types.Evidence) (*types.File, error)
 
 	Task(ctx context.Context, obj *types.Evidence) (*types.Task, error)
 	Measure(ctx context.Context, obj *types.Evidence) (*types.Measure, error)
@@ -1622,6 +1623,9 @@ type EvidenceResolver interface {
 type EvidenceConnectionResolver interface {
 	TotalCount(ctx context.Context, obj *types.EvidenceConnection) (int, error)
 }
+type FileResolver interface {
+	DownloadURL(ctx context.Context, obj *types.File) (string, error)
+}
 type FrameworkResolver interface {
 	Organization(ctx context.Context, obj *types.Framework) (*types.Organization, error)
 	Controls(ctx context.Context, obj *types.Framework, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error)
@@ -1701,10 +1705,7 @@ type MutationResolver interface {
 	DeleteRiskDocumentMapping(ctx context.Context, input types.DeleteRiskDocumentMappingInput) (*types.DeleteRiskDocumentMappingPayload, error)
 	CreateRiskObligationMapping(ctx context.Context, input types.CreateRiskObligationMappingInput) (*types.CreateRiskObligationMappingPayload, error)
 	DeleteRiskObligationMapping(ctx context.Context, input types.DeleteRiskObligationMappingInput) (*types.DeleteRiskObligationMappingPayload, error)
-	RequestEvidence(ctx context.Context, input types.RequestEvidenceInput) (*types.RequestEvidencePayload, error)
-	FulfillEvidence(ctx context.Context, input types.FulfillEvidenceInput) (*types.FulfillEvidencePayload, error)
 	DeleteEvidence(ctx context.Context, input types.DeleteEvidenceInput) (*types.DeleteEvidencePayload, error)
-	UploadTaskEvidence(ctx context.Context, input types.UploadTaskEvidenceInput) (*types.UploadTaskEvidencePayload, error)
 	UploadMeasureEvidence(ctx context.Context, input types.UploadMeasureEvidenceInput) (*types.UploadMeasureEvidencePayload, error)
 	UploadVendorComplianceReport(ctx context.Context, input types.UploadVendorComplianceReportInput) (*types.UploadVendorComplianceReportPayload, error)
 	DeleteVendorComplianceReport(ctx context.Context, input types.DeleteVendorComplianceReportInput) (*types.DeleteVendorComplianceReportPayload, error)
@@ -1891,7 +1892,7 @@ type VendorBusinessAssociateAgreementResolver interface {
 type VendorComplianceReportResolver interface {
 	Vendor(ctx context.Context, obj *types.VendorComplianceReport) (*types.Vendor, error)
 
-	FileURL(ctx context.Context, obj *types.VendorComplianceReport) (string, error)
+	File(ctx context.Context, obj *types.VendorComplianceReport) (*types.File, error)
 }
 type VendorConnectionResolver interface {
 	TotalCount(ctx context.Context, obj *types.VendorConnection) (int, error)
@@ -3600,19 +3601,12 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 
 		return e.complexity.Evidence.Description(childComplexity), true
 
-	case "Evidence.fileUrl":
-		if e.complexity.Evidence.FileURL == nil {
+	case "Evidence.file":
+		if e.complexity.Evidence.File == nil {
 			break
 		}
 
-		return e.complexity.Evidence.FileURL(childComplexity), true
-
-	case "Evidence.filename":
-		if e.complexity.Evidence.Filename == nil {
-			break
-		}
-
-		return e.complexity.Evidence.Filename(childComplexity), true
+		return e.complexity.Evidence.File(childComplexity), true
 
 	case "Evidence.id":
 		if e.complexity.Evidence.ID == nil {
@@ -3628,13 +3622,6 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 
 		return e.complexity.Evidence.Measure(childComplexity), true
 
-	case "Evidence.mimeType":
-		if e.complexity.Evidence.MimeType == nil {
-			break
-		}
-
-		return e.complexity.Evidence.MimeType(childComplexity), true
-
 	case "Evidence.size":
 		if e.complexity.Evidence.Size == nil {
 			break
@@ -3726,6 +3713,55 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 
 		return e.complexity.ExportFrameworkPayload.ExportJobID(childComplexity), true
 
+	case "File.createdAt":
+		if e.complexity.File.CreatedAt == nil {
+			break
+		}
+
+		return e.complexity.File.CreatedAt(childComplexity), true
+
+	case "File.downloadUrl":
+		if e.complexity.File.DownloadURL == nil {
+			break
+		}
+
+		return e.complexity.File.DownloadURL(childComplexity), true
+
+	case "File.fileName":
+		if e.complexity.File.FileName == nil {
+			break
+		}
+
+		return e.complexity.File.FileName(childComplexity), true
+
+	case "File.id":
+		if e.complexity.File.ID == nil {
+			break
+		}
+
+		return e.complexity.File.ID(childComplexity), true
+
+	case "File.mimeType":
+		if e.complexity.File.MimeType == nil {
+			break
+		}
+
+		return e.complexity.File.MimeType(childComplexity), true
+
+	case "File.size":
+		if e.complexity.File.Size == nil {
+			break
+		}
+
+		return e.complexity.File.Size(childComplexity), true
+
+	case "File.updatedAt":
+		if e.complexity.File.UpdatedAt == nil {
+			break
+		}
+
+		return e.complexity.File.UpdatedAt(childComplexity), true
+
 	case "Framework.controls":
 		if e.complexity.Framework.Controls == nil {
 			break
@@ -4889,18 +4925,6 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 
 		return e.complexity.Mutation.ExportFramework(childComplexity, args["input"].(types.ExportFrameworkInput)), true
 
-	case "Mutation.fulfillEvidence":
-		if e.complexity.Mutation.FulfillEvidence == nil {
-			break
-		}
-
-		args, err := ec.field_Mutation_fulfillEvidence_args(ctx, rawArgs)
-		if err != nil {
-			return 0, false
-		}
-
-		return e.complexity.Mutation.FulfillEvidence(childComplexity, args["input"].(types.FulfillEvidenceInput)), true
-
 	case "Mutation.generateDocumentChangelog":
 		if e.complexity.Mutation.GenerateDocumentChangelog == nil {
 			break
@@ -4985,18 +5009,6 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 
 		return e.complexity.Mutation.RemoveUser(childComplexity, args["input"].(types.RemoveUserInput)), true
 
-	case "Mutation.requestEvidence":
-		if e.complexity.Mutation.RequestEvidence == nil {
-			break
-		}
-
-		args, err := ec.field_Mutation_requestEvidence_args(ctx, rawArgs)
-		if err != nil {
-			return 0, false
-		}
-
-		return e.complexity.Mutation.RequestEvidence(childComplexity, args["input"].(types.RequestEvidenceInput)), true
-
 	case "Mutation.requestSignature":
 		if e.complexity.Mutation.RequestSignature == nil {
 			break
@@ -5345,18 +5357,6 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 
 		return e.complexity.Mutation.UploadMeasureEvidence(childComplexity, args["input"].(types.UploadMeasureEvidenceInput)), true
 
-	case "Mutation.uploadTaskEvidence":
-		if e.complexity.Mutation.UploadTaskEvidence == nil {
-			break
-		}
-
-		args, err := ec.field_Mutation_uploadTaskEvidence_args(ctx, rawArgs)
-		if err != nil {
-			return 0, false
-		}
-
-		return e.complexity.Mutation.UploadTaskEvidence(childComplexity, args["input"].(types.UploadTaskEvidenceInput)), true
-
 	case "Mutation.uploadTrustCenterNDA":
 		if e.complexity.Mutation.UploadTrustCenterNda == nil {
 			break
@@ -7421,13 +7421,6 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 
 		return e.complexity.UploadMeasureEvidencePayload.EvidenceEdge(childComplexity), true
 
-	case "UploadTaskEvidencePayload.evidenceEdge":
-		if e.complexity.UploadTaskEvidencePayload.EvidenceEdge == nil {
-			break
-		}
-
-		return e.complexity.UploadTaskEvidencePayload.EvidenceEdge(childComplexity), true
-
 	case "UploadTrustCenterNDAPayload.trustCenter":
 		if e.complexity.UploadTrustCenterNDAPayload.TrustCenter == nil {
 			break
@@ -7838,19 +7831,12 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 
 		return e.complexity.VendorComplianceReport.CreatedAt(childComplexity), true
 
-	case "VendorComplianceReport.fileSize":
-		if e.complexity.VendorComplianceReport.FileSize == nil {
+	case "VendorComplianceReport.file":
+		if e.complexity.VendorComplianceReport.File == nil {
 			break
 		}
 
-		return e.complexity.VendorComplianceReport.FileSize(childComplexity), true
-
-	case "VendorComplianceReport.fileUrl":
-		if e.complexity.VendorComplianceReport.FileURL == nil {
-			break
-		}
-
-		return e.complexity.VendorComplianceReport.FileURL(childComplexity), true
+		return e.complexity.VendorComplianceReport.File(childComplexity), true
 
 	case "VendorComplianceReport.id":
 		if e.complexity.VendorComplianceReport.ID == nil {
@@ -8442,7 +8428,6 @@ func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
 		ec.unmarshalInputUpdateVendorServiceInput,
 		ec.unmarshalInputUploadAuditReportInput,
 		ec.unmarshalInputUploadMeasureEvidenceInput,
-		ec.unmarshalInputUploadTaskEvidenceInput,
 		ec.unmarshalInputUploadTrustCenterNDAInput,
 		ec.unmarshalInputUploadVendorBusinessAssociateAgreementInput,
 		ec.unmarshalInputUploadVendorComplianceReportInput,
@@ -10308,8 +10293,7 @@ type VendorComplianceReport implements Node {
   reportDate: Datetime!
   validUntil: Datetime
   reportName: String!
-  fileUrl: String! @goField(forceResolver: true)
-  fileSize: BigInt!
+  file: File @goField(forceResolver: true)
   createdAt: Datetime!
   updatedAt: Datetime!
 }
@@ -10497,12 +10481,10 @@ type Task implements Node {
 
 type Evidence implements Node {
   id: ID!
-  fileUrl: String @goField(forceResolver: true)
-  mimeType: String!
   size: Int!
   state: EvidenceState!
   type: EvidenceType!
-  filename: String!
+  file: File @goField(forceResolver: true)
   url: String
   description: String!
 
@@ -11143,6 +11125,16 @@ type SnapshotEdge {
   node: Snapshot!
 }
 
+type File {
+    id: ID!
+    mimeType: String!
+    fileName: String!
+    size: BigInt!
+    downloadUrl: String! @goField(forceResolver: true)
+    createdAt: Datetime!
+    updatedAt: Datetime!
+}
+
 # Root Types
 type Query {
   node(id: ID!): Node!
@@ -11304,12 +11296,7 @@ type Mutation {
   ): DeleteRiskObligationMappingPayload!
 
   # Evidence mutations
-  requestEvidence(input: RequestEvidenceInput!): RequestEvidencePayload!
-  fulfillEvidence(input: FulfillEvidenceInput!): FulfillEvidencePayload!
   deleteEvidence(input: DeleteEvidenceInput!): DeleteEvidencePayload!
-  uploadTaskEvidence(
-    input: UploadTaskEvidenceInput!
-  ): UploadTaskEvidencePayload!
   uploadMeasureEvidence(
     input: UploadMeasureEvidenceInput!
   ): UploadMeasureEvidencePayload!
@@ -12695,19 +12682,10 @@ type CancelSignatureRequestPayload {
   deletedDocumentVersionSignatureId: ID!
 }
 
-type UploadTaskEvidencePayload {
-  evidenceEdge: EvidenceEdge!
-}
-
 type UploadMeasureEvidencePayload {
   evidenceEdge: EvidenceEdge!
 }
 
-input UploadTaskEvidenceInput {
-  taskId: ID!
-  file: Upload!
-}
-
 input UploadMeasureEvidenceInput {
   measureId: ID!
   file: Upload!
@@ -16247,29 +16225,6 @@ func (ec *executionContext) field_Mutation_exportFramework_argsInput(
 	return zeroVal, nil
 }
 
-func (ec *executionContext) field_Mutation_fulfillEvidence_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
-	var err error
-	args := map[string]any{}
-	arg0, err := ec.field_Mutation_fulfillEvidence_argsInput(ctx, rawArgs)
-	if err != nil {
-		return nil, err
-	}
-	args["input"] = arg0
-	return args, nil
-}
-func (ec *executionContext) field_Mutation_fulfillEvidence_argsInput(
-	ctx context.Context,
-	rawArgs map[string]any,
-) (types.FulfillEvidenceInput, error) {
-	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("input"))
-	if tmp, ok := rawArgs["input"]; ok {
-		return ec.unmarshalNFulfillEvidenceInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐFulfillEvidenceInput(ctx, tmp)
-	}
-
-	var zeroVal types.FulfillEvidenceInput
-	return zeroVal, nil
-}
-
 func (ec *executionContext) field_Mutation_generateDocumentChangelog_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -16431,29 +16386,6 @@ func (ec *executionContext) field_Mutation_removeUser_argsInput(
 	return zeroVal, nil
 }
 
-func (ec *executionContext) field_Mutation_requestEvidence_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
-	var err error
-	args := map[string]any{}
-	arg0, err := ec.field_Mutation_requestEvidence_argsInput(ctx, rawArgs)
-	if err != nil {
-		return nil, err
-	}
-	args["input"] = arg0
-	return args, nil
-}
-func (ec *executionContext) field_Mutation_requestEvidence_argsInput(
-	ctx context.Context,
-	rawArgs map[string]any,
-) (types.RequestEvidenceInput, error) {
-	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("input"))
-	if tmp, ok := rawArgs["input"]; ok {
-		return ec.unmarshalNRequestEvidenceInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐRequestEvidenceInput(ctx, tmp)
-	}
-
-	var zeroVal types.RequestEvidenceInput
-	return zeroVal, nil
-}
-
 func (ec *executionContext) field_Mutation_requestSignature_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -17121,29 +17053,6 @@ func (ec *executionContext) field_Mutation_uploadMeasureEvidence_argsInput(
 	return zeroVal, nil
 }
 
-func (ec *executionContext) field_Mutation_uploadTaskEvidence_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
-	var err error
-	args := map[string]any{}
-	arg0, err := ec.field_Mutation_uploadTaskEvidence_argsInput(ctx, rawArgs)
-	if err != nil {
-		return nil, err
-	}
-	args["input"] = arg0
-	return args, nil
-}
-func (ec *executionContext) field_Mutation_uploadTaskEvidence_argsInput(
-	ctx context.Context,
-	rawArgs map[string]any,
-) (types.UploadTaskEvidenceInput, error) {
-	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("input"))
-	if tmp, ok := rawArgs["input"]; ok {
-		return ec.unmarshalNUploadTaskEvidenceInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐUploadTaskEvidenceInput(ctx, tmp)
-	}
-
-	var zeroVal types.UploadTaskEvidenceInput
-	return zeroVal, nil
-}
-
 func (ec *executionContext) field_Mutation_uploadTrustCenterNDA_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -32301,91 +32210,6 @@ func (ec *executionContext) fieldContext_Evidence_id(_ context.Context, field gr
 	return fc, nil
 }
 
-func (ec *executionContext) _Evidence_fileUrl(ctx context.Context, field graphql.CollectedField, obj *types.Evidence) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Evidence_fileUrl(ctx, field)
-	if err != nil {
-		return graphql.Null
-	}
-	ctx = graphql.WithFieldContext(ctx, fc)
-	defer func() {
-		if r := recover(); r != nil {
-			ec.Error(ctx, ec.Recover(ctx, r))
-			ret = graphql.Null
-		}
-	}()
-	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
-		ctx = rctx // use context from middleware stack in children
-		return ec.resolvers.Evidence().FileURL(rctx, obj)
-	})
-	if err != nil {
-		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
-		return graphql.Null
-	}
-	res := resTmp.(*string)
-	fc.Result = res
-	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
-}
-
-func (ec *executionContext) fieldContext_Evidence_fileUrl(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "Evidence",
-		Field:      field,
-		IsMethod:   true,
-		IsResolver: true,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
-		},
-	}
-	return fc, nil
-}
-
-func (ec *executionContext) _Evidence_mimeType(ctx context.Context, field graphql.CollectedField, obj *types.Evidence) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Evidence_mimeType(ctx, field)
-	if err != nil {
-		return graphql.Null
-	}
-	ctx = graphql.WithFieldContext(ctx, fc)
-	defer func() {
-		if r := recover(); r != nil {
-			ec.Error(ctx, ec.Recover(ctx, r))
-			ret = graphql.Null
-		}
-	}()
-	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.MimeType, nil
-	})
-	if err != nil {
-		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
-		return graphql.Null
-	}
-	res := resTmp.(string)
-	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
-}
-
-func (ec *executionContext) fieldContext_Evidence_mimeType(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "Evidence",
-		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
-		},
-	}
-	return fc, nil
-}
-
 func (ec *executionContext) _Evidence_size(ctx context.Context, field graphql.CollectedField, obj *types.Evidence) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_Evidence_size(ctx, field)
 	if err != nil {
@@ -32518,8 +32342,8 @@ func (ec *executionContext) fieldContext_Evidence_type(_ context.Context, field
 	return fc, nil
 }
 
-func (ec *executionContext) _Evidence_filename(ctx context.Context, field graphql.CollectedField, obj *types.Evidence) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Evidence_filename(ctx, field)
+func (ec *executionContext) _Evidence_file(ctx context.Context, field graphql.CollectedField, obj *types.Evidence) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Evidence_file(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -32532,31 +32356,44 @@ func (ec *executionContext) _Evidence_filename(ctx context.Context, field graphq
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Filename, nil
+		return ec.resolvers.Evidence().File(rctx, obj)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(*types.File)
 	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
+	return ec.marshalOFile2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐFile(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Evidence_filename(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Evidence_file(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "Evidence",
 		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
+		IsMethod:   true,
+		IsResolver: true,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_File_id(ctx, field)
+			case "mimeType":
+				return ec.fieldContext_File_mimeType(ctx, field)
+			case "fileName":
+				return ec.fieldContext_File_fileName(ctx, field)
+			case "size":
+				return ec.fieldContext_File_size(ctx, field)
+			case "downloadUrl":
+				return ec.fieldContext_File_downloadUrl(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_File_createdAt(ctx, field)
+			case "updatedAt":
+				return ec.fieldContext_File_updatedAt(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type File", field.Name)
 		},
 	}
 	return fc, nil
@@ -33103,18 +32940,14 @@ func (ec *executionContext) fieldContext_EvidenceEdge_node(_ context.Context, fi
 			switch field.Name {
 			case "id":
 				return ec.fieldContext_Evidence_id(ctx, field)
-			case "fileUrl":
-				return ec.fieldContext_Evidence_fileUrl(ctx, field)
-			case "mimeType":
-				return ec.fieldContext_Evidence_mimeType(ctx, field)
 			case "size":
 				return ec.fieldContext_Evidence_size(ctx, field)
 			case "state":
 				return ec.fieldContext_Evidence_state(ctx, field)
 			case "type":
 				return ec.fieldContext_Evidence_type(ctx, field)
-			case "filename":
-				return ec.fieldContext_Evidence_filename(ctx, field)
+			case "file":
+				return ec.fieldContext_Evidence_file(ctx, field)
 			case "url":
 				return ec.fieldContext_Evidence_url(ctx, field)
 			case "description":
@@ -33222,6 +33055,314 @@ func (ec *executionContext) fieldContext_ExportFrameworkPayload_exportJobId(_ co
 	return fc, nil
 }
 
+func (ec *executionContext) _File_id(ctx context.Context, field graphql.CollectedField, obj *types.File) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_File_id(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.ID, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(gid.GID)
+	fc.Result = res
+	return ec.marshalNID2githubᚗcomᚋgetproboᚋproboᚋpkgᚋgidᚐGID(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_File_id(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "File",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _File_mimeType(ctx context.Context, field graphql.CollectedField, obj *types.File) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_File_mimeType(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.MimeType, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(string)
+	fc.Result = res
+	return ec.marshalNString2string(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_File_mimeType(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "File",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _File_fileName(ctx context.Context, field graphql.CollectedField, obj *types.File) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_File_fileName(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.FileName, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(string)
+	fc.Result = res
+	return ec.marshalNString2string(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_File_fileName(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "File",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _File_size(ctx context.Context, field graphql.CollectedField, obj *types.File) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_File_size(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Size, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(int64)
+	fc.Result = res
+	return ec.marshalNBigInt2int64(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_File_size(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "File",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type BigInt does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _File_downloadUrl(ctx context.Context, field graphql.CollectedField, obj *types.File) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_File_downloadUrl(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return ec.resolvers.File().DownloadURL(rctx, obj)
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(string)
+	fc.Result = res
+	return ec.marshalNString2string(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_File_downloadUrl(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "File",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _File_createdAt(ctx context.Context, field graphql.CollectedField, obj *types.File) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_File_createdAt(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.CreatedAt, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(time.Time)
+	fc.Result = res
+	return ec.marshalNDatetime2timeᚐTime(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_File_createdAt(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "File",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Datetime does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _File_updatedAt(ctx context.Context, field graphql.CollectedField, obj *types.File) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_File_updatedAt(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.UpdatedAt, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(time.Time)
+	fc.Result = res
+	return ec.marshalNDatetime2timeᚐTime(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_File_updatedAt(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "File",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Datetime does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Framework_id(ctx context.Context, field graphql.CollectedField, obj *types.Framework) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_Framework_id(ctx, field)
 	if err != nil {
@@ -38647,124 +38788,6 @@ func (ec *executionContext) fieldContext_Mutation_deleteRiskObligationMapping(ct
 	return fc, nil
 }
 
-func (ec *executionContext) _Mutation_requestEvidence(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Mutation_requestEvidence(ctx, field)
-	if err != nil {
-		return graphql.Null
-	}
-	ctx = graphql.WithFieldContext(ctx, fc)
-	defer func() {
-		if r := recover(); r != nil {
-			ec.Error(ctx, ec.Recover(ctx, r))
-			ret = graphql.Null
-		}
-	}()
-	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
-		ctx = rctx // use context from middleware stack in children
-		return ec.resolvers.Mutation().RequestEvidence(rctx, fc.Args["input"].(types.RequestEvidenceInput))
-	})
-	if err != nil {
-		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
-		return graphql.Null
-	}
-	res := resTmp.(*types.RequestEvidencePayload)
-	fc.Result = res
-	return ec.marshalNRequestEvidencePayload2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐRequestEvidencePayload(ctx, field.Selections, res)
-}
-
-func (ec *executionContext) fieldContext_Mutation_requestEvidence(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "Mutation",
-		Field:      field,
-		IsMethod:   true,
-		IsResolver: true,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "evidenceEdge":
-				return ec.fieldContext_RequestEvidencePayload_evidenceEdge(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type RequestEvidencePayload", field.Name)
-		},
-	}
-	defer func() {
-		if r := recover(); r != nil {
-			err = ec.Recover(ctx, r)
-			ec.Error(ctx, err)
-		}
-	}()
-	ctx = graphql.WithFieldContext(ctx, fc)
-	if fc.Args, err = ec.field_Mutation_requestEvidence_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
-		ec.Error(ctx, err)
-		return fc, err
-	}
-	return fc, nil
-}
-
-func (ec *executionContext) _Mutation_fulfillEvidence(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Mutation_fulfillEvidence(ctx, field)
-	if err != nil {
-		return graphql.Null
-	}
-	ctx = graphql.WithFieldContext(ctx, fc)
-	defer func() {
-		if r := recover(); r != nil {
-			ec.Error(ctx, ec.Recover(ctx, r))
-			ret = graphql.Null
-		}
-	}()
-	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
-		ctx = rctx // use context from middleware stack in children
-		return ec.resolvers.Mutation().FulfillEvidence(rctx, fc.Args["input"].(types.FulfillEvidenceInput))
-	})
-	if err != nil {
-		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
-		return graphql.Null
-	}
-	res := resTmp.(*types.FulfillEvidencePayload)
-	fc.Result = res
-	return ec.marshalNFulfillEvidencePayload2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐFulfillEvidencePayload(ctx, field.Selections, res)
-}
-
-func (ec *executionContext) fieldContext_Mutation_fulfillEvidence(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "Mutation",
-		Field:      field,
-		IsMethod:   true,
-		IsResolver: true,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "evidenceEdge":
-				return ec.fieldContext_FulfillEvidencePayload_evidenceEdge(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type FulfillEvidencePayload", field.Name)
-		},
-	}
-	defer func() {
-		if r := recover(); r != nil {
-			err = ec.Recover(ctx, r)
-			ec.Error(ctx, err)
-		}
-	}()
-	ctx = graphql.WithFieldContext(ctx, fc)
-	if fc.Args, err = ec.field_Mutation_fulfillEvidence_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
-		ec.Error(ctx, err)
-		return fc, err
-	}
-	return fc, nil
-}
-
 func (ec *executionContext) _Mutation_deleteEvidence(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_Mutation_deleteEvidence(ctx, field)
 	if err != nil {
@@ -38824,65 +38847,6 @@ func (ec *executionContext) fieldContext_Mutation_deleteEvidence(ctx context.Con
 	return fc, nil
 }
 
-func (ec *executionContext) _Mutation_uploadTaskEvidence(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Mutation_uploadTaskEvidence(ctx, field)
-	if err != nil {
-		return graphql.Null
-	}
-	ctx = graphql.WithFieldContext(ctx, fc)
-	defer func() {
-		if r := recover(); r != nil {
-			ec.Error(ctx, ec.Recover(ctx, r))
-			ret = graphql.Null
-		}
-	}()
-	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
-		ctx = rctx // use context from middleware stack in children
-		return ec.resolvers.Mutation().UploadTaskEvidence(rctx, fc.Args["input"].(types.UploadTaskEvidenceInput))
-	})
-	if err != nil {
-		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
-		return graphql.Null
-	}
-	res := resTmp.(*types.UploadTaskEvidencePayload)
-	fc.Result = res
-	return ec.marshalNUploadTaskEvidencePayload2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐUploadTaskEvidencePayload(ctx, field.Selections, res)
-}
-
-func (ec *executionContext) fieldContext_Mutation_uploadTaskEvidence(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "Mutation",
-		Field:      field,
-		IsMethod:   true,
-		IsResolver: true,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "evidenceEdge":
-				return ec.fieldContext_UploadTaskEvidencePayload_evidenceEdge(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type UploadTaskEvidencePayload", field.Name)
-		},
-	}
-	defer func() {
-		if r := recover(); r != nil {
-			err = ec.Recover(ctx, r)
-			ec.Error(ctx, err)
-		}
-	}()
-	ctx = graphql.WithFieldContext(ctx, fc)
-	if fc.Args, err = ec.field_Mutation_uploadTaskEvidence_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
-		ec.Error(ctx, err)
-		return fc, err
-	}
-	return fc, nil
-}
-
 func (ec *executionContext) _Mutation_uploadMeasureEvidence(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_Mutation_uploadMeasureEvidence(ctx, field)
 	if err != nil {
@@ -56250,56 +56214,6 @@ func (ec *executionContext) fieldContext_UploadMeasureEvidencePayload_evidenceEd
 	return fc, nil
 }
 
-func (ec *executionContext) _UploadTaskEvidencePayload_evidenceEdge(ctx context.Context, field graphql.CollectedField, obj *types.UploadTaskEvidencePayload) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_UploadTaskEvidencePayload_evidenceEdge(ctx, field)
-	if err != nil {
-		return graphql.Null
-	}
-	ctx = graphql.WithFieldContext(ctx, fc)
-	defer func() {
-		if r := recover(); r != nil {
-			ec.Error(ctx, ec.Recover(ctx, r))
-			ret = graphql.Null
-		}
-	}()
-	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.EvidenceEdge, nil
-	})
-	if err != nil {
-		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
-		return graphql.Null
-	}
-	res := resTmp.(*types.EvidenceEdge)
-	fc.Result = res
-	return ec.marshalNEvidenceEdge2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐEvidenceEdge(ctx, field.Selections, res)
-}
-
-func (ec *executionContext) fieldContext_UploadTaskEvidencePayload_evidenceEdge(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "UploadTaskEvidencePayload",
-		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "cursor":
-				return ec.fieldContext_EvidenceEdge_cursor(ctx, field)
-			case "node":
-				return ec.fieldContext_EvidenceEdge_node(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type EvidenceEdge", field.Name)
-		},
-	}
-	return fc, nil
-}
-
 func (ec *executionContext) _UploadTrustCenterNDAPayload_trustCenter(ctx context.Context, field graphql.CollectedField, obj *types.UploadTrustCenterNDAPayload) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_UploadTrustCenterNDAPayload_trustCenter(ctx, field)
 	if err != nil {
@@ -59299,8 +59213,8 @@ func (ec *executionContext) fieldContext_VendorComplianceReport_reportName(_ con
 	return fc, nil
 }
 
-func (ec *executionContext) _VendorComplianceReport_fileUrl(ctx context.Context, field graphql.CollectedField, obj *types.VendorComplianceReport) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_VendorComplianceReport_fileUrl(ctx, field)
+func (ec *executionContext) _VendorComplianceReport_file(ctx context.Context, field graphql.CollectedField, obj *types.VendorComplianceReport) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_VendorComplianceReport_file(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -59313,75 +59227,44 @@ func (ec *executionContext) _VendorComplianceReport_fileUrl(ctx context.Context,
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
 		ctx = rctx // use context from middleware stack in children
-		return ec.resolvers.VendorComplianceReport().FileURL(rctx, obj)
+		return ec.resolvers.VendorComplianceReport().File(rctx, obj)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(*types.File)
 	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
+	return ec.marshalOFile2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐFile(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_VendorComplianceReport_fileUrl(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_VendorComplianceReport_file(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "VendorComplianceReport",
 		Field:      field,
 		IsMethod:   true,
 		IsResolver: true,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
-		},
-	}
-	return fc, nil
-}
-
-func (ec *executionContext) _VendorComplianceReport_fileSize(ctx context.Context, field graphql.CollectedField, obj *types.VendorComplianceReport) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_VendorComplianceReport_fileSize(ctx, field)
-	if err != nil {
-		return graphql.Null
-	}
-	ctx = graphql.WithFieldContext(ctx, fc)
-	defer func() {
-		if r := recover(); r != nil {
-			ec.Error(ctx, ec.Recover(ctx, r))
-			ret = graphql.Null
-		}
-	}()
-	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.FileSize, nil
-	})
-	if err != nil {
-		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
-		return graphql.Null
-	}
-	res := resTmp.(int64)
-	fc.Result = res
-	return ec.marshalNBigInt2int64(ctx, field.Selections, res)
-}
-
-func (ec *executionContext) fieldContext_VendorComplianceReport_fileSize(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "VendorComplianceReport",
-		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type BigInt does not have child fields")
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_File_id(ctx, field)
+			case "mimeType":
+				return ec.fieldContext_File_mimeType(ctx, field)
+			case "fileName":
+				return ec.fieldContext_File_fileName(ctx, field)
+			case "size":
+				return ec.fieldContext_File_size(ctx, field)
+			case "downloadUrl":
+				return ec.fieldContext_File_downloadUrl(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_File_createdAt(ctx, field)
+			case "updatedAt":
+				return ec.fieldContext_File_updatedAt(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type File", field.Name)
 		},
 	}
 	return fc, nil
@@ -59672,10 +59555,8 @@ func (ec *executionContext) fieldContext_VendorComplianceReportEdge_node(_ conte
 				return ec.fieldContext_VendorComplianceReport_validUntil(ctx, field)
 			case "reportName":
 				return ec.fieldContext_VendorComplianceReport_reportName(ctx, field)
-			case "fileUrl":
-				return ec.fieldContext_VendorComplianceReport_fileUrl(ctx, field)
-			case "fileSize":
-				return ec.fieldContext_VendorComplianceReport_fileSize(ctx, field)
+			case "file":
+				return ec.fieldContext_VendorComplianceReport_file(ctx, field)
 			case "createdAt":
 				return ec.fieldContext_VendorComplianceReport_createdAt(ctx, field)
 			case "updatedAt":
@@ -70827,40 +70708,6 @@ func (ec *executionContext) unmarshalInputUploadMeasureEvidenceInput(ctx context
 	return it, nil
 }
 
-func (ec *executionContext) unmarshalInputUploadTaskEvidenceInput(ctx context.Context, obj any) (types.UploadTaskEvidenceInput, error) {
-	var it types.UploadTaskEvidenceInput
-	asMap := map[string]any{}
-	for k, v := range obj.(map[string]any) {
-		asMap[k] = v
-	}
-
-	fieldsInOrder := [...]string{"taskId", "file"}
-	for _, k := range fieldsInOrder {
-		v, ok := asMap[k]
-		if !ok {
-			continue
-		}
-		switch k {
-		case "taskId":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("taskId"))
-			data, err := ec.unmarshalNID2githubᚗcomᚋgetproboᚋproboᚋpkgᚋgidᚐGID(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.TaskID = data
-		case "file":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("file"))
-			data, err := ec.unmarshalNUpload2githubᚗcomᚋ99designsᚋgqlgenᚋgraphqlᚐUpload(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.File = data
-		}
-	}
-
-	return it, nil
-}
-
 func (ec *executionContext) unmarshalInputUploadTrustCenterNDAInput(ctx context.Context, obj any) (types.UploadTrustCenterNDAInput, error) {
 	var it types.UploadTrustCenterNDAInput
 	asMap := map[string]any{}
@@ -77147,7 +76994,22 @@ func (ec *executionContext) _Evidence(ctx context.Context, sel ast.SelectionSet,
 			if out.Values[i] == graphql.Null {
 				atomic.AddUint32(&out.Invalids, 1)
 			}
-		case "fileUrl":
+		case "size":
+			out.Values[i] = ec._Evidence_size(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "state":
+			out.Values[i] = ec._Evidence_state(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "type":
+			out.Values[i] = ec._Evidence_type(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "file":
 			field := field
 
 			innerFunc := func(ctx context.Context, _ *graphql.FieldSet) (res graphql.Marshaler) {
@@ -77156,7 +77018,7 @@ func (ec *executionContext) _Evidence(ctx context.Context, sel ast.SelectionSet,
 						ec.Error(ctx, ec.Recover(ctx, r))
 					}
 				}()
-				res = ec._Evidence_fileUrl(ctx, field, obj)
+				res = ec._Evidence_file(ctx, field, obj)
 				return res
 			}
 
@@ -77180,31 +77042,6 @@ func (ec *executionContext) _Evidence(ctx context.Context, sel ast.SelectionSet,
 			}
 
 			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
-		case "mimeType":
-			out.Values[i] = ec._Evidence_mimeType(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&out.Invalids, 1)
-			}
-		case "size":
-			out.Values[i] = ec._Evidence_size(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&out.Invalids, 1)
-			}
-		case "state":
-			out.Values[i] = ec._Evidence_state(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&out.Invalids, 1)
-			}
-		case "type":
-			out.Values[i] = ec._Evidence_type(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&out.Invalids, 1)
-			}
-		case "filename":
-			out.Values[i] = ec._Evidence_filename(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&out.Invalids, 1)
-			}
 		case "url":
 			out.Values[i] = ec._Evidence_url(ctx, field, obj)
 		case "description":
@@ -77516,6 +77353,106 @@ func (ec *executionContext) _ExportFrameworkPayload(ctx context.Context, sel ast
 	return out
 }
 
+var fileImplementors = []string{"File"}
+
+func (ec *executionContext) _File(ctx context.Context, sel ast.SelectionSet, obj *types.File) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, fileImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("File")
+		case "id":
+			out.Values[i] = ec._File_id(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "mimeType":
+			out.Values[i] = ec._File_mimeType(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "fileName":
+			out.Values[i] = ec._File_fileName(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "size":
+			out.Values[i] = ec._File_size(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "downloadUrl":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._File_downloadUrl(ctx, field, obj)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "createdAt":
+			out.Values[i] = ec._File_createdAt(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "updatedAt":
+			out.Values[i] = ec._File_updatedAt(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
 var frameworkImplementors = []string{"Framework", "Node"}
 
 func (ec *executionContext) _Framework(ctx context.Context, sel ast.SelectionSet, obj *types.Framework) graphql.Marshaler {
@@ -78795,20 +78732,6 @@ func (ec *executionContext) _Mutation(ctx context.Context, sel ast.SelectionSet)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
-		case "requestEvidence":
-			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
-				return ec._Mutation_requestEvidence(ctx, field)
-			})
-			if out.Values[i] == graphql.Null {
-				out.Invalids++
-			}
-		case "fulfillEvidence":
-			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
-				return ec._Mutation_fulfillEvidence(ctx, field)
-			})
-			if out.Values[i] == graphql.Null {
-				out.Invalids++
-			}
 		case "deleteEvidence":
 			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
 				return ec._Mutation_deleteEvidence(ctx, field)
@@ -78816,13 +78739,6 @@ func (ec *executionContext) _Mutation(ctx context.Context, sel ast.SelectionSet)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
-		case "uploadTaskEvidence":
-			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
-				return ec._Mutation_uploadTaskEvidence(ctx, field)
-			})
-			if out.Values[i] == graphql.Null {
-				out.Invalids++
-			}
 		case "uploadMeasureEvidence":
 			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
 				return ec._Mutation_uploadMeasureEvidence(ctx, field)
@@ -84696,45 +84612,6 @@ func (ec *executionContext) _UploadMeasureEvidencePayload(ctx context.Context, s
 	return out
 }
 
-var uploadTaskEvidencePayloadImplementors = []string{"UploadTaskEvidencePayload"}
-
-func (ec *executionContext) _UploadTaskEvidencePayload(ctx context.Context, sel ast.SelectionSet, obj *types.UploadTaskEvidencePayload) graphql.Marshaler {
-	fields := graphql.CollectFields(ec.OperationContext, sel, uploadTaskEvidencePayloadImplementors)
-
-	out := graphql.NewFieldSet(fields)
-	deferred := make(map[string]*graphql.FieldSet)
-	for i, field := range fields {
-		switch field.Name {
-		case "__typename":
-			out.Values[i] = graphql.MarshalString("UploadTaskEvidencePayload")
-		case "evidenceEdge":
-			out.Values[i] = ec._UploadTaskEvidencePayload_evidenceEdge(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				out.Invalids++
-			}
-		default:
-			panic("unknown field " + strconv.Quote(field.Name))
-		}
-	}
-	out.Dispatch(ctx)
-	if out.Invalids > 0 {
-		return graphql.Null
-	}
-
-	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
-
-	for label, dfs := range deferred {
-		ec.processDeferredGroup(graphql.DeferredGroup{
-			Label:    label,
-			Path:     graphql.GetPath(ctx),
-			FieldSet: dfs,
-			Context:  ctx,
-		})
-	}
-
-	return out
-}
-
 var uploadTrustCenterNDAPayloadImplementors = []string{"UploadTrustCenterNDAPayload"}
 
 func (ec *executionContext) _UploadTrustCenterNDAPayload(ctx context.Context, sel ast.SelectionSet, obj *types.UploadTrustCenterNDAPayload) graphql.Marshaler {
@@ -85684,19 +85561,16 @@ func (ec *executionContext) _VendorComplianceReport(ctx context.Context, sel ast
 			if out.Values[i] == graphql.Null {
 				atomic.AddUint32(&out.Invalids, 1)
 			}
-		case "fileUrl":
+		case "file":
 			field := field
 
-			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+			innerFunc := func(ctx context.Context, _ *graphql.FieldSet) (res graphql.Marshaler) {
 				defer func() {
 					if r := recover(); r != nil {
 						ec.Error(ctx, ec.Recover(ctx, r))
 					}
 				}()
-				res = ec._VendorComplianceReport_fileUrl(ctx, field, obj)
-				if res == graphql.Null {
-					atomic.AddUint32(&fs.Invalids, 1)
-				}
+				res = ec._VendorComplianceReport_file(ctx, field, obj)
 				return res
 			}
 
@@ -85720,11 +85594,6 @@ func (ec *executionContext) _VendorComplianceReport(ctx context.Context, sel ast
 			}
 
 			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
-		case "fileSize":
-			out.Values[i] = ec._VendorComplianceReport_fileSize(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&out.Invalids, 1)
-			}
 		case "createdAt":
 			out.Values[i] = ec._VendorComplianceReport_createdAt(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
@@ -91247,25 +91116,6 @@ var (
 	}
 )
 
-func (ec *executionContext) unmarshalNFulfillEvidenceInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐFulfillEvidenceInput(ctx context.Context, v any) (types.FulfillEvidenceInput, error) {
-	res, err := ec.unmarshalInputFulfillEvidenceInput(ctx, v)
-	return res, graphql.ErrorOnPath(ctx, err)
-}
-
-func (ec *executionContext) marshalNFulfillEvidencePayload2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐFulfillEvidencePayload(ctx context.Context, sel ast.SelectionSet, v types.FulfillEvidencePayload) graphql.Marshaler {
-	return ec._FulfillEvidencePayload(ctx, sel, &v)
-}
-
-func (ec *executionContext) marshalNFulfillEvidencePayload2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐFulfillEvidencePayload(ctx context.Context, sel ast.SelectionSet, v *types.FulfillEvidencePayload) graphql.Marshaler {
-	if v == nil {
-		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
-			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
-		}
-		return graphql.Null
-	}
-	return ec._FulfillEvidencePayload(ctx, sel, v)
-}
-
 func (ec *executionContext) unmarshalNGenerateDocumentChangelogInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐGenerateDocumentChangelogInput(ctx context.Context, v any) (types.GenerateDocumentChangelogInput, error) {
 	res, err := ec.unmarshalInputGenerateDocumentChangelogInput(ctx, v)
 	return res, graphql.ErrorOnPath(ctx, err)
@@ -92419,25 +92269,6 @@ func (ec *executionContext) marshalNRemoveUserPayload2ᚖgithubᚗcomᚋgetprobo
 	return ec._RemoveUserPayload(ctx, sel, v)
 }
 
-func (ec *executionContext) unmarshalNRequestEvidenceInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐRequestEvidenceInput(ctx context.Context, v any) (types.RequestEvidenceInput, error) {
-	res, err := ec.unmarshalInputRequestEvidenceInput(ctx, v)
-	return res, graphql.ErrorOnPath(ctx, err)
-}
-
-func (ec *executionContext) marshalNRequestEvidencePayload2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐRequestEvidencePayload(ctx context.Context, sel ast.SelectionSet, v types.RequestEvidencePayload) graphql.Marshaler {
-	return ec._RequestEvidencePayload(ctx, sel, &v)
-}
-
-func (ec *executionContext) marshalNRequestEvidencePayload2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐRequestEvidencePayload(ctx context.Context, sel ast.SelectionSet, v *types.RequestEvidencePayload) graphql.Marshaler {
-	if v == nil {
-		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
-			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
-		}
-		return graphql.Null
-	}
-	return ec._RequestEvidencePayload(ctx, sel, v)
-}
-
 func (ec *executionContext) unmarshalNRequestSignatureInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐRequestSignatureInput(ctx context.Context, v any) (types.RequestSignatureInput, error) {
 	res, err := ec.unmarshalInputRequestSignatureInput(ctx, v)
 	return res, graphql.ErrorOnPath(ctx, err)
@@ -93886,25 +93717,6 @@ func (ec *executionContext) marshalNUploadMeasureEvidencePayload2ᚖgithubᚗcom
 	return ec._UploadMeasureEvidencePayload(ctx, sel, v)
 }
 
-func (ec *executionContext) unmarshalNUploadTaskEvidenceInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐUploadTaskEvidenceInput(ctx context.Context, v any) (types.UploadTaskEvidenceInput, error) {
-	res, err := ec.unmarshalInputUploadTaskEvidenceInput(ctx, v)
-	return res, graphql.ErrorOnPath(ctx, err)
-}
-
-func (ec *executionContext) marshalNUploadTaskEvidencePayload2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐUploadTaskEvidencePayload(ctx context.Context, sel ast.SelectionSet, v types.UploadTaskEvidencePayload) graphql.Marshaler {
-	return ec._UploadTaskEvidencePayload(ctx, sel, &v)
-}
-
-func (ec *executionContext) marshalNUploadTaskEvidencePayload2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐUploadTaskEvidencePayload(ctx context.Context, sel ast.SelectionSet, v *types.UploadTaskEvidencePayload) graphql.Marshaler {
-	if v == nil {
-		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
-			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
-		}
-		return graphql.Null
-	}
-	return ec._UploadTaskEvidencePayload(ctx, sel, v)
-}
-
 func (ec *executionContext) unmarshalNUploadTrustCenterNDAInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐUploadTrustCenterNDAInput(ctx context.Context, v any) (types.UploadTrustCenterNDAInput, error) {
 	res, err := ec.unmarshalInputUploadTrustCenterNDAInput(ctx, v)
 	return res, graphql.ErrorOnPath(ctx, err)
@@ -96060,6 +95872,13 @@ func (ec *executionContext) unmarshalOEvidenceOrder2ᚖgithubᚗcomᚋgetprobo
 	return &res, graphql.ErrorOnPath(ctx, err)
 }
 
+func (ec *executionContext) marshalOFile2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐFile(ctx context.Context, sel ast.SelectionSet, v *types.File) graphql.Marshaler {
+	if v == nil {
+		return graphql.Null
+	}
+	return ec._File(ctx, sel, v)
+}
+
 func (ec *executionContext) unmarshalOFrameworkOrder2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐFrameworkOrderBy(ctx context.Context, v any) (*types.FrameworkOrderBy, error) {
 	if v == nil {
 		return nil, nil
diff --git a/pkg/server/api/console/v1/types/evidence.go b/pkg/server/api/console/v1/types/evidence.go
index a85d94592..64de603e0 100644
--- a/pkg/server/api/console/v1/types/evidence.go
+++ b/pkg/server/api/console/v1/types/evidence.go
@@ -61,8 +61,6 @@ func NewEvidenceEdge(e *coredata.Evidence, orderBy coredata.EvidenceOrderField)
 }
 
 func NewEvidence(e *coredata.Evidence) *Evidence {
-	var fileURL *string = nil
-
 	var urlPtr *string = nil
 	if e.URL != "" {
 		urlCopy := e.URL
@@ -73,10 +71,6 @@ func NewEvidence(e *coredata.Evidence) *Evidence {
 		ID:          e.ID,
 		State:       e.State,
 		Type:        e.Type,
-		FileURL:     fileURL,
-		Filename:    e.Filename,
-		MimeType:    e.MimeType,
-		Size:        int(e.Size),
 		URL:         urlPtr,
 		Description: e.Description,
 		CreatedAt:   e.CreatedAt,
diff --git a/pkg/server/api/console/v1/types/file.go b/pkg/server/api/console/v1/types/file.go
new file mode 100644
index 000000000..a7cbf5e85
--- /dev/null
+++ b/pkg/server/api/console/v1/types/file.go
@@ -0,0 +1,30 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/coredata"
+)
+
+func NewFile(r *coredata.File) *File {
+	return &File{
+		ID:        r.ID,
+		MimeType:  r.MimeType,
+		FileName:  r.FileName,
+		Size:      r.FileSize,
+		CreatedAt: r.CreatedAt,
+		UpdatedAt: r.UpdatedAt,
+	}
+}
diff --git a/pkg/server/api/console/v1/types/types.go b/pkg/server/api/console/v1/types/types.go
index 58c2d3b98..877a209a4 100644
--- a/pkg/server/api/console/v1/types/types.go
+++ b/pkg/server/api/console/v1/types/types.go
@@ -1034,12 +1034,10 @@ type DocumentVersionSignatureOrder struct {
 
 type Evidence struct {
 	ID          gid.GID                `json:"id"`
-	FileURL     *string                `json:"fileUrl,omitempty"`
-	MimeType    string                 `json:"mimeType"`
 	Size        int                    `json:"size"`
 	State       coredata.EvidenceState `json:"state"`
 	Type        coredata.EvidenceType  `json:"type"`
-	Filename    string                 `json:"filename"`
+	File        *File                  `json:"file,omitempty"`
 	URL         *string                `json:"url,omitempty"`
 	Description string                 `json:"description"`
 	Task        *Task                  `json:"task,omitempty"`
@@ -1075,6 +1073,16 @@ type ExportFrameworkPayload struct {
 	ExportJobID gid.GID `json:"exportJobId"`
 }
 
+type File struct {
+	ID          gid.GID   `json:"id"`
+	MimeType    string    `json:"mimeType"`
+	FileName    string    `json:"fileName"`
+	Size        int64     `json:"size"`
+	DownloadURL string    `json:"downloadUrl"`
+	CreatedAt   time.Time `json:"createdAt"`
+	UpdatedAt   time.Time `json:"updatedAt"`
+}
+
 type Framework struct {
 	ID           gid.GID            `json:"id"`
 	Name         string             `json:"name"`
@@ -1955,15 +1963,6 @@ type UploadMeasureEvidencePayload struct {
 	EvidenceEdge *EvidenceEdge `json:"evidenceEdge"`
 }
 
-type UploadTaskEvidenceInput struct {
-	TaskID gid.GID        `json:"taskId"`
-	File   graphql.Upload `json:"file"`
-}
-
-type UploadTaskEvidencePayload struct {
-	EvidenceEdge *EvidenceEdge `json:"evidenceEdge"`
-}
-
 type UploadTrustCenterNDAInput struct {
 	TrustCenterID gid.GID        `json:"trustCenterId"`
 	FileName      string         `json:"fileName"`
@@ -2090,8 +2089,7 @@ type VendorComplianceReport struct {
 	ReportDate time.Time  `json:"reportDate"`
 	ValidUntil *time.Time `json:"validUntil,omitempty"`
 	ReportName string     `json:"reportName"`
-	FileURL    string     `json:"fileUrl"`
-	FileSize   int64      `json:"fileSize"`
+	File       *File      `json:"file,omitempty"`
 	CreatedAt  time.Time  `json:"createdAt"`
 	UpdatedAt  time.Time  `json:"updatedAt"`
 }
diff --git a/pkg/server/api/console/v1/types/vendor_compliance_report.go b/pkg/server/api/console/v1/types/vendor_compliance_report.go
index 352eb1a26..0160ec20c 100644
--- a/pkg/server/api/console/v1/types/vendor_compliance_report.go
+++ b/pkg/server/api/console/v1/types/vendor_compliance_report.go
@@ -49,7 +49,6 @@ func NewVendorComplianceReport(c *coredata.VendorComplianceReport) *VendorCompli
 		ReportDate: c.ReportDate,
 		ValidUntil: c.ValidUntil,
 		ReportName: c.ReportName,
-		FileSize:   c.FileSize,
 		CreatedAt:  c.CreatedAt,
 		UpdatedAt:  c.UpdatedAt,
 	}
diff --git a/pkg/server/api/console/v1/v1_resolver.go b/pkg/server/api/console/v1/v1_resolver.go
index 43869f6db..5f3e4ce8a 100644
--- a/pkg/server/api/console/v1/v1_resolver.go
+++ b/pkg/server/api/console/v1/v1_resolver.go
@@ -734,21 +734,25 @@ func (r *documentVersionSignatureResolver) SignedBy(ctx context.Context, obj *ty
 	return types.NewPeople(people), nil
 }
 
-// FileURL is the resolver for the fileUrl field.
-func (r *evidenceResolver) FileURL(ctx context.Context, obj *types.Evidence) (*string, error) {
+// File is the resolver for the file field.
+func (r *evidenceResolver) File(ctx context.Context, obj *types.Evidence) (*types.File, error) {
 	prb := r.ProboService(ctx, obj.ID.TenantID())
 
-	if obj.Type == coredata.EvidenceTypeLink {
-		return obj.URL, nil
-	}
-
-	fileURL, err := prb.Evidences.GenerateFileURL(ctx, obj.ID, 15*time.Minute)
+	evidence, err := prb.Evidences.Get(ctx, obj.ID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot generate file URL: %w", err)
+		return nil, fmt.Errorf("cannot load evidence: %w", err)
 	}
 
-	result := *fileURL
-	return &result, nil
+	if evidence.EvidenceFileId == nil {
+		return nil, nil
+	}
+
+	file, err := prb.Files.Get(ctx, *evidence.EvidenceFileId)
+	if err != nil {
+		return nil, fmt.Errorf("cannot load evidence file: %w", err)
+	}
+
+	return types.NewFile(file), nil
 }
 
 // Task is the resolver for the task field.
@@ -811,6 +815,18 @@ func (r *evidenceConnectionResolver) TotalCount(ctx context.Context, obj *types.
 	panic(fmt.Errorf("unsupported resolver: %T", obj.Resolver))
 }
 
+// DownloadURL is the resolver for the downloadUrl field.
+func (r *fileResolver) DownloadURL(ctx context.Context, obj *types.File) (string, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	downloadUrl, err := prb.Files.GenerateFileTempURL(ctx, obj.ID, 60*time.Second)
+	if err != nil {
+		return "", fmt.Errorf("cannot generate download url: %w", err)
+	}
+
+	return downloadUrl, nil
+}
+
 // Organization is the resolver for the organization field.
 func (r *frameworkResolver) Organization(ctx context.Context, obj *types.Framework) (*types.Organization, error) {
 	prb := r.ProboService(ctx, obj.ID.TenantID())
@@ -2227,55 +2243,6 @@ func (r *mutationResolver) DeleteRiskObligationMapping(ctx context.Context, inpu
 	}, nil
 }
 
-// RequestEvidence is the resolver for the requestEvidence field.
-func (r *mutationResolver) RequestEvidence(ctx context.Context, input types.RequestEvidenceInput) (*types.RequestEvidencePayload, error) {
-	prb := r.ProboService(ctx, input.TaskID.TenantID())
-
-	evidence, err := prb.Evidences.Request(
-		ctx,
-		probo.RequestEvidenceRequest{
-			TaskID:      &input.TaskID,
-			Name:        input.Name,
-			Type:        input.Type,
-			Description: input.Description,
-		},
-	)
-	if err != nil {
-		panic(fmt.Errorf("cannot request evidence: %w", err))
-	}
-
-	return &types.RequestEvidencePayload{
-		EvidenceEdge: types.NewEvidenceEdge(evidence, coredata.EvidenceOrderFieldCreatedAt),
-	}, nil
-}
-
-// FulfillEvidence is the resolver for the fulfillEvidence field.
-func (r *mutationResolver) FulfillEvidence(ctx context.Context, input types.FulfillEvidenceInput) (*types.FulfillEvidencePayload, error) {
-	prb := r.ProboService(ctx, input.EvidenceID.TenantID())
-
-	req := probo.FulfilledEvidenceRequest{
-		EvidenceID: input.EvidenceID,
-	}
-
-	if input.File != nil {
-		req.File = input.File.File
-		req.Filename = &input.File.Filename
-	}
-
-	if input.URL != nil {
-		req.URL = input.URL
-	}
-
-	evidence, err := prb.Evidences.Fulfill(ctx, req)
-	if err != nil {
-		panic(fmt.Errorf("cannot fulfill evidence: %w", err))
-	}
-
-	return &types.FulfillEvidencePayload{
-		EvidenceEdge: types.NewEvidenceEdge(evidence, coredata.EvidenceOrderFieldCreatedAt),
-	}, nil
-}
-
 // DeleteEvidence is the resolver for the deleteEvidence field.
 func (r *mutationResolver) DeleteEvidence(ctx context.Context, input types.DeleteEvidenceInput) (*types.DeleteEvidencePayload, error) {
 	prb := r.ProboService(ctx, input.EvidenceID.TenantID())
@@ -2290,31 +2257,6 @@ func (r *mutationResolver) DeleteEvidence(ctx context.Context, input types.Delet
 	}, nil
 }
 
-// UploadTaskEvidence is the resolver for the uploadTaskEvidence field.
-func (r *mutationResolver) UploadTaskEvidence(ctx context.Context, input types.UploadTaskEvidenceInput) (*types.UploadTaskEvidencePayload, error) {
-	prb := r.ProboService(ctx, input.TaskID.TenantID())
-
-	evidence, err := prb.Evidences.UploadTaskEvidence(
-		ctx,
-		probo.UploadTaskEvidenceRequest{
-			TaskID: input.TaskID,
-			File: probo.File{
-				Content:     input.File.File,
-				Filename:    input.File.Filename,
-				Size:        input.File.Size,
-				ContentType: input.File.ContentType,
-			},
-		},
-	)
-	if err != nil {
-		panic(fmt.Errorf("cannot upload task evidence: %w", err))
-	}
-
-	return &types.UploadTaskEvidencePayload{
-		EvidenceEdge: types.NewEvidenceEdge(evidence, coredata.EvidenceOrderFieldCreatedAt),
-	}, nil
-}
-
 // UploadMeasureEvidence is the resolver for the uploadMeasureEvidence field.
 func (r *mutationResolver) UploadMeasureEvidence(ctx context.Context, input types.UploadMeasureEvidenceInput) (*types.UploadMeasureEvidencePayload, error) {
 	prb := r.ProboService(ctx, input.MeasureID.TenantID())
@@ -2323,7 +2265,7 @@ func (r *mutationResolver) UploadMeasureEvidence(ctx context.Context, input type
 		ctx,
 		probo.UploadMeasureEvidenceRequest{
 			MeasureID: input.MeasureID,
-			File: probo.File{
+			File: probo.FileUpload{
 				Content:     input.File.File,
 				Filename:    input.File.Filename,
 				Size:        input.File.Size,
@@ -2348,7 +2290,7 @@ func (r *mutationResolver) UploadVendorComplianceReport(ctx context.Context, inp
 		ctx,
 		input.VendorID,
 		&probo.VendorComplianceReportCreateRequest{
-			File:       input.File.File,
+			File:       probo.FileUpload{Filename: input.File.Filename, Size: input.File.Size, Content: input.File.File, ContentType: input.File.ContentType},
 			ReportDate: input.ReportDate,
 			ValidUntil: input.ValidUntil,
 			ReportName: input.ReportName,
@@ -5065,16 +5007,25 @@ func (r *vendorComplianceReportResolver) Vendor(ctx context.Context, obj *types.
 	return types.NewVendor(vendor), nil
 }
 
-// FileURL is the resolver for the fileUrl field.
-func (r *vendorComplianceReportResolver) FileURL(ctx context.Context, obj *types.VendorComplianceReport) (string, error) {
+// File is the resolver for the file field.
+func (r *vendorComplianceReportResolver) File(ctx context.Context, obj *types.VendorComplianceReport) (*types.File, error) {
 	prb := r.ProboService(ctx, obj.ID.TenantID())
 
-	fileURL, err := prb.VendorComplianceReports.GenerateFileURL(ctx, obj.ID, 1*time.Hour)
+	evidence, err := prb.VendorComplianceReports.Get(ctx, obj.ID)
 	if err != nil {
-		panic(fmt.Errorf("failed to generate file URL: %w", err))
+		return nil, fmt.Errorf("cannot load evidence: %w", err)
 	}
 
-	return fileURL, nil
+	if evidence.ReportFileId == nil {
+		return nil, nil
+	}
+
+	file, err := prb.Files.Get(ctx, *evidence.ReportFileId)
+	if err != nil {
+		return nil, fmt.Errorf("cannot load evidence file: %w", err)
+	}
+
+	return types.NewFile(file), nil
 }
 
 // TotalCount is the resolver for the totalCount field.
@@ -5271,6 +5222,9 @@ func (r *Resolver) EvidenceConnection() schema.EvidenceConnectionResolver {
 	return &evidenceConnectionResolver{r}
 }
 
+// File returns schema.FileResolver implementation.
+func (r *Resolver) File() schema.FileResolver { return &fileResolver{r} }
+
 // Framework returns schema.FrameworkResolver implementation.
 func (r *Resolver) Framework() schema.FrameworkResolver { return &frameworkResolver{r} }
 
@@ -5434,6 +5388,7 @@ type documentVersionResolver struct{ *Resolver }
 type documentVersionSignatureResolver struct{ *Resolver }
 type evidenceResolver struct{ *Resolver }
 type evidenceConnectionResolver struct{ *Resolver }
+type fileResolver struct{ *Resolver }
 type frameworkResolver struct{ *Resolver }
 type frameworkConnectionResolver struct{ *Resolver }
 type measureResolver struct{ *Resolver }