Compliance, kept in order
Every policy, control and vendor review, in one well-kept place.
Fresh Cut Boards keeps your SOC 2, ISO 27001, PCI DSS and HIPAA programs organized — documents, controls, evidence, audit dates and vendor questionnaires — so the work stays current and the answers are ready when someone asks.
Free during early access · Five framework libraries included · No credit card
Acme Health · Dashboard
Compliance posture
Coming up
- Quarterly access reviewin 6 days
- Vendor review · Payroll providerin 12 days
- Incident response policy review2 days overdue
Illustrative sample data
What's inside
Six rooms, one well-built house.
Everything an auditor asks for lives somewhere specific — and links to everything it relates to.
Documents & policies
One register for every policy, contract and procedure — owners, versions, approvals and review dates that remind you before they lapse.
Controls & frameworks
SOC 2, ISO 27001, PCI DSS, HIPAA and NIST CSF libraries mapped to a starter control set, so you can see coverage requirement by requirement.
Evidence
Files and links tied to the control, obligation or audit they prove — reviewed, dated, and flagged when they go stale.
Audit timeline
Obligations, fieldwork, report dates and milestones on one calendar, with a digest before anything slips.
Vendor reviews
Send security questionnaires through a private portal — no vendor accounts — then score, flag and accept the answers.
Audit trail
Every change, approval and vendor submission is recorded, so you can show an auditor exactly who did what, and when.
How it works
Set it up once. Keep it in order.
- I
Set up your organization
Create a workspace, then upload the certificates and audit reports you already have. Your control status, evidence and renewal dates are set from them — you review every change.
- II
Bring in the right people
Invite your team into security groups — Admin, Contributor, Evidence gatherer, Document viewer, Auditor. Verify your email domain so colleagues can request access.
- III
Keep it current
Review cadences, evidence expiry and audit dates keep the program moving. When the auditor asks, it's already in order.
Security
Built like the records it keeps.
A compliance tool should meet the bar it helps you clear. Here's how it's built — and, just as plainly, what we don't offer yet.
Read Security & Trust- Organizations are isolated; every record is scoped on the server.
- Security groups decide what each person can see and do — checked on the server, not just hidden.
- Company domains must be proven by DNS before anyone joins through them.
- Private file storage with short-lived, permission-checked links.
- Single-use email sign-in links, rate limited; 12-hour sessions.
- An audit log your auditors can review and export.
Not for patient data yet. We don't sign HIPAA Business Associate Agreements today, so keep protected health information in BAA-covered systems and use Fresh Cut Boards to run the program around it.
Start keeping it in order.
Create your organization in a minute. Bring the certificates you already have — we'll take it from there.
Get started