AuditsCompliance-in-a-Box: The Startup Guide to Audit-Ready DocsSVSid Varma · 12 min readFor software and services companies certifying to ISO 27001 or ISO 42001, or answering customer security questionnaires. The policy set approved, sent to the people it covers, and on record by version.
30-day trialUnlimited free viewersNo credit card required
Good teams already have the policies. The work is keeping approval, acknowledgment and review as current as the code.
ISO/IEC 27001, clauses 5.2, 7.3, 7.5, A.5.1
The information security policy and topic policies are approved, published, communicated, acknowledged and reviewed. Auditors sample the record.
ISO/IEC 42001, clauses 5.2, 7.3, A.2
An AI policy set, communicated, with people aware of their part in it. A new standard, heavy on documented information.
NIST CSF 2.0, Govern function
The Govern function is policy and oversight. Policies and roles mapped to it give a clear answer when customers ask how you align.
GDPR, Articles 5(2), 24, 39
Accountability means documented policies and staff awareness, alongside your records of processing and impact assessments.
Built for security and compliance leads who show policy control to auditors, customers and investors.
Engineering gets secure development, ops gets incident response, everyone gets acceptable use.
Invite a new starter with their tags and their policies are waiting.
Employees and other viewers are unlimited and free. You pay for the people who write.
A revised policy is approved, then everyone it covers is asked again, automatically.
Publish chosen policies on your own domain, from the approved version.
Filter the record by date, person or policy and export a PDF or CSV.
Tag people by team and location. Each policy reaches only the people it covers, and new hires get theirs on day one.
Show the auditor who has acknowledged which version, with the time and the statement they agreed to.
Certification covers part of it. A company runs on many other policies, and they need the same control.
Share approved policies with a prospect as a one-time viewer, without sending files around.
A policy for generative AI tools, current as the tools change, and acknowledged by everyone.
Access procedures versioned, so every manager follows the same steps.
A policy every employee and contractor has acknowledged.
Equipment and expense rules current, with state differences kept in one place.
One current version for every employee, confirmed when it changes.
Certification auditors, enterprise customers and investors ask the same thing in different words: the current policy, who approved it and who has it.
Export the record as a PDF or CSV, share a policy with a one-time viewer, or publish it on your trust page.
Need help writing the policies? Find a consultant for your standard.
No. They read, acknowledge and sign as viewers, free of charge.
Both are available. Choose for each policy when you send it. e-sign is an add-on on the Scale plan.
The new version is approved, then sent to everyone it applies to, who are asked again.
Yes. Add them as a one-time viewer and they open that document with a one-time code.
Yes. Make an approved policy public and it appears on your site, from the same approved version.
Their completed acknowledgments stay on record.
free for 30 days