📄 Policy & Document Ingestion Hub

Bring your policies into AssurAI

Import internal policies, procedures, and standards from any source — URL, paste, or file upload — and make them available across all AI tools.

🔗 From URL

📋 Paste Content

📎 Upload Files

Document or Web Page URL

Works with: SharePoint shared links, Confluence pages, intranet pages, regulatory websites, public policy documents

Policy Name

📚 Policy Library

0 policies stored

📂

No policies yet — use the ingestion methods above to add your first policy.

'); win.document.close(); } } function openUseModal(id,name){ selectedPolicyId=id; (document.getElementById('modal-policy-title') || {}).textContent ='Use "'+name+'"'; (document.getElementById('modal-policy-sub') || {}).textContent ='How would you like to use this policy?'; document.getElementById('use-modal').classList.add('open'); } function closeModal(){document.getElementById('use-modal').classList.remove('open');selectedPolicyId=null;} function useInAI(action){ const p=getLocalPolicies().find(function(x){return x.id===selectedPolicyId;}); if(!p){closeModal();return;} closeModal(); const snippet=p.content.slice(0,3000); if(action==='pipeline'){ sessionStorage.setItem('assurai_pipeline_policy_ctx','POLICY CONTEXT — '+p.name+':\n'+snippet); toast('Policy added as context for next Agent Pipeline run.','success'); setTimeout(function(){window.location.href='/ai-agent-pipeline.html';},1200); return; } const prompts={ review:'Review the following policy against our current workpapers and identify any areas where our workpapers do not sufficiently address the requirements set out in this policy:\n\nPOLICY: '+p.name+'\n\n'+snippet, gaps:'Identify compliance gaps between our current controls and the requirements in the following policy. For each gap: describe the gap, rate its severity (High/Medium/Low), and recommend remediation actions:\n\nPOLICY: '+p.name+'\n\n'+snippet, tests:'Based on the following policy, generate 10–15 specific audit test procedures to verify compliance. For each procedure: objective, method, evidence required, and exception criteria:\n\nPOLICY: '+p.name+'\n\n'+snippet }; sessionStorage.setItem('assurai_copilot_prefill', prompts[action]||prompts.review); window.location.href='/co-pilot-pro.html'; } function loadDemoPolicies(){ var DEMO_POLICIES=[ { id:'demo-'+Date.now()+'-1', name:'Information Security Policy v2.4', category:'Information Security', source:'Pasted', created_at:new Date().toISOString(), content:'1. PURPOSE\nThis Information Security Policy establishes the framework for protecting Acme Corp\'s information assets and ensuring the confidentiality, integrity, and availability of all data.\n\n2. SCOPE\nThis policy applies to all employees, contractors, and third-party users who access Acme Corp information systems.\n\n3. INFORMATION CLASSIFICATION\n3.1 All information must be classified as: Public, Internal, Confidential, or Restricted.\n3.2 Restricted data includes PII, financial records, and proprietary IP.\n3.3 Data owners are responsible for classifying and labelling their data assets.\n\n4. ACCESS CONTROL\n4.1 Access to systems shall be granted on the principle of least privilege.\n4.2 Multi-factor authentication (MFA) is mandatory for all remote access and privileged accounts.\n4.3 User access rights shall be reviewed quarterly by system owners.\n4.4 Terminated user accounts must be disabled within 4 hours of termination.\n\n5. CRYPTOGRAPHY\n5.1 All data in transit must be encrypted using TLS 1.2 or higher.\n5.2 All data at rest classified as Confidential or Restricted must be encrypted using AES-256.\n5.3 Cryptographic keys must be managed using an approved key management solution.\n\n6. INCIDENT MANAGEMENT\n6.1 All security incidents must be reported to the Security team within 1 hour of discovery.\n6.2 A post-incident review must be conducted within 5 business days.\n6.3 Incidents involving personal data must be assessed for regulatory notification requirements.\n\n7. BUSINESS CONTINUITY\n7.1 Critical systems must have a Recovery Time Objective (RTO) of no more than 4 hours.\n7.2 All critical data must be backed up daily with backups stored offsite or in a separate cloud region.\n7.3 Business continuity plans must be tested at least annually.\n\n8. COMPLIANCE\n8.1 This policy aligns with ISO 27001, SOC 2 Trust Service Criteria, and applicable regulatory requirements.\n8.2 Violations of this policy may result in disciplinary action up to and including termination.\n\nApproved by: Chief Information Security Officer\nEffective Date: 1 January 2026\nReview Date: 1 January 2027', size: 1820 }, { id:'demo-'+Date.now()+'-2', name:'Vendor & Third-Party Risk Management Policy', category:'Risk Management', source:'Pasted', created_at:new Date().toISOString(), content:'1. PURPOSE\nThis policy establishes requirements for identifying, assessing, and managing risks associated with third-party vendors, suppliers, and service providers.\n\n2. SCOPE\nApplicable to all vendors who process, store, or transmit Acme Corp data or provide services critical to business operations.\n\n3. VENDOR CLASSIFICATION\n3.1 Critical: Vendors with access to PII, financial data, or core infrastructure. Annual assessment required.\n3.2 High: Vendors providing material business services. Assessment every 18 months.\n3.3 Medium: Vendors with limited data access. Assessment every 2 years.\n3.4 Low: Vendors with no data access or system connectivity. Assessment every 3 years.\n\n4. DUE DILIGENCE REQUIREMENTS\n4.1 All Critical and High vendors must provide a SOC 2 Type II report or equivalent before contract execution.\n4.2 ISO 27001 certification or penetration test reports may be accepted as alternatives subject to CISO approval.\n4.3 Vendors must complete a security questionnaire covering: access controls, encryption, incident response, and business continuity.\n\n5. CONTRACT REQUIREMENTS\n5.1 All vendor contracts must include: data processing terms, security obligations, audit rights, and breach notification timelines.\n5.2 Sub-processor lists must be disclosed and changes notified with 30 days written notice.\n5.3 Vendors must maintain cyber liability insurance of no less than $5 million.\n\n6. ONGOING MONITORING\n6.1 SOC 2 reports must be renewed annually. Expired reports require compensating controls or expedited reassessment.\n6.2 Adverse news monitoring must be conducted quarterly for Critical vendors.\n6.3 Vendor performance and risk ratings must be reviewed by the Vendor Risk Committee quarterly.\n\n7. OFFBOARDING\n7.1 Upon contract termination, vendors must certify destruction or return of all Acme Corp data within 30 days.\n7.2 Access to all systems must be revoked within 24 hours of contract termination.\n\nApproved by: Chief Risk Officer\nEffective Date: 1 March 2026\nReview Date: 1 March 2027', size: 1980 } ]; var existing=getLocalPolicies(); var existingNames=existing.map(function(p){return p.name;}); var toAdd=DEMO_POLICIES.filter(function(p){return existingNames.indexOf(p.name)===-1;}); if(!toAdd.length){toast('Demo policies already loaded.','success');return;} setLocalPolicies(existing.concat(toAdd)); renderLibrary(); toast(toAdd.length+' demo polic'+(toAdd.length===1?'y':'ies')+' loaded.','success'); } function escHtml(str){return String(str||'').replace(/&/g,'&').replace(//g,'>').replace(/"/g,'"');} async function init(){ const {data:{user}}=await sb.auth.getUser(); currentUser=user; if(user) (document.getElementById('user-email') || {}).textContent =user.email; renderLibrary(); } init(); var _analyzePolicyId = null; var _analyzeResult = null; function openAnalyzeModal(id, name) { _analyzePolicyId = id; (document.getElementById('analyze-policy-name') || {}).textContent = 'Policy: ' + name; var p = getLocalPolicies().find(function(x){return x.id===id;}); (document.getElementById('analyze-policy-content') || {}).value = p ? p.content.slice(0,3000) : ''; (document.getElementById('analysis-results') || {}).style.display = 'none'; (document.getElementById('analyze-status') || {}).textContent = ''; document.querySelectorAll('.fw-chip').forEach(function(c){c.classList.remove('checked');c.querySelector('input').checked=false;}); document.getElementById('analyze-modal').classList.add('open'); } function closeAnalyzeModal() { document.getElementById('analyze-modal').classList.remove('open'); _analyzePolicyId = null; } function toggleFwChip(el) { var cb = el.querySelector('input'); cb.checked = !cb.checked; el.classList.toggle('checked', cb.checked); } async function runPolicyAnalysis() { var frameworks = []; document.querySelectorAll('.fw-chip input:checked').forEach(function(cb){frameworks.push(cb.value);}); if (!frameworks.length) { toast('Select at least one framework.','error'); return; } var content = (document.getElementById('analyze-policy-content').value||'').trim(); if (!content) { toast('Please paste or load the policy content.','error'); return; } var btn = document.getElementById('run-analysis-btn'); var orig = btn.innerHTML; btn.disabled = true; btn.innerHTML = '⏳ Analyzing…'; (document.getElementById('analyze-status') || {}).textContent = 'AI is reviewing your policy against ' + frameworks.length + ' framework(s)…'; (document.getElementById('analysis-results') || {}).style.display = 'none'; var sys = 'You are a GRC policy specialist with expertise in compliance frameworks. Analyze the provided policy document against the selected frameworks. Return ONLY valid JSON:\n{"policy_name":"string","frameworks_assessed":["string"],"overall_coverage":0,"framework_results":[{"framework":"string","coverage_pct":0,"requirements_met":["string"],"requirements_partial":["string"],"requirements_missing":["string"],"critical_gaps":["string"]}],"top_gaps":["string"],"recommendations":["string"],"executive_summary":"string"}'; var msg = 'Frameworks to assess against: ' + frameworks.join(', ') + '\n\nPolicy document:\n' + content; try { var aiResp = await window.assuraiAI({ model: 'claude-haiku-4-5-20251001', max_tokens: 3000, system: sys, messages: [{role:'user',content:msg}] }); var raw = (aiResp && aiResp.content && aiResp.content[0]) ? aiResp.content[0].text : ''; var parsed = tryParseAnalysisJson(raw); if (!parsed) throw new Error('Could not parse AI response'); _analyzeResult = parsed; renderAnalysisResults(parsed); (document.getElementById('analyze-status') || {}).textContent = '✅ Analysis complete'; } catch(e) { (document.getElementById('analyze-status') || {}).textContent = '❌ ' + e.message; } finally { btn.disabled = false; btn.innerHTML = orig; } } function tryParseAnalysisJson(text) { if (!text) return null; var t = text.trim().replace(/^```(?:json)?\s*/i,'').replace(/\s*```\s*$/i,'').trim(); try { return JSON.parse(t); } catch(e) {} var f = t.indexOf('{'), l = t.lastIndexOf('}'); if (f !== -1 && l > f) { try { return JSON.parse(t.slice(f, l+1)); } catch(e) {} } return null; } function renderAnalysisResults(r) { var gaugesHtml = (r.framework_results||[]).map(function(fw) { var pct = Math.max(0, Math.min(100, parseInt(fw.coverage_pct)||0)); var color = pct >= 80 ? '#22c55e' : pct >= 60 ? '#d97706' : '#dc2626'; return '

'+escHtml(fw.framework)+'

' +'

'+pct+'%

'; }).join(''); var gapRows = []; (r.framework_results||[]).forEach(function(fw) { (fw.requirements_missing||[]).forEach(function(req) { gapRows.push(''+escHtml(fw.framework)+''+escHtml(req)+'' +'Missing' +'Review and add controls'); }); (fw.requirements_partial||[]).forEach(function(req) { gapRows.push(''+escHtml(fw.framework)+''+escHtml(req)+'' +'Partial' +'Strengthen existing controls'); }); }); var topGapItems = (r.top_gaps||[]).slice(0,5).map(function(g) { return '

' +'⚠' +''+escHtml(g)+'

'; }).join(''); var oc = parseInt(r.overall_coverage||0); var html = '

' +escHtml(r.executive_summary||'')+'

' +'

Overall Coverage

' +'

'+oc+'%

' +'

'+gaugesHtml+'

'; if (topGapItems) { html += '

🔴 Top 5 Critical Gaps

'+topGapItems; } if (gapRows.length) { html += '

Gap Analysis Table

' +'

' +'' +'' +'' +'' +'' +''+gapRows.join('')+'

Framework	Requirement	Status	Recommendation

'; } if ((r.recommendations||[]).length) { html += '

Recommendations

' +'

'+escHtml(rec)+'

'; } (document.getElementById('analysis-results-inner') || {}).innerHTML = html; (document.getElementById('analysis-results') || {}).style.display = 'block'; } function exportGapReport() { if (!_analyzeResult) return; var r = _analyzeResult; var text = 'POLICY vs FRAMEWORK GAP ANALYSIS REPORT\n\n' +'Policy: ' + (r.policy_name||'Unknown') + '\n' +'Overall Coverage: ' + (r.overall_coverage||0) + '%\n' +'Frameworks Assessed: ' + (r.frameworks_assessed||[]).join(', ') + '\n\n' +'EXECUTIVE SUMMARY\n' + (r.executive_summary||'') + '\n\n' +'TOP GAPS\n' + (r.top_gaps||[]).map(function(g,i){return (i+1)+'. '+g;}).join('\n') + '\n\n' +'RECOMMENDATIONS\n' + (r.recommendations||[]).map(function(rec,i){return (i+1)+'. '+rec;}).join('\n') + '\n\n' +'FRAMEWORK DETAILS\n' + (r.framework_results||[]).map(function(fw){ return '\n--- ' + fw.framework + ' (' + (fw.coverage_pct||0) + '% coverage) ---\n' +'Missing: ' + (fw.requirements_missing||[]).join('; ') + '\n' +'Partial: ' + (fw.requirements_partial||[]).join('; '); }).join('\n'); var blob = new Blob([text], {type:'application/msword'}); var a = document.createElement('a'); a.href = URL.createObjectURL(blob); a.download = 'policy-gap-report-' + new Date().toISOString().slice(0,10) + '.doc'; a.click(); }