Skip to content
SPECIFICTION
Get listed

Policyflow

policyflow.app

From €155/mo Free plan Web
Visit policyflow.app
Spec score 8.4 #4 of 23 in HR Policy Management Software

What it is

Policyflow is a web service for distributing policies, recording confirmations for each document version and exporting auditor evidence. Its builder uses a clause library and tracks clause coverage during drafting. Uploaded PDFs become editable requirement passages while retaining their original wording. Reviewers can approve drafts in sequence, with sign-offs and later confirmations tied to specific versions. Campaigns send personal, single-use email links, so recipients need no account or installation. Evidence exports include PDF certificates and CSV logs with version and timestamp details. Policyflow lists Azure AD and Google Workspace directory synchronization, plus Microsoft and Google single sign-on. Its acknowledgement-evidence use cases include ISO 27001, SOC 2, GDPR, NIS2, DORA and HIPAA. The free plan costs nothing, has no time limit and supports up to 15 employees. Core costs €155 a month when billed annually for up to 250 covered people. The Trust Center says its controls are self-assessed or aligned, and that Policyflow is not ISO 27001 certified and has no SOC 2 Type II report.

Spec sheet

What it does
Policyflow lets organisations draft, approve, distribute and track employee policy attestations, then export evidence.Read 15 Oct 2026 · policyflow.app
Purpose
Policyflow distributes policies, records who confirmed each version, and exports evidence for auditors.Read 30 Sep 2026 · policyflow.app
Integrations
Directory synchronisation is offered for Azure AD and Google Workspace, with SSO through Microsoft and Google.Read 15 Oct 2026 · policyflow.app
Support
The pricing page lists email support for Core and gives [email protected] as the contact address.Read 30 Sep 2026 · policyflow.app
AI assistant
The Compliance feature set includes an AI policy assistant.Read 15 Oct 2026 · policyflow.app
Approval workflows
Drafts can pass through sequential reviewers, with each approval recorded against the relevant document version.Read 15 Oct 2026 · policyflow.app
Approvals and versioning
Reviewers can approve drafts in sequence, with each sign-off and later confirmation tied to a specific document version.Read 30 Sep 2026 · policyflow.app
Attestation security
Attestation tokens are cryptographically signed and capture policy version, recipient, timestamp and IP.Read 15 Oct 2026 · policyflow.app
Audit log
Uploads, edits, approvals, deliveries, attestations, exports and administrative actions are recorded in an immutable activity log.Read 15 Oct 2026 · policyflow.app
Availability limitation
The Terms say uninterrupted access is not guaranteed and the service is provided as-is.Read 15 Oct 2026 · policyflow.app
Campaigns
Campaigns target groups, show progress and share a deadline for related policies.Read 15 Oct 2026 · policyflow.app
Certification limit
Policyflow states it is not ISO 27001 certified and has no SOC 2 Type II report.Read 15 Oct 2026 · policyflow.app
Certification status
The Trust Center says its GDPR, ISO 27001, and SOC 2 controls are self-assessed or aligned, and Policyflow is not ISO 27001 certified and does not currently have a SOC 2 Type II report.Read 30 Sep 2026 · policyflow.app
Compliance mapping
Core includes ISO 27001:2022 mapping, a compliance calendar, scheduled reports, manager escalation and an auditor portal.Read 15 Oct 2026 · policyflow.app
Data export
Administrators can export policies, attestations, audit logs and files as a dated TAR archive with credentials redacted.Read 15 Oct 2026 · policyflow.app
Developer API
No public API reference, SDK or developer documentation was found; the Trust Center only mentions encrypted storage of API keys.Read 15 Oct 2026 · policyflow.app
Distribution
Campaigns send recipients personal, single-use email links that do not require an account or installation.Read 30 Sep 2026 · policyflow.app
Encryption
Traffic uses TLS 1.2 or newer with HSTS, while databases and file uploads use AES-256 encryption at rest.Read 15 Oct 2026 · policyflow.app
Evidence exports
The service exports a summary PDF certificate and a row-level CSV containing policy version and timestamps.Read 15 Oct 2026 · policyflow.app
Evidence limitation
The vendor says an acknowledgement proves delivery and confirmation of a specific version but not reading, understanding, later compliance, legal identity or certification sufficiency.Read 15 Oct 2026 · policyflow.app
Frameworks
The product describes acknowledgement evidence use cases for ISO 27001, SOC 2, GDPR, NIS2, DORA and HIPAA.Read 15 Oct 2026 · policyflow.app
GRC limitation
The SOC 2 guide says Policyflow is not a full GRC platform, does not map Trust Services Criteria or run control testing, and does not replace an auditor.Read 15 Oct 2026 · policyflow.app
Hosting
Primary customer data is hosted in Supabase Postgres in Frankfurt, with application delivery through a Vercel EU deployment and global CDN.Read 15 Oct 2026 · policyflow.app
Hosting and encryption
The Trust Center states primary data is hosted in the EU, with TLS 1.2+ in transit and AES-256 encryption at rest.Read 30 Sep 2026 · policyflow.app
Independent integrations listing (different insurance product)
GetApp lists Feefo, QuickBooks Online Advanced, Trustpilot and Xero for its separate insurance Policyflow product.Read 15 Oct 2026 · getapp.com
Independent pricing listing (different insurance product)
Capterra lists that separate insurance product from £135 per user per month and says a free trial is available.Read 15 Oct 2026 · capterra.com
Independent review status (different insurance product)
Software Advice says its separate insurance Policyflow profile has no reviews and starts at £70 per user per month.Read 15 Oct 2026 · softwareadvice.com
Licence
The Terms grant a limited subscription right and prohibit reverse engineering, decompiling and source-code extraction, indicating proprietary closed-source software.Read 15 Oct 2026 · policyflow.app
Maker structure
Applikeable describes itself as a one-person app studio based in Copenhagen, with two apps shipping in 2026.Read 15 Oct 2026 · applikeable.com
Maker support
Applikeable says product support is handled by email and usually receives a same-day reply.Read 15 Oct 2026 · applikeable.com
Notable limit
The free offering is limited to teams of up to 15 employees, and Custom is presented for organizations above 2,500 employees or with non-standard requirements.Read 30 Sep 2026 · policyflow.app
PDF import
Uploaded PDFs are converted into editable requirement passages while retaining the original wording and downloadable source.Read 15 Oct 2026 · policyflow.app
Policy authoring
Its policy builder uses a clause library and tracks clause coverage as users draft.Read 30 Sep 2026 · policyflow.app
Policy builder
Its builder provides an ISO 27001 clause library, tracks clause coverage and reuses approved wording.Read 15 Oct 2026 · policyflow.app
Praise: independent review availability
GetApp reports no user reviews for its separate insurance Policyflow listing, so it supplies no independent praise or complaint evidence for policyflow.app.Read 15 Oct 2026 · getapp.com
Rating on Capterra (different insurance product)
0.0 out of 5 from 0 reviews; Capterra describes a UK insurance policy administration product unrelated to policyflow.app.Read 15 Oct 2026 · capterra.com
Rating on GetApp (different insurance product)
0 out of 5 from 0 reviews; the listing is for a UK insurance broker system, not the policyflow.app compliance product.Read 15 Oct 2026 · getapp.com
Recipient access
Recipients confirm through personal single-use browser links without accounts, passwords or installations.Read 15 Oct 2026 · policyflow.app
Reminders
Automated reminders are sent only to people who have not yet confirmed, with optional escalation.Read 15 Oct 2026 · policyflow.app
Retention
Account data lasts through the subscription plus 30 days, while policy versions, attestations and audit logs are retained for the subscription life.Read 15 Oct 2026 · policyflow.app
Roles
Role-based permissions include Admin, Editor, Approver and Viewer roles.Read 15 Oct 2026 · policyflow.app
Security alignment
The Trust Center describes GDPR, ISO 27001 and SOC 2 controls as self-assessed or aligned rather than certified.Read 15 Oct 2026 · policyflow.app
Self-hosting
No self-hosted deployment option is described on the product, security or terms pages.Read 15 Oct 2026 · policyflow.app
Tenant isolation
Every tenant table uses PostgreSQL row-level security to isolate organisations.Read 15 Oct 2026 · policyflow.app
Version control
Published policy versions are immutable, and later confirmations remain tied to the version recipients received.Read 15 Oct 2026 · policyflow.app

Plans and prices

Free Free No time limit; no card required Up to 15 employees · unlimited policies · full version history · audit-ready exports Read 15 Oct 2026 · policyflow.app
Core €155 a month Billed annually; page says €155/ mo Up to 250 covered people · 10 admin seats · approvals · targeting · reminders · templates · RBAC · directory sync · SSO · email support Read 15 Oct 2026 · policyflow.app
Custom Priced on request Contact vendor Above 2,500 employees or non-standard requirements · volume pricing · contract/security/DPA review · invoice or purchase-order billing Read 15 Oct 2026 · policyflow.app

Every Policyflow plan and price →

Strong points and limits

Strong points

  • Single-use links need no recipient account
  • Versioned approvals and confirmations
  • PDF and CSV evidence exports
  • Directory sync and single sign-on
  • Unlimited policies on Free

Limits

  • Free plan limited to 15 employees
  • Core costs €155 a month annually
  • No free trial
  • Not ISO 27001 certified

Who it suits

Policyflow suits organizations distributing internal policies and needing version-specific acknowledgement evidence. The free plan fits teams of up to 15 employees; larger teams can consider Core or Custom.

Verdict

Policyflow focuses on policy drafting, controlled distribution and audit-ready confirmation records. Check employee limits, annual billing and the stated certification status against your compliance requirements.

Where Specifiction places it

Alternatives to PolicyflowAll alternatives →