Prove who read your policy, and when
Upload a PDF, send it to a chosen slice of your roster, and every person confirms through a one-time link with nothing to sign up for. Reminders chase whoever hasn't on a cadence you choose, and the register answers the one question an auditor, a works council or a court actually asks: who read version Y, and on what date.
What proof other duties ask for
No single law requires this product. Several do require something close to it: the Whistleblower Directive asks you to inform staff of the reporting channel, the Pay Transparency Directive asks for a pay-transparency notice, GDPR and security policies ask for staff acknowledgement of data-handling rules, and a code of conduct under ISO 37001 or ISO 37301 asks for a recorded sign-off.
What they have in common is the question that comes afterwards, not a shared clock: did everyone get the document, and can you show that each person said they read it. A policy sitting on a shared drive answers neither.
This product doesn't write the policy or decide when it should change — that stays with your own lawyers or HR team. It is where you upload the PDF your organisation already has, send it, and keep the proof that you did.
The dates are yours to set
No regulation times a policy attestation, so nothing on this page is a statutory clock — every date here is a choice your organisation makes, not a limit Klaruna imposes.
You pick an optional target date to put in the invitation — a request to your own staff, never a count-down the product enforces or turns red over.
Reminders go out on their own, on a cadence and up to a cap you choose in your own settings, until a person confirms, their link is revoked, or the cap is reached, whichever comes first.
An optional re-confirmation cycle can reopen the conversation on its own schedule — short, long, or never at all — so an annual code-of-conduct sign-off and a policy you only ever send once both fit the same product.
How it works
- Upload a policy, publish a version
Add a PDF to your library and publish it as a version. Publishing moves the pointer forward; it never overwrites or deletes an earlier one, because an attestation to version one is a statement about version one's own bytes.
- Send it to a chosen slice of your roster
Filter by a tag or tick people off one at a time, see the exact headcount, and add your own note or a target date. Sending can't be undone, so the screen asks you to confirm the count first.
- Everyone confirms on their own link
Each person gets a one-time link with no account to create. The document sits in the page itself so reading and confirming happen in one place, and only pressing confirm counts as an attestation — opening the link is recorded as a separate fact.
- Reminders chase automatically, you chase by hand
The product reminds whoever hasn't confirmed, on your schedule and up to your cap. From a round's own screen you can also resend one link, revoke one person's access, or record a paper signature instead, each with its own note.
- New joiners are flagged, and the register proves it
Add someone to the roster after a round has already gone out, and the product flags every policy they've never received, ready to close in one click. The register, a CSV export and a per-version certificate carrying its own hash show who confirmed what, and when.
What's included
Your own policy library
Upload a PDF, publish it as a version, and add a description, an owner and a review date. Publishing never removes what came before; archiving only takes a policy out of circulation, never deletes it.
Target who gets it
Filter your roster by tag or tick people off one at a time before you send, so a site-specific policy reaches the right office rather than the whole company.
No-account attestation
Everyone confirms through a one-time link, with the document shown in the page itself and nothing to register for.
Automatic chasing
Reminders go out on the cadence and up to the cap you choose, and stop on their own once a person confirms, is revoked, or reaches the cap.
A round you can act on
Resend a single link, revoke one person's access, or record an offline signature with a note, all from that one distribution's own screen.
Catch-up and re-confirmation
A one-click send to whoever has never received a policy, and an optional cycle that reopens acknowledgement on its own schedule.
Register, certificate and verification
Export the whole register as a CSV, or a per-version certificate carrying a document hash. A public page lets anyone holding that certificate confirm the hash still matches.
Built for advisors
A partner acting for several clients sees attested and outstanding counts for each one from one screen, then opens a single client at a time to work on it.
Data and security
Everything runs in EU data centres: the application, the database, file storage, backups and email delivery.
A policy document is sealed with a key unique to its version before it ever reaches storage, and a recipient's name and email are encrypted at rest under a key unique to your organisation.
No IP address or device is recorded anywhere on the attestation path. Opening a link is recorded separately from confirming it, and only the explicit confirmation counts as an attestation.
Every send, resend, revocation and attestation is written to an append-only, hash-linked audit trail. A chase is recorded as one entry for the whole round, never as a list of names.
Deactivating someone revokes their outstanding links but leaves their past attestations and register entry untouched. After the retention period you choose, their name and email are erased, and the register still shows the date and the version.
Where it applies
Applies across the EU.