Creating Policies from Templates
Regentra includes a library of pre-built policy templates tailored to each compliance framework. Templates cover common policies like:- Acceptable Use Policy
- Access Control Policy
- Incident Response Plan
- Data Classification Policy
- Business Continuity Plan
- Password Management Policy
Select a template
Browse templates by framework or category. Each template includes boilerplate language adapted to the framework’s requirements.
Policy Editor
The policy editor supports both rich text and Markdown formatting. You can:- Structure content with headings, lists, and tables
- Embed links to external resources or internal procedures
- Add inline notes and callouts for reviewers
- Preview the final formatted document before publishing
Policy Lifecycle
Every policy moves through a defined lifecycle:| Status | Description |
|---|---|
| Draft | Initial creation and editing. Only visible to compliance team members. |
| In Review | Submitted for review by designated approvers. Comments and revision requests happen here. |
| Approved | Reviewed and approved by an authorized approver. Ready to be made active. |
| Active | Live and visible to the organization. Can be attached to controls and included in signature campaigns. This is the operational state — auditors see it as the published policy. |
| Archived | Superseded by a newer version or retired. Kept for audit history but no longer in force. |
| Expired | Past its review date and not yet reviewed/re-approved. Acts as a flag that the policy is overdue for review. |
Moving a policy backward in the lifecycle (e.g., from Approved back to Draft) is allowed. This is useful when an active policy needs significant revisions.
Separation of duties — author cannot self-approve
Regentra enforces a separation-of-duties (SoD) rule on policy approval: the person who last edited a version’s content cannot approve that same version. The system trackslastContentAuthorId per version and blocks the Approve action if the requesting user matches.
This is a hard server-side check — not a UI suggestion — and matches the SOC 2 / ISO 27001 / HIPAA expectation that author and approver are different individuals.
| Scenario | Behavior |
|---|---|
| Author submits the policy for review, a different approver approves | Approval succeeds |
| Author submits, then approves their own version | Blocked with “You cannot approve your own edits — another approver must review” |
| Author edits, a second person edits, second person approves | Blocked — the second person is now the lastContentAuthorId |
| Same person edits in Draft, makes no further edits in Review, then approves | Blocked — they are the last content author |
Per-requirement applicability badges
Compliance programs vary by organization type — a non-clearinghouse covered entity does not need to satisfy §164.308(a)(4)(ii)(A), and an org that doesn’t operate in the EU has no GDPR Article 27 representative obligations. Regentra surfaces this on each framework requirement directly. On any framework detail page (Compliance → Frameworks → [framework]), requirements that apply only to specific organizational roles render with an applicability badge — for exampleclearinghouse only or controller only. Hover the badge for the long-form explanation. If the role does not match your org, mark the corresponding control N/A with a one-line justification.
Version History
Regentra maintains a complete version history for every policy. Each time a policy is updated and re-published, a new version is created.- View previous versions and compare changes
- Track who made edits and when
- Auditors can see the full history of policy evolution
- Previous versions remain accessible even after new versions are published
Signature Campaigns
Signature campaigns let you send policies to employees for formal acknowledgment.Create a campaign
From the policy detail page, click Create Campaign. Select the policy and choose your target audience — all employees, a specific department, or individual users.
Configure the campaign
Set a deadline for signatures and customize the notification message. You can require employees to confirm they have read the full document.
Launch the campaign
Click Send. Each recipient gets a notification (email and in-app) with a link to review and sign the policy.
Campaign Tracking and Reminders
The campaign dashboard shows real-time completion status:- Signed — employees who have reviewed and acknowledged the policy
- Pending — employees who have not yet responded
- Overdue — employees who have missed the deadline
You can send manual reminders to pending employees or configure automatic reminders at intervals you define (e.g., 3 days before deadline, 1 day after deadline).