AuditsCompliance-in-a-Box: The Startup Guide to Audit-Ready DocsSVSid Varma · 12 min readSend each policy to the people it covers, collect an acknowledgment from each of them by name and version, and ask again whenever it changes. The record is ready before anyone asks for it.
30-day trialUnlimited free viewersNo credit card required
One job, start to finish. Each step links to the part of the product that does it.
Tags decide who receives each policy. Leave out named people before you send, and new hires get theirs on day one.
Policy Distribution and AccessPeople open the policy and acknowledge it there. The record holds their name and email, the version, the time, the statement and the IP address.
Audit Trail and ExportChoose a cadence when you send, from every day to every three weeks, and reminders go out until each person acts.
Policy Distribution and AccessOnce a new version is approved, everyone it covers is asked to acknowledge it. If a review finds nothing to change, the date simply moves.
Versions and ReviewsFilter by date, person or action, and export a PDF or CSV. Or let an auditor open the document with a one-time code.
External ViewersThe policy itself, with an Acknowledge button. No forms, no attachments to sign and send back.
A new version, once approved, goes back to everyone it covers. Yesterday’s acknowledgment never stands in for today’s.
Inside the company and outside it, people ask the same question: did this person receive this version, and when.
SOC 2, Trust Services Criteria CC1.1
When customers ask for your SOC 2 report, the auditor usually samples new hires and checks that each one acknowledged the code of conduct.
ISO/IEC 27001, clauses 5.2, 7.3
The security policy is communicated within the organization, and people are aware of it and of their part in it. Auditors sample the evidence.
PCI DSS v4.0, Requirement 12
Personnel confirm at least once a year that they have read and understood the security policy.
Wherever you employ people
Harassment, leave and conduct policies often have to reach every employee with proof of receipt, and the rules differ by country and by state.
Your region’s laws, the standards your customers ask for, and your own house rules. Write each one as a policy, approve it, and send it to the people it covers.
From the handbook on day one to the security policy before the audit.
Already have a policy as a PDF? Upload it and get it acknowledged by name.
Choose when you send it. A notification tells people about the policy; an acknowledgment records each person, by version and time. e-sign is an add-on on the Scale plan.
Yes. Each record holds the person’s name and email, the version, the time, the statement and the IP address. Export it as a PDF or CSV.
Reminders go out on the cadence you set until they do, and you can see at a glance who has acknowledged and who has not.
Once the new version is approved, everyone it covers is asked again. Every change counts, however small.
Only when a policy changes or expires. If nothing changed at review, the date moves and no one is asked again.
Yes. Invite them as external viewers or users, and they acknowledge the same way as staff.
Their completed acknowledgments stay on record.
free for 30 days