Something new is coming up soon from Kanishu — stay tuned.
Kanishu Policy Written. Approved. Read.

Policies that stay current — with control mapping and evidence built in.

Create, approve, publish and track policies in one controlled workflow. Link live policies to relevant regulatory controls, identify gaps in policy coverage, and maintain a clear record of versions, approvals and employee acknowledgements.

See it in action See plans & pricing Watch the tour How it fits into the suite →

The problem

Policies exist, but nobody can prove who read them

Documents live in shared folders in several versions, reviews slip past their dates, and showing an auditor that staff acknowledged the current version is guesswork.

What changes with Policy Management

One current version

Draft, review and approve policies with every version kept and the approved one always clear.

Recorded policy acknowledgement

Send read-and-acknowledge links and see when each person opened and acknowledged the exact version.

Reviews that happen

Reminders before a policy's review date, so policies don't quietly go stale.

Mapped to your controls

Link policies to the controls and regulations they cover, and see the gaps.

Key capabilities

What Policy Management does across its plans. Availability and limits vary by plan — each capability below shows the plan it starts on, and the comparison lists every difference.

Named owners, versioned drafts, and approvals in order before anything goes live
Start from 17 ready-made templates for HR, IT security, and operations
Publish to your own intranet, or use read-and-accept links with a record of who read what
Automatic review drafts, so policies do not quietly go past their review date
Complete history on every policy, including rejections

Take the 3-minute tour

Policy Management with sample data — the screens your team would use every day.

See it

Published, in review and draft policies, and reviews coming due.
Dashboard. Published, in review and draft policies, and reviews coming due.
Policies with owner, version, status and review date.
Policies. Policies with owner, version, status and review date.
Versions, approvals, acknowledgements and supported controls.
A policy. Versions, approvals, acknowledgements and supported controls.
Control coverage across ISO 27001, SOC 2, DPDP and GDPR.
Controls. Control coverage across ISO 27001, SOC 2, DPDP and GDPR.
Send policies for acknowledgement and track who has accepted.
Send for acknowledgement. Send policies for acknowledgement and track who has accepted.

Works with the rest of Kanishu

IT Asset Management

Choose policies that go to each person given equipment, to read and acknowledge.

People

Mark a policy to be sent automatically to every new joiner.

Continuous Assurance

Policies are mapped to the same controls Assurance checks; with acknowledgement campaigns (Business), overdue acknowledgements become Assurance findings.

Everything Policy Management does

Every capability, grouped by what it's for — not a feature-name soup.

Policy library

17 ready-made templates (All plans)
Starting points for HR, IT security, and operations policies, from acceptable use to offboarding.
Blank or template-based policies (All plans)
Start from a template or from scratch. Every policy has a named owner.
Your own templates (All plans)
Save a policy as a template, and publish new template versions as your standards change.

Ownership, versions and approvals

Named owner on every policy (All plans)
A policy cannot be submitted for approval until it has an owner.
Minor and major versions (All plans)
Wording changes and material changes are recorded as different kinds of version, with version history kept.
Approval chains (Growth+)
Approvers sign off in order. The drafter cannot approve their own version, and nothing goes live until every step is approved.
Single-step approval (All plans)
One approver signs off each version.
Version comparison (Growth+)
See exactly which sections changed between any two versions, line by line.
Change summary written for you (All plans)
The "what changed" note is generated from the comparison. Edit it, or leave it.

Reviews and reminders

Scheduled review dates (All plans)
Each policy has a review interval, set per policy.
Automatic draft when a review falls due (All plans)
The owner is reminded and a new draft is started, so a policy cannot quietly go past its review date.
Approval reminders (All plans)
Approvers are reminded when a step has waited too long, and the drafter is told each time an approval is recorded.

Publishing and read records

Publish to your own intranet or site (Growth+)
Your systems pull the live text from a read-only API, with a content hash to confirm the copy matches the approved version.
Read-and-accept links (All plans)
Your system asks for a link for an employee. The employee opens it, reads the policy, and accepts it. Nothing is stored about them beyond the reference your system sends.
Read register (All plans)
For each published version: who opened it and who acknowledged it, when, and which integration sent them. An acknowledgement records that the person accepted that version; it is not a test of understanding.
Read events for your own systems (Growth+)
A feed of opens and acceptances your software can poll, so it can decide what to do next.
Acknowledgement campaigns (Business+)
Send several policies to a list of people at once, with a deadline; see who has opened and acknowledged each one, resend only to those who haven't, and turn overdue acknowledgements into exceptions to follow up.

Audit trail

Full history on every policy (All plans)
Who drafted, who approved and when, and every change, including rejections, are recorded and kept.

Regulation and controls

Business and above
Control catalogue (Business+)
ISO/IEC 27001:2022 Annex A, SOC 2 Trust Services Criteria, India's DPDP Act 2023, and EU GDPR, loaded ready to map against.
Map each policy to the controls it supports (Business+)
Choose the controls each policy supports. Every change is recorded in the policy history.
Coverage report (Business+)
See which controls are covered by a live policy and which have gaps, with the evidence for each: the policy, its live version, a content hash, and read figures. A mapped live policy supports your documentary evidence; it is not a compliance determination.
Coverage for your own systems (Business+)
A read-only coverage feed your software can pull, scoped to controls.

Security

Each organisation's business records are kept in its own database, separate from every other customer's.
Multi-factor authentication any user can turn on; on Business and above, admins can make it compulsory.
Role-based access, adjustable person by person, permission by permission.
A history on every record — who changed what and when — in a chained audit log, so a later edit to the log is detectable.
Secrets you give a product, such as integration passwords and API keys, are encrypted at rest and never shown again once saved; an API token is shown once, when it is issued.

Plans & pricing

Capabilities marked "All plans" above are in every plan; higher plans add capacity and the capabilities marked with the plan they start on.

Starter

INR 999 /mo

Growth

INR 2,499 /mo

Business

INR 3,999 /mo

Full plan comparison

Included Starter Growth Business
Policies 10 30 200
Product users (create, edit or approve) 2 5 25
Read-only logins and document viewers Unlimited Unlimited Unlimited
Built-in policy templates
Approval chains Single-step Multi-step Multi-step
Version comparison —
Review reminders and automatic review drafts
Publish policies to your own site (read-only API) —
Read-and-accept links and read register
Read events feed for your own systems —
Full audit history
Regulation and control mapping — —
Acknowledgement campaigns with deadlines and overdue exceptions — —
API calls a day, per function 200 500 5,000
API clients (integrations without a login) — 2 5
Signed API requests (an HMAC on every call) — —
Email support (first reply within 3 business days)
Priority support (first reply within a business day) — —
Custom report builder — —
Require MFA (for admins only, or for everyone) — —
Organisation-wide change log and export — —
Joiners, movers and leavers (People) — —
Automatic login changes for joiners and leavers — —
Single sign-on with your identity provider (SAML: Entra ID, Google, Okta) — —

Questions

Do employees need a login to acknowledge a policy?

No. They get a secure link, open the policy and accept it; the acknowledgement is recorded against the exact version.

Can I buy just this product?

Yes. Every Kanishu product is sold and billed on its own. Start with one and add others later from the same account — no bundle.

Do the products share one sign-in?

Your team moves between the Kanishu products your organisation uses without signing in again. Each product keeps its own roles and permissions, and People keeps one directory of your staff for all of them.

What happens when we reach a plan limit?

Your admins get an email at 80% and again at 100% of a limit. Nothing is deleted: at the limit you can't add more until you free some up or upgrade, and the usage is shown on your My Plan page.

Do you issue GST invoices?

Yes — a GST tax invoice in rupees for every payment.

What support do you offer?

Support is by email, from inside the product (Contact Support) or by replying to our emails. We reply within 3 business days on every plan, and within 1 business day on plans that include priority support. Business days are Monday to Friday, 9:00 to 17:00 India time. We don't offer chat or phone support.

Using more than one part of your IT stack?

See how Policy Management connects with the rest of the suite — one account, single sign-on, and cross-linked records.

How the suite works together
← Back to all products