- Home
- Policy Management Software
- Policyflow
Policyflow
What it is
Policyflow is a web service for distributing policies, tracking confirmations by document version, and exporting evidence for auditors. Its policy builder uses a clause library and tracks clause coverage while users draft. Uploaded PDFs are processed into editable requirement passages while retaining their original wording. Reviewers can approve drafts in sequence, with sign-offs and later confirmations linked to a specific version. Campaigns send recipients personal, single-use email links that do not require an account or installation. Evidence exports include PDF certificates and CSV logs with version and timestamp details. Policyflow lists Azure AD and Google Workspace directory sync, plus single sign-on through Microsoft and Google. Its acknowledgement-evidence use cases include ISO 27001, SOC 2, GDPR, NIS2, DORA, and HIPAA. The free plan has no time limit and supports teams of up to 15 employees. Core costs €155 a month when billed annually for up to 250 covered people, with 10 admin seats. Custom pricing is listed for organizations above 2,500 employees or with non-standard requirements. The Trust Center says the service is not ISO 27001 certified and does not currently have a SOC 2 Type II report.
For and against
For
- Free plan has no time limit.
- Single-use email links need no account or installation.
- Exports evidence as PDF certificates or CSV logs.
- Tracks approvals and confirmations by version.
- Lists Microsoft and Google single sign-on.
Against
- Free plan supports up to 15 employees.
- Core costs €155 a month billed annually.
- No free trial is listed.
- Not ISO 27001 certified and has no SOC 2 Type II report.
The verdict
Policyflow combines policy drafting, version-specific approvals, distribution, and evidence exports. Teams should note the free-plan employee cap and the stated certification and report status.
Who it suits
Policyflow suits teams that distribute policies, collect version-specific confirmations, and prepare audit evidence. The free plan is limited to teams of up to 15 employees; Core covers up to 250 people.
Plans and prices
Free
Up to 15 employees · unlimited policies · full version history · audit-ready exports
Read 15 Oct 2026 · policyflow.app
Core
Up to 250 covered people · 10 admin seats · approvals · targeting
Read 15 Oct 2026 · policyflow.app
Custom
Above 2,500 employees or non-standard requirements · volume pricing · contract/security/DPA review · invoice or purchase-order billing
Read 15 Oct 2026 · policyflow.app
On the record
- AI assistant
- The Compliance feature set includes an AI policy assistant.policyflow.app · read 15 Oct 2026
- Approvals and versioning
- Reviewers can approve drafts in sequence, with each sign-off and later confirmation tied to a specific document version.policyflow.app · read 30 Sep 2026
- Approval workflows
- Drafts can pass through sequential reviewers, with each approval recorded against the relevant document version.policyflow.app · read 15 Oct 2026
- Attestation security
- Attestation tokens are cryptographically signed and capture policy version, recipient, timestamp and IP.policyflow.app · read 15 Oct 2026
- Audit log
- Uploads, edits, approvals, deliveries, attestations, exports and administrative actions are recorded in an immutable activity log.policyflow.app · read 15 Oct 2026
- Availability limitation
- The Terms say uninterrupted access is not guaranteed and the service is provided as-is.policyflow.app · read 15 Oct 2026
- Campaigns
- Campaigns target groups, show progress and share a deadline for related policies.policyflow.app · read 15 Oct 2026
- Certification limit
- Policyflow states it is not ISO 27001 certified and has no SOC 2 Type II report.policyflow.app · read 15 Oct 2026
- Certification status
- The Trust Center says its GDPR, ISO 27001, and SOC 2 controls are self-assessed or aligned, and Policyflow is not ISO 27001 certified and does not currently have a SOC 2 Type II report.policyflow.app · read 30 Sep 2026
- Compliance mapping
- Core includes ISO 27001:2022 mapping, a compliance calendar, scheduled reports, manager escalation and an auditor portal.policyflow.app · read 15 Oct 2026
- Data export
- Administrators can export policies, attestations, audit logs and files as a dated TAR archive with credentials redacted.policyflow.app · read 15 Oct 2026
- Developer API
- No public API reference, SDK or developer documentation was found; the Trust Center only mentions encrypted storage of API keys.policyflow.app · read 15 Oct 2026
- Distribution
- Campaigns send recipients personal, single-use email links that do not require an account or installation.policyflow.app · read 30 Sep 2026
- Encryption
- Traffic uses TLS 1.2 or newer with HSTS, while databases and file uploads use AES-256 encryption at rest.policyflow.app · read 15 Oct 2026
- Evidence exports
- The service exports a summary PDF certificate and a row-level CSV containing policy version and timestamps.policyflow.app · read 15 Oct 2026
- Evidence limitation
- The vendor says an acknowledgement proves delivery and confirmation of a specific version but not reading, understanding, later compliance, legal identity or certification sufficiency.policyflow.app · read 15 Oct 2026
- Frameworks
- The product describes acknowledgement evidence use cases for ISO 27001, SOC 2, GDPR, NIS2, DORA and HIPAA.policyflow.app · read 15 Oct 2026
- GRC limitation
- The SOC 2 guide says Policyflow is not a full GRC platform, does not map Trust Services Criteria or run control testing, and does not replace an auditor.policyflow.app · read 15 Oct 2026
