Board minutes, management reviews, submitted access requests, pen-test results — the paperwork an ISMS actually generates lives here. Every record belongs to a category that supplies its template, cadence and owner, and marking one final cuts an immutable version, so what was signed off stays exactly as it was signed off.
A category defines the kind of document, you write it in an editor built for prose, and finalizing commits an immutable version.
Meeting minutes, access requests, whistleblower reports, management reviews — each category supplies the template, cadence, owner and linked items its records inherit. File a record into a category and the structure is already decided.
The editor keeps headings, lists, tables, images and references to your collections, and drops the section structure and control-mapping a policy needs. A record moves through draft, in progress and final by hand — no approver gate where the work doesn’t need one.
A policy states the rules and is gated by an approver. Evidence is body-less proof on a control. A record is the authored, dated document in between — each identified by a short code like RE-001, so “where are the March minutes?” has a one-line answer.
Marking a record final snapshots its title, content and files into an append-only version — v1, then v2. Editing reopens the record as in progress while every committed version stays untouched, so the audit trail of what was approved when writes itself.
Four choices behind how records work here — each one something you can check, not an adjective.
A policy is section-structured, control-mapped and approver-gated. Evidence is body-less proof. A record is an authored, dated document — devguard keeps the three apart so each stays simple.
A category defines the kind of document and supplies the template, cadence, owner and linked items its records inherit — file a record and the structure is already there.
Marking a record final cuts an append-only version — v1, v2, v3. Editing reopens the record while every committed version stays exactly as it was signed off.
Records move through draft, in progress and final by hand — anyone with write permission can move them. There’s no approval chain where the work doesn’t need one.
Hosted in Switzerland by default, in German and English, with on-premise possible. Your data and evidence are yours and exportable in full at any time, with no lock-in.
Records are the documents between the rules and the proof — connected to the policies, evidence, audits and deadlines around them.
The rules you set — records are the documents you produce.
Proof attached to a control — records carry the writing.
Management reviews and minutes, ready when the auditor asks.
A record’s due date lands on the same calendar.
A policy is a section-structured document that maps to controls and is gated by an approver. Evidence is body-less proof attached to a control. A record is an authored, dated document that belongs to a category — board minutes, a management review, a submitted access request, a pen-test result. It’s a third thing, kept deliberately separate.
Finalizing snapshots the record’s title, content and attached files into an immutable version — v1, then v2, and so on. Editing a final record reopens it as in progress while the committed version stays untouched; finalizing again cuts the next version, optionally with a short changelog.
Yes. Upload the documents you already have as records — file each into its category and mark it final to cut v1. Nothing has to be re-authored, and later versions build on top of what you imported.
A folder of documents has no notion of category, cadence, status or versions — you find out a management review is missing when the auditor asks for it. Here every record has a category that defines what should exist and how often, a status you can read at a glance, and immutable versions that prove what was signed off when.
Swiss-hosted by default, in German and English, with on-premise possible. Records and their versions are yours and exportable in full at any time, with no lock-in.
File the minutes, reviews and reports your ISMS produces into categories with a cadence and an owner, and let finalizing cut the immutable version that proves what was signed off.