You're trusting us with your management system. Here's how we look after it.
Your policies, risks and audit findings are some of the most sensitive documents your organisation holds. This page sets out, plainly, what we do to protect them — and what we don't yet claim.
Every record belongs to one organisation
StayEvident is multi-tenant with row-level isolation. Every query is scoped to your current organisation, and the scope fails closed: with no organisation in context, nothing is returned — never everything. Isolation between organisations is covered by automated tests that run on every change.
An immutable record of change
Material changes are recorded with what changed, who changed it, when, and from which IP address and browser. That includes AI verdicts and the human decisions on them, evidence links and register updates.
Least privilege by role
Four roles — owner, admin, member and a read-only auditor. Only owners and admins can invite people, manage members, change billing or switch modules on and off. Your external auditor never needs edit rights.
Two-factor authentication
Sign in with email and password or Google. Turn on two-factor authentication with any authenticator app, with recovery codes for a lost device. Email addresses are verified before use.
AI proposes. People decide. Nothing trains on your content.
- ✓Excerpts of your documents are sent to our AI providers only to assess them against the clauses you have in scope, and to index them for search.
- ✓Your content is never used to train models — ours or anyone else's.
- ✓AI output is a proposal. Every verdict is confirmed or overridden by a person in your organisation, and the original AI verdict is kept beside the decision.
- ✓AI-proposed evidence stays "proposed" until someone confirms it. Only confirmed evidence reaches your audit pack.
Subprocessors
The third parties that process data on our behalf. Contact us for regions and transfer safeguards.
What we don't claim yet
We'd rather be precise than impressive. StayEvident does not currently hold an independent security certification, and we don't yet offer SAML single sign-on or a guaranteed data-residency region. If any of these are a requirement for you, tell us — it directly shapes what we build next.
Security questions or disclosures
Completing a supplier security questionnaire, or found a vulnerability? Email hello@stayevident.com. We'll respond to questionnaires and acknowledge responsibly disclosed issues promptly. See also our privacy policy.
Stop dreading audit season.
Upload your documents, adopt a standard, and see clause-by-clause coverage — including the gaps you didn't know about.