Bundle your security evidence into a package, have a colleague approve it and share one link. Customers request access, you approve it with an expiry, and every file stays pinned to the version you shared.
The back and forth of a security review becomes one tracked flow.
01
Pick the files a customer needs, such as your ISO certificate, pen test summary and policies, and label them once instead of attaching them to every email.
A package holds 1 to 25 files, each pinned to an exact evidence version and content hash.
02
A reviewer who is not the author approves the package before it can be published. A new version replaces the old one automatically.
Versions move from draft to approved to published; only the current approved version can go live.
03
Customers request access through the link. You approve with an expiry, reject or revoke later, and answer extra evidence requests in the same place.
Guest access can never outlast the package, and every request, approval and revocation is logged with a hash.
Everything around answering a customer's security review.
Emailing security documents one by one
One link to a reviewed package
Tracking which customer got which version
Every file pinned to the version you shared
Remembering to cut off access later
Access expires on the date you set
Chasing extra evidence requests over email
Requests and answers tracked in the package
How long does your team spend sending documents for each one?
Hours per year spent sending documents
60
Your numbers, multiplied: reviews × minutes. Nothing of ours goes into the result.
Sharing follows the rules your auditor would set.
A package is published only after a reviewer who is not its author approves it.
Every file is pinned to an evidence version and hash, and downloads fail if the publication changed in the meantime.
Requests, approvals, rejections and revocations go into an append-only log with a hash on each entry. Only non-personal evidence can be shared.
Packages of 1 to 25 evidence files, such as certificates, reports and policies, each pinned to its version. Only evidence classified as non-personal can be shared.
You set an expiry when you approve a guest. It can never be later than the package's own expiry, which is at most 366 days.
The author assigns a reviewer, who cannot be the author. Only that reviewer can approve, and only the approved version can be published.
Yes. Guests can request additional evidence with a due date; your team answers with a pinned evidence version that the guest accepts or sends back.
Share one reviewed link and keep control of every file.