PolicyReadinessYou hand us your proof.
Here is how we guard it.
Evidence files say a lot about a company. This page says what the application does with them, in plain words. Each point below describes how the software works today.
Get the one-page summary to share with your team, your broker, or your auditor.
Your files
Checked before they are stored
Each upload is opened and inspected first. The content must match the file type. We refuse program files with a changed name, Office files with macros or DDE commands, PDFs with scripts or embedded files, HTML, SVG, and spreadsheets with formulas that run programs. One bad file refuses the whole upload.
In plain words: we open each file to check that it is what it says it is. Anything that could run code is refused.
Scanned for malware
Each stored file then gets a ClamAV scan in a private container that nothing on the internet can reach. Nobody can download a file until its scan is clean. An infected file is deleted at once; its record stays in your trail.
In plain words: a virus check runs in a sealed area. Nobody can open a file until it passes.
Reviewed by AI, one file at a time
After the virus scan, the file goes to Anthropic's Claude API, which says whether it supports the control.
- We send one file and one control at a time, never another company's data.
- Anthropic is our processor under its data processing addendum. It does not train its models on what we send, and by default deletes it within 30 days.
- We do not keep the file text after the review. We keep only the verdict and the reason.
- You can ask for a human review of any verdict: tick "I disagree" and say why.
- AI Use Policy draft: we send your five answers, your approved and banned tools, and staff survey totals (tool names, counts, data types, ratings). We never send what staff wrote in their own words.
- Advisor questions: we send your question, your recent advisor messages, and a summary of your controls, reviews, plan, and Shadow AI survey totals. We never send your files or staff survey comments.
- Tool names that staff typed under “Other” are included in both cases.
Never shown, only downloaded
Your browser never displays an uploaded file on our site. Files leave only as downloads, so an uploaded file can never run as a page.
A fingerprint on every file
Each file gets a time stamp and a SHA-256 fingerprint. You can prove later that a file is the one you uploaded, unchanged.
In plain words: each file gets a unique code. If the file changes, the code changes.
Connected services
Read-only, and only what a control needs
A company can connect Microsoft 365 or Google Workspace. The app asks for read-only permissions: users and admin roles, MFA and sign-in settings, the last sign-in of each account, and the devices with their disk encryption. Email authentication (SPF, DKIM, DMARC) is read from public DNS. Nothing in the app can change a setting in your tenant.
In plain words: we can look at your security settings. We cannot touch them.
No passwords, no refresh tokens
For Microsoft 365 we store only your tenant ID; the app reads as itself, with one credential kept as a server secret. For Google Workspace we store your customer ID, your domain, and the email of the admin who connected; access comes from the domain-wide delegation that your super admin grants and can delete. Only an owner can connect, and the admin who approves must hold an admin role, so nobody can connect a tenant that is not theirs.
In plain words: we keep no key to your accounts. Your admin can remove our access at any time.
Facts, never verdicts
Each reading is a plain-text file of facts, saved as evidence with a fingerprint like an upload. It goes through the same automatic review and analyst review. A setting the app could not read says "could not read", never "none".
Changes are flagged, not acted on
The settings are read again every day. When a control that an analyst accepted changes, its status, the sign-off, and any certificate stay as they are. The analyst and the company get an email, and the analyst decides.
Your record
Append-only trail
Evidence, review notes, and the activity record are only ever added to. The application has no function that edits or deletes them.
In plain words: records can be added, but the app never changes or erases them.
One company, one locker
Every record carries the key of its company. A client account reads and writes only its own company. Each request is checked on the server, not in the page. If your plan comes from a partner, such as your broker or IT provider, the partner's staff see their own clients only, never another partner's.
In plain words: each company's records are kept apart. One company cannot see another's.
The server keeps the score
The readiness score is computed by the same code in your browser and on our server. An analyst cannot sign off an assessment unless the server agrees that the score is 75% or more with no critical gap.
In plain words: the score is worked out again on our server. A browser cannot make it look better than it is.
Your account
Passwords we cannot read
Passwords are stored as salted PBKDF2-SHA-256 hashes with 600,000 rounds. Session tokens and email links are stored as hashes too.
In plain words: we store only a scrambled form of each password. We cannot read the original, and neither can our staff.
Locked after wrong guesses
Eight wrong passwords from one network lock an email address on that network for 15 minutes, and 50 from all networks lock it everywhere. Someone who knows your email cannot lock you out from your own network. Sign-in answers the same way for a known and an unknown email.
In plain words: too many wrong passwords lock the account for 15 minutes, so guessing does not work.
Two-step sign-in
Every account can add a second step: a 6-digit code from an authenticator app. Every PolicyReadiness analyst must use it, because analysts see client evidence. The secret behind the codes is stored encrypted.
In plain words: an app on your phone makes a new 6-digit code each time you sign in.
Confirmed email first
No account can read or write company data until its email address is confirmed. A password reset signs out every device.
In plain words: you must click the link we email you before you can use your company's data.
The platform
Cloudflare, end to end
The site and the API run on Cloudflare Workers. Records live in Cloudflare D1 and files in Cloudflare R2. Only the application can reach the database, the file store, and the scanner.
In plain words: our site, our database, and our file storage all run on Cloudflare's servers.
HTTPS only
All traffic is encrypted with HTTPS, enforced with HSTS. A content security policy, framing protection, and a same-origin rule for every write guard the pages.
In plain words: data travels in locked form between your browser and us, and your browser is told to accept only that.
Built on certified infrastructure
The companies that run our platform each hold their own audits and certifications. Those cover their services, not PolicyReadiness: we have not had our own SOC 2 audit. Each link goes to that company's own page.
Cloudflare
Runs the site, the database, and file storage. SOC 2 Type II and ISO 27001.
Anthropic
Runs the AI review. SOC 2 Type II, ISO 27001, and ISO/IEC 42001 for AI management.
Stripe
Takes payments. PCI DSS Service Provider Level 1 and SOC 2 Type II. Card numbers go to Stripe and never reach us.
In plain words: our providers passed their own security audits. We chose them for that, and we name them so you can check.
Found a security problem?
Write to support@policyreadiness.com with the steps to see it. Our contact details for researchers are also in security.txt.
See it with sample data.
The live demo is a read-only sample company. No account is necessary.