Your management system, governed
One controlled library for the policies, standards and procedures behind ISO 27001, ISO 9001, SOC 2 and the rest of your framework. Written by the people who own them, changed only with the approvals you set, and published to everyone who has to read them.
Single sign-on · role-based access · full audit trail · your own domain
For the documented information behind
- ISO 27001
- ISO 9001
- ISO 14001
- ISO 45001
- SOC 2
- NIST CSF
- …and your own
Three tools and a spreadsheet
Nothing here is anyone's fault. A policy library grows into the tools that were to hand, and by the time it matters the pieces no longer join up.
Where the documents live
A folder of Word files, a wiki page, a copy on the intranet and a PDF someone emailed round. Everyone reads whichever one they found first.
How they change
The edit happens in a shared drive. The approval happens in an email thread. The two are never joined back together, so the record of why a clause says what it says is gone.
What the auditor asks
“Show me the version in force in March, who approved it, and what changed since.” A fortnight goes into reconstructing an answer that should have been a click.
An editor your policy owners will use
Policy owners write in sections, not files. Headings, tables, callouts and cross references are all in the toolbar. Clause numbering comes from where a section sits, so inserting a clause at 3.2 renumbers everything below it, and every reference that pointed there still points there.
- Templates for policies, supporting policies, standards and procedures, editable by your administrators rather than fixed by us
- Cross references that point at a section rather than a page number, so they survive renames and reordering
- Sections can be marked internal and kept out of the catalog and every export
- Optional AI help getting a document started, off until you turn it on
Nobody starts from a blank page
The reason a policy sits unwritten for a year is rarely that nobody knows what it should say. It is that nobody wants to start it. Two ways not to.
- Draft it from a brief. Describe what the document needs to cover, in your own words, and get a complete draft with sections, numbered requirements and a table of responsibilities. Where it was not told a specific, it leaves a marked gap for you to fill rather than inventing a system name or a control reference.
- Bring in what you already have. A Word file or a PDF comes back as a structured document, with the cover page and the running headers left behind. Most organisations have a library already. This is how it gets in.
Both produce a proposal, not a document. You read it, and nothing exists until you accept it. From there it is an ordinary draft, and it reaches the library the same way everything else does, through the approvals you set.
All of it is optional. The AI features are off until an administrator turns them on, and can be switched off again for the whole organisation at any time. With them off, Imsenta is the authoring, governance and publishing system described on the rest of this page, and no document content is sent to a model.
If your organisation already runs its own AI service, we can point Imsenta at that instead, so the text never leaves an estate you control. Ask during onboarding.
Change that has to be approved
Nothing reaches the library by being saved. An edit becomes a change request: a rationale, the proposed text, and a diff against the version in force. Reviewers discuss it, request changes or approve it, and the rule for merging is yours to set.
- How many approvals, and which roles they have to come from
- Authors cannot approve their own change
- Approvals are cleared if the proposal moves after they were given, so nothing merges on a stale sign-off
- Declined requests keep their discussion and can be picked up again later
Evidence without assembling it
Every issue is kept whole and unchangeable. Compare any two of them clause by clause: sections are matched by identity, so a renamed heading reads as renamed and a moved clause reads as moved, instead of a wall of deletions and insertions you have to interpret.
- Inline or side by side, as structured clauses or as raw Markdown
- Additions, deletions, edits, renames and moves each labelled as what they are
- Who changed what, who approved it, and the date it took effect
- Restore any earlier issue into a new draft without losing the ones after it
Everyone reading the version in force
The catalog shows published documents and nothing else, searchable by title, type and tag, with a PDF whenever anyone needs one. Give it its own address, put your logo and colour on it, and let people in with the sign-on they already use. It is read-only in the API, not merely in the interface.
Its own address
northwind.imsenta.com, or
your own policies.northwind.com
pointed at us with a CNAME.
Behind your sign-on
Readers arrive, authenticate with your identity provider and see the library. No second account to create, no password to reset.
Published only
Drafts, proposals and internal-only sections never appear. A document under review still shows the issue that is actually in force.
Your policies leave in the shape they arrived
Documents are held as structured content and projected to Markdown with YAML front matter: deterministic, diffable, and perfectly readable without Imsenta. Take one document or the whole library, whenever you like. The PDF template is yours to design: cover page, logo, colours, headers, footers and the wording of the furniture.
- Markdown with YAML front matter
- PDF to your own template
- Word .docx, for people who insist
- Bundle the whole library as a zip
Written to be handed to your security reviewer
The questions your InfoSec team will ask have answers on one page, with the design decisions behind them rather than a badge.
Single sign-on
OpenID Connect, authorisation code with PKCE, asymmetric signatures only. Any provider that implements OIDC discovery.
Roles that mean something
Owner, administrator, author, reviewer and reader map onto a capability matrix checked on the server for every request.
One organisation cannot see another
Tenancy is resolved from the session and the hostname, and applied in the data layer rather than in the interface.
Audit trail
Who did what, to which document, when. Kept as a matter of course rather than switched on for an audit.
Run on AWS
Nothing to install, patch or back up. The physical and infrastructure controls beneath us are Amazon’s, audited on a scale no policy tool could match on its own.
Yours to take back
Export the whole library whenever you like, in formats that outlive us. Hosting your policies is not the same as holding them hostage.
Questions we are asked
Do our policy owners have to learn Markdown?
No. They see an editor with headings, lists, tables and a cross reference button. Markdown is how the content is stored and exported, not how it is written, the same way nobody writing a document thinks about the file format underneath it.
Can we bring our existing policies in?
Yes. Hand it a Word file, a PDF, Markdown or the text pasted straight in, and it comes back as a structured document: sections, subsections, clause numbering, tables and lists. Cover pages, running headers and revision-history tables are left behind, because that furniture belongs in metadata rather than in the policy. Nothing is created until you have read it and accepted it. Importing uses the AI features, so it is available only while those are switched on.
If you would rather not do it yourself, we offer a managed onboarding service: give us the library you have and we will bring it in, structured, checked against your originals and ready for your owners to review. Ask about it when you book a walkthrough.
Which identity providers work?
Any that implements OpenID Connect discovery, which includes Microsoft Entra ID, Okta, Google Workspace, Keycloak and Auth0. You give us the issuer URL and a client; there is no per-provider integration to wait for.
Is our content sent to an AI model?
Only if you use the AI features. When you draft from a brief or import a document, the text involved is sent to OpenAI to be processed and the result comes back to you. Nothing else is sent, and nothing is sent in the background. The AI features are off until an administrator turns them on and can be switched off for the whole organisation, in which case no document content is sent to a model at all. Organisations that run their own AI service can have Imsenta use that instead, in which case the text goes there rather than to OpenAI. Ask about it during onboarding.
What happens if we stop using Imsenta?
You export the library as Markdown, PDF, Word or a zip of all three, and it is readable in any editor afterwards. There is no proprietary format holding the content, and no need to ask us for it.
Where is our data hosted?
In the region you choose when your organisation is set up: the United States, the United Kingdom (London), Germany (Frankfurt) or Australia (Sydney). Your policies, versions and audit log stay in that region. It is where the data lives, not merely where you reach it from.
See it against your own policies
Bring one of your real documents. We will put it in, propose a change to it, approve it and publish it, so you can judge the workflow on something you recognise rather than a demo library.