How we keep your security evidence safe

PolicyReadiness holds the proof behind your security controls: screenshots, exports, and policies. Here is how that proof is protected, in one page.

Every file is checked before anyone opens it

Inspected on upload. The content must match the file type. Programs, Office macros, PDFs with scripts, HTML, and SVG are refused.
Virus-scanned with ClamAV in a private container. Nobody can download a file until its scan is clean.
Never shown in the browser, only downloaded, so an uploaded file can never run as a page.

A record that cannot be rewritten

A SHA-256 fingerprint and a time stamp on every file, so you can prove later that it is unchanged.
Add-only. Evidence, review notes, and the activity log are only ever added to. The app has no function that edits or deletes them.
The server checks the score. A browser cannot make the readiness score look better than it is.

Each company is kept apart

One company, one locker. Every record carries its company's key, and the server checks it on every request.
Share links for a broker or a board expire after 30 days, can be turned off, and carry no files.
HTTPS only, with a strict content security policy and secure session cookies.

Accounts that resist guessing

Passwords we cannot read: salted PBKDF2-SHA-256 hashes with 600,000 rounds. Sessions and email links are stored as hashes too.
Two-step sign-in for every account, and required for every analyst. Its secret is stored encrypted.
Locked after wrong guesses for 15 minutes. No account sees company data before its email is confirmed.

Read-only connections

Microsoft 365 and Google Workspace connect read-only. We read security settings and cannot change them.
No passwords or refresh tokens are stored. Your admin can remove our access at any time.
A changed setting is flagged to your analyst, never acted on by the app.

AI with clear limits

One file and one control at a time go to Anthropic's Claude API, never another company's data.
Not used for training. Anthropic deletes it within 30 days by default. We keep only the verdict and its reason.
A person has the last word. Disagree with a verdict, and an analyst reviews it.

Built on certified infrastructure

Cloudflare: Site, database, and files. SOC 2 Type II, ISO 27001.
Anthropic: AI review. SOC 2 Type II, ISO 27001, ISO/IEC 42001.
Stripe: Payments. PCI DSS Level 1. Card numbers never reach us.
Resend: Email. SOC 2 Type II.

These certifications cover our providers' services, not PolicyReadiness itself: we have not had our own SOC 2 audit.