A version history your examiner can actually defend.
Draft, approve, and publish policies in one place. The moment you publish, the version locks and cannot be edited, so your examiner sees exactly what shipped, when, and who signed off. Effy drafts from your controls to get you off the blank page.
Policy work, end to end.
AI-assisted drafting
Effy generates first drafts from your existing controls, framework requirements, and prior policy versions. Review, edit, route. Never start from a blank page.
- Draft from controls or framework requirements
- Inline citations to source artifacts
- Reviewer overrides AI suggestions, always
Approval workflow
Configurable approval chain: single approver, sequential, or parallel. Named reviewers, timestamps, and comments captured on every decision. SLA tracking for stalled approvals.
- Configurable approval chains
- Named reviewers with comment trail
- SLA alerts on stalled approvals
Immutable PolicyVersion on publish
When a policy publishes, a PolicyVersion record locks. Drafts and approved-but-unpublished content stay separate. Auditors see exactly what was published, when, and by whom.
- PolicyVersion locks at publish
- Drafts isolated from published artifacts
- AuditLog captures every change
Three steps from setup to value.
Draft
Start from a template, an existing policy, or have Effy generate one from your controls. Cite sources inline as you write.
Approve
Route through your approval chain. Reviewers comment, edit, or approve in-platform. Activity log captures every step.
Publish + lock
On publish, an immutable PolicyVersion record is created. The published artifact is permanently fixed for audit reference.
Frequently asked questions
What happens when a published policy needs to change?
The published version stays as it is. An immutable PolicyVersion record is created at publish and cannot be edited. Changes are made on a new draft, which goes through submit and approve again and creates a new PolicyVersion when it is published. The earlier version remains on record for audit reference.
What are the stages of the policy lifecycle?
A policy moves through five stages: draft, submit, approve, publish, and retire. Draft content stays on the working policy while it is being written and reviewed. The locked version record is created only at publish, never at submission or approval, so an unapproved draft cannot be mistaken for the policy in force.
Can our auditor see policies without being able to edit them?
Yes. The AUDITOR role is read-only across the platform and enforced on the server, not only in the interface. An auditor can read policies, leave reviewer comments, and submit reviews. They cannot create, edit, or delete a policy, so giving an auditor access does not put the record at risk.
How does AI help write policies?
The AI assistant generates a first draft from your controls and flags gaps where a policy does not line up with the controls it should support. The draft is a starting point. It goes through the same submit and approve steps as any policy, and nothing is published until your approvers sign off.
Are policies connected to controls and frameworks?
Yes. Policies are linked to the controls they support, and those controls are cross-mapped across the ten built-in frameworks. One policy can therefore back requirements in several frameworks. Your policies also feed the questionnaire engine, which cites them when it drafts answers to customer security questionnaires.