What has changed, and when.
Every change to the clause library, the engine and the product, with the date it shipped. Currently at version 2.9: 137 clauses across 4 documents, selected from 21 questions.
- 2.9Clause library
The draft stamp is back, and a technical review found real errors
A detailed technical review of the clause library — not the attorney sign-off we are still waiting on, and it said so itself — found genuine mistakes, so the “DRAFT FOR REVIEW” stamp removed on 2026-07-31 is back on every document until that sign-off exists. The two we would call out specifically: one clause named New York alongside Massachusetts as requiring a written security program, when New York’s law requires a security program without specifying that it be written; and another stated a 30-day reporting deadline without the rule that decides when it applies, which read backwards. Both are corrected, along with a landing-page line that no longer matched what a document actually says once it is generated. Twenty-four clauses and seventeen public claims were checked line by line; thirteen of the seventeen needed a change, most of them a sentence narrowing an “applies to you” into “may apply to you”, or adding a caveat a clause already carried but the page summarizing it did not.
- 2.8Product
Three more guidance notes, and a page that says how to reach us
New plain-English notes on the HIPAA covered-entity and business-associate split, on writing an incident response plan a small firm will actually use at 2am, and on answering the security questionnaire a large client sends. Each states what a rule asks of a business in scope and leaves whether it applies to you with you and your counsel — the same standard the documents themselves are held to. There is also a contact page now: one inbox, no phone queue, no chat widget, and a note on what to include so a question can be answered in one reply.
- 2.7Craft
The site is now usable without a mouse or a screen
An exhaustive accessibility pass over every public page, replacing an earlier partial one. Every page now begins with a “Skip to content” link, so a keyboard or screen-reader user is not walked through the masthead on each visit. The count-up figures — the hero statistics and every demo counter — were announcing nothing at all to a screen reader, because the label they carried is one assistive technology is required to ignore. The closing panel on nine pages failed the contrast threshold, and sat outside the page structure a screen reader navigates by. Navigation links throughout were below the minimum touch-target size. All of it is now checked automatically on every page before anything ships, rather than audited once.
- 2.6Product
Third-party analytics removed again, and the draft stamp taken off your documents
We say in two places — on the page describing how this is built, and in the privacy policy — that we run no third-party analytics. For a few days at the end of July that was not true: a Vercel page-view script had been added to the site, which reported your visits to them. It has been removed, our own cookieless step counts are again the only measurement here, and an automated check now fails the build if any page requests anything from a third party, so the claim cannot quietly stop being true a second time. Separately, generated documents no longer carry a “DRAFT FOR REVIEW” stamp — the clause library is still draft pending professional review, and the changelog and the how-this-is-built page continue to say so, but a watermark across a document you paid for and are handing to an underwriter was the wrong place to say it.
- 2.5.1Product
One page for whichever kind of business you run
The pages written for tax and accounting practices, clinics, and firms answering client security questionnaires now sit under a single index, so you can find the one that matches your situation instead of arriving at whichever the search engine picked.
- 2.5Engine
One question fewer, and a promise we could not keep removed
The intake claims every question changes what your documents say. We checked it mechanically — sweeping every question through every answer it can take, against six different businesses, and comparing the output — and it was true of twenty-three of the twenty-four. The exception was the insurance renewal month, which changed nothing at all, so it is gone and the first screen is now twenty-one questions. An automated check now fails any future question that earns nothing. The dashboard also said we would remind you before your renewal, which nothing was ever going to do; it now offers a real reminder you can opt into, and only where we can actually send one.
- 2.4Product
A clearer way in, and a clearer way to buy on a phone
Each note now offers the free check first and the full set of questions second — a minute is a fairer first ask than ten of them, and the check’s answers carry over if you continue. On a phone, the confirmation that unlocks checkout sat more than a screen above the buttons it unlocks, so a greyed-out button had no visible explanation; each button now says what to confirm and takes you straight to it.
- 2.3Product
The questions now save as you answer them
If you were interrupted partway through the questions, you lost them: your answers were only stored once you reached the last one. They are now saved in your browser as you give them, and coming back picks up at the first question you had not answered yet — with everything before it still filled in. Nothing is sent to us until you decide to buy, exactly as before. The purchase panel also now shows what this work costs the usual way, so the comparison is in front of you where you decide rather than back on the home page.
- 2.2Product
A free check, and a way to know what works
Everything this product makes used to sit behind twenty-two questions, so there was nothing you could hold before committing ten minutes. There is now a free check: eight questions, the same rules engine, an honest score and the answer-sheet rows those questions support — no email, no account, and your answers carry into the full intake if you go on. It shows only what its own questions establish, and an automated check fails the build if any answer you did not give could change what it says. Alongside it, a referral programme for accountants and brokers, and our own first-party measurement — no third-party analytics, no advertising pixels, no tracking cookies, and step counts that carry no identifier of any kind.
- 2.1Engine
A one-page summary, for the person who will not read the set
You are usually not the reader. You forward these to a broker, an underwriter, or the client whose questionnaire started it, and that person opens twenty pages on a phone. Your set now opens with a single page built for them: who the business is, what is confirmed in place, what is open with the first step against each item, and — stated rather than left silent — what your answers did not establish. Every line is the readiness summary and the action plan restated, so the summary can never be kinder than the documents behind it; nine automated checks hold that.
- 2.0Engine
An application answer sheet
The reason most people want these documents is that a form asked. Your set now opens with the form, answered: the questions cyber insurance applications and client security questionnaires most often ask, each with the answer your intake supports and the sentence to write in the detail box. Where your answers did not establish something, it says “Not confirmed” and tells you what to check rather than guessing — an application is a set of representations your insurer can rely on when you claim, so a generous answer today is a problem later.
- 1.9Engine
Readiness and an action plan now ship in the files
The readiness summary was rendered on screen but was not in the PDF or the Word file, even though it is listed as a Standard deliverable — so a buyer downloaded their set and it was not there. It now ships in both, and it arrives with a plan: every gap ranked, each with a plain first step naming your own tools, and space to write an owner and a date against it. The ordering rationale travels with the plan, and it says plainly that it is ours and not a claim about how any carrier underwrites.
- 1.8Craft
New identity
A geometric mark and wordmark, one green used as a surface rather than as hairlines, and a single sans across the product — with the serif now reserved for the documents themselves, so the artifact reads as a different object from the software that made it. The generated PDF and Word files are unchanged apart from the accent colour: same structure, same wording, same clause references.
- 1.7Product
Published how this is built, and this changelog
A page answering the questions a client security review would ask about us — what is stored, what we never see, what the engine does to stop a document claiming a control you do not have, and plainly what has and has not been professionally reviewed. Plus this record, so you can see what the clause library said when you generated your set and what has changed since.
- 1.6Craft
Motion, and a demo that shows its working
The homepage engine demo now names the clauses an answer selects, by reference, as they arrive — and reports the ones it removes the same way. The intake became fillable from the keyboard: number keys pick an answer, Enter advances, Backspace goes back. All motion respects the operating system’s reduced-motion setting, and every word on the page remains readable with JavaScript disabled.
- 1.5Craft
Typesetting pass across the product and the documents
Every contraction and possessive in the generated PDF and Word files was being set with a typewriter apostrophe. All 284 were replaced with typographic quotes, and two automated checks now fail the build if one reappears — one over assembled document output, one over every public page. The page frame was unified so the masthead, content and footer share a single measure.
- 1.4Clause library
Guidance notes and segment pages
Plain-English explainers on what a WISP is, what the FTC Safeguards Rule asks of a small firm, and what cyber insurance applications actually ask — plus pages for the three situations that send people looking: a tax or accounting practice, a clinic, and a firm answering a client security questionnaire.
- 1.3Clause library
US regulatory clauses corrected and a review pack prepared
A pass over the HIPAA and FTC Safeguards clauses corrected several statements of scope: the covered-entity test is electronic transmission rather than simply treating patients, the business associate agreement requirement excludes pure conduits, and the Safeguards Rule’s relief for firms holding information on fewer than 5,000 consumers was missing entirely. A complete review pack was generated from the live library for a US attorney to work through.
- 1.2Engine
US focus, and a regulatory layer
The product now serves US businesses specifically. Pricing moved to USD; UK-tailored content was removed rather than left dormant. New clause families cover state breach-notification duties, HIPAA roles, the FTC Safeguards Rule and PCI DSS — each stating what a regime asks of a business in scope, never asserting that holding a document makes anyone compliant. Two documents were added: an Acceptable Use Policy including rules for public AI tools, and a Business Continuity Plan.
- 1.1Product
Entity details and navigation
Full trading disclosure in the footer of every page, section navigation on the landing page, and layout fixes across the intake, checkout confirmation and dashboard.
- 1.0Engine
Intake expanded after security and legal review
The question set grew to cover the controls cyber carriers actually underwrite on — patching, training, multi-factor authentication beyond email, unsupported software, and who runs IT — so the library stops asserting controls the intake never verified. Remote-access method is asked only of businesses running a local server. Honesty violations found in review were fixed, and the automated invariant suite was written to stop them recurring.
Entries describe work that actually shipped, on the date it shipped. The clause library remains draft pending review by a qualified US attorney — see how this is built for what that means.