Your management system, governed
One controlled library for the policies, standards and procedures behind ISO 27001, ISO 9001, SOC 2 and the rest of your framework. Written by the people who own them, changed only with the approvals you set, and published to everyone who has to read them.
Single sign-on · role-based access · full audit trail · self-hosted or run for you
For the documented information behind
- ISO 27001
- ISO 9001
- ISO 14001
- ISO 45001
- SOC 2
- NIST CSF
- …and your own
Three tools and a spreadsheet
Nothing here is anyone's fault. A policy library grows into the tools that were to hand, and by the time it matters the pieces no longer join up.
Where the documents live
A folder of Word files, a wiki page, a copy on the intranet and a PDF someone emailed round. Everyone reads whichever one they found first.
How they change
The edit happens in a shared drive. The approval happens in an email thread. The two are never joined back together, so the record of why a clause says what it says is gone.
What the auditor asks
“Show me the version in force in March, who approved it, and what changed since.” A fortnight goes into reconstructing an answer that should have been a click.
An editor your policy owners will use
Policy owners write in sections, not files. Headings, tables, callouts and cross references are all in the toolbar. Clause numbering comes from where a section sits, so inserting a clause at 3.2 renumbers everything below it — and every reference that pointed there still points there.
- Templates for policies, supporting policies, standards and procedures — editable by your administrators, not fixed by us
- Cross references that point at a section rather than a page number, so they survive renames and reordering
- Sections can be marked internal and kept out of the catalog and every export
- Optional AI drafting on your own OpenAI key — off unless you switch it on
Change that has to be approved
Nothing reaches the library by being saved. An edit becomes a change request: a rationale, the proposed text, and a diff against the version in force. Reviewers discuss it, request changes or approve it — and the rule for merging is yours to set.
- How many approvals, and which roles they have to come from
- Authors cannot approve their own change
- Approvals are cleared if the proposal moves after they were given, so nothing merges on a stale sign-off
- Declined requests keep their discussion and can be picked up again later
Evidence without assembling it
Every issue is kept whole and unchangeable. Compare any two of them clause by clause: sections are matched by identity, so a renamed heading reads as renamed and a moved clause reads as moved, instead of a wall of deletions and insertions you have to interpret.
- Inline or side by side, as structured clauses or as raw Markdown
- Additions, deletions, edits, renames and moves each labelled as what they are
- Who changed what, who approved it, and the date it took effect
- Restore any earlier issue into a new draft without losing the ones after it
Everyone reading the version in force
The catalog shows published documents and nothing else — searchable by title, type and tag, with a PDF whenever anyone needs one. Give it its own address, put your logo and colour on it, and let people in with the sign-on they already use. It is read-only in the API, not merely in the interface.
Its own address
northwind.imsenta.com, or
your own policies.northwind.com
pointed at us with a CNAME.
Behind your sign-on
Readers arrive, authenticate with your identity provider and see the library. No second account to create, no password to reset.
Published only
Drafts, proposals and internal-only sections never appear. A document under review still shows the issue that is actually in force.
Your policies leave in the shape they arrived
Documents are held as structured content and projected to Markdown with YAML front matter — deterministic, diffable, and perfectly readable without Imsenta. Take one document or the whole library, whenever you like. The PDF template is yours to design: cover page, logo, colours, headers, footers and the wording of the furniture.
- Markdown with YAML front matter
- PDF to your own template
- Word .docx, for people who insist
- Bundle the whole library as a zip
Written to be handed to your security reviewer
The questions your InfoSec team will ask have answers on one page, with the design decisions behind them rather than a badge.
Single sign-on
OpenID Connect, authorisation code with PKCE, asymmetric signatures only. Any provider that implements OIDC discovery.
Roles that mean something
Owner, administrator, author, reviewer and reader map onto a capability matrix checked on the server for every request.
One organisation cannot see another
Tenancy is resolved from the session and the hostname, and applied in the data layer rather than in the interface.
Audit trail
Who did what, to which document, when — kept as a matter of course rather than switched on for an audit.
Your infrastructure
One container and a volume, brought up with Docker Compose. SQLite to begin with, Postgres when you want it.
Nothing calls home
A self-hosted instance talks to your identity provider and nothing else, unless you switch on AI drafting with your own key.
Questions we are asked
Do our policy owners have to learn Markdown?
No. They see an editor with headings, lists, tables and a cross reference button. Markdown is how the content is stored and exported, not how it is written — the same way nobody writing a document thinks about the file format underneath it.
Can we bring our existing policies in?
Markdown imports directly, and comes back out identically — headings become sections and numbered clauses are recognised as such. Word documents need converting to Markdown first, which is a one-off step we can help with as part of onboarding.
Which identity providers work?
Any that implements OpenID Connect discovery, which includes Microsoft Entra ID, Okta, Google Workspace, Keycloak and Auth0. You give us the issuer URL and a client; there is no per-provider integration to wait for.
Is our content sent to an AI model?
Only if you switch on drafting assistance, which is off by default and runs on an OpenAI key you supply. With it off, no document content leaves your instance.
What happens if we stop using Imsenta?
You export the library as Markdown, PDF, Word or a zip of all three, and it is readable in any editor. There is no proprietary format holding the content, and a self-hosted instance is a database file you already have.
Can several organisations share one instance?
Yes. Imsenta is multi-tenant throughout — useful for a group with separate operating companies, or for a consultancy running libraries on behalf of its clients. Each organisation has its own users, roles, templates, catalog and domain.
See it against your own policies
Bring one of your real documents. We will put it in, propose a change to it, approve it and publish it, so you can judge the workflow on something you recognise rather than a demo library.