Security & Trust
Last updated: 5 November 2026
This page describes what Policynez does today to protect company and employee information. Each section is marked In place, Partial or Not yet. We only list controls that are actually running; anything planned is described as not yet available.
How company data is kept separate
- Every company gets its own workspace. Every policy, version, acknowledgement, receipt, reading record, notification, invitation, AI usage record and chat integration is tagged with that workspace.
- The database itself checks the workspace on every read and write, through a mandatory isolation rule that sits on top of all other access rules. Even if another rule were written too broadly, it could not return another company's records.
- New records are stamped with the signed-in person's workspace by the database, not by the browser, so a modified app cannot file data into another company.
- Each person belongs to one workspace. Their role (owner, HR admin or employee) is stored for that workspace only, so being HR in one company gives no rights anywhere else.
- Uploaded policy files are stored in folders named after the workspace, and storage rules refuse uploads or downloads outside your own folder. Files are shared through short-lived signed links.
- The AI assistant reads a policy using the employee's own permissions, so it can only answer from documents that person is already allowed to open.
- Platform support staff are listed separately from company roles. Their cross-company view is limited to account and usage summaries, and every request is checked on the server first.
Sign-in and SSO setup
- Built-in sign-in: Microsoft 365 and Google Workspace work straight away. Personal Gmail and Outlook accounts are refused.
- Domain lock: in HR Admin → Settings, list the email domains that belong to your company. Anyone signing in from another domain is blocked by the database.
- Company SSO: in HR Admin → Settings → Single sign-on, choose Okta, Microsoft Entra ID, Ping or another SAML 2.0 / OpenID Connect provider, and enter the details from your identity provider.
- Activation: we review each SSO connection by hand and switch it on, usually within one business day. Your IT team keeps control of joiners, leavers and multi-factor authentication in your identity provider.
- Automatic user syncing (SCIM) is not available yet. Remove leavers in your identity provider and in HR Admin → People.
Data privacy statement
- Your company owns its policies and acknowledgement records. Intellinez Systems Private Limited processes them only to run Policynez for you.
- We collect only what the service needs: name, work email, company, role, the policies people read and confirm, reading time, and AI questions on the Core + AI plan.
- We do not sell personal data, show advertising, or use customer content to train AI models.
- We use only essential cookies and browser storage needed for sign-in. There are no advertising or cross-site tracking cookies.
- People can ask their employer, or us, to see, correct or delete their personal data. Acknowledgement receipts may be kept while the workspace is active because they serve as legal proof for the employer.
Full details are in our Privacy Policy.
Compliance at a glance
EU / UK GDPRPartial
We act as a processor for your company's employee data and support access, correction, export and deletion requests. A standard Data Processing Agreement is available on request. Data is hosted in Singapore, so transfers from the EU/UK rely on contractual safeguards that we put in place with each customer.
India DPDP Act 2023In place
Our privacy policy follows the Digital Personal Data Protection Act. Intellinez is an Indian company, and Indian law governs our terms.
US privacy laws (e.g. CCPA/CPRA)Partial
We act as a service provider, do not sell or share personal information for advertising, and handle deletion and access requests on behalf of customers.
Payment card security (PCI DSS)In place
Payments are taken by Paddle as Merchant of Record. Card details go straight to Paddle, which is PCI DSS compliant, and never touch Policynez servers.
SOC 2 / ISO 27001Not yet
Policynez is not certified and no audit has started. See SOC 2 status below.
HIPAANot yet
Policynez is not designed to hold health records and we do not sign Business Associate Agreements.
Service providers we use
| Provider | Purpose | Location |
|---|---|---|
| Lovable Cloud (managed infrastructure) | Database, file storage, sign-in, hosting | Singapore + global edge |
| Lovable AI Gateway / OpenAI | Policy assistant answers (Core + AI only) | United States |
| Paddle | Checkout, invoices, tax, Merchant of Record | United Kingdom / global |
| Microsoft, Google | Sign-in, if your company uses them | Global |
| Email delivery service | Policy and invitation emails from notify.policynez.com | Global |
| Slack, Microsoft Teams | Channel messages, only if HR connects them | Global |
Control-by-control status
Hosting location
In place- The application database, file storage and sign-in service run on managed cloud infrastructure in the Asia-Pacific (Singapore) region.
- Web pages and server functions are served from a global edge network, so requests may be handled close to the visitor before reaching the Singapore data store.
- Choosing a different data region per customer is not available yet.
Encryption
In place- All traffic to policynez.com is served over HTTPS; plain HTTP requests are redirected to HTTPS.
- Stored data relies on the encryption at rest provided by our hosting provider. We do not add our own field-level encryption on top of it.
- Every acknowledgement records a SHA-256 fingerprint of the exact document confirmed, so later changes to a file can be detected.
AI provider
In place- The optional policy assistant (Core + AI plan) sends the employee's question and the text of the policy they are reading to an OpenAI model through the Lovable AI Gateway.
- Requests are made from our server, never from the browser, and only for policies the employee is already allowed to read.
- Usage is capped per employee and per company each month. Workspaces on the Core plan do not send any data to the AI provider.
Model training
Partial- Policynez does not use customer documents, questions or answers to train or fine-tune any AI model.
- Data sent to the AI provider is handled under that provider's business terms. We have not yet published a signed confirmation of the provider's training and retention settings — ask us for the current position.
Access controls
In place- Sign-in is through Microsoft 365, Google Workspace or company single sign-on; there are no Policynez passwords. Personal Gmail accounts are blocked.
- Each company can restrict sign-in to its own email domains, enforced in the database.
- Every company's data is separated by workspace, and database-level access rules check each record on every request.
- Roles (owner, HR admin, employee) are stored per company. Only HR can publish policies or view reports.
- Company SSO (SAML / OIDC) setup is available; each connection is activated after a manual review.
- Multi-factor authentication is handled by your identity provider; Policynez does not enforce it separately.
Backups
Partial- Backups of the database are managed by our hosting provider.
- Point-in-time recovery is not enabled, and we have not yet run or documented a restore test. Uploaded policy files are not separately backed up.
Testing
Partial- Key rules — acknowledgement status, receipts, reading engagement, pricing and AI limits — are covered by automated tests.
- We run automated security and dependency scans and fix reported issues.
- No independent penetration test has been carried out yet.
Retention
Partial- Policy versions and acknowledgement receipts are kept for as long as the company's workspace is active, so they can serve as proof.
- There are no configurable or automatic retention periods yet.
Export
In place- HR can download acknowledgement receipts as PDF and export confirmation records as CSV, per policy.
- A full one-click export of an entire workspace is not available yet; we can provide one on request.
Deletion
Not yet- HR can remove individual policies and users, but there is no self-service way to delete a whole workspace.
- Workspace deletion is handled on request through our contact form. We have not yet published a fixed deletion timeline.
SOC 2 status
Not yet- Policynez is not SOC 2 certified and no SOC 2 audit has been started or completed.
- Several controls follow SOC 2 patterns (role separation, per-record access checks, delivery logs), but this is not a certification or attestation. We do not claim ISO 27001, HIPAA or other certifications either.
Reporting a security concern
If you believe you have found a vulnerability or need our security questionnaire answered, contact us through the form on policynez.com. Please don't publicly disclose an issue before we have had a chance to look at it.