Governance
AI Governance System
Sets up AI policies, ownership, approvals and reviews across the organization.
Extensions
Compliance Documentation Pack
Your reviewers get a clear written account of what data the product handles, where it goes and which controls apply.
Security questionnaires and compliance reviews keep asking where data goes, who can see it and what controls are in place. This pack documents the data flows, processing and controls of the AI product you already run, written by the people who built it. It supports your own compliance reviews, and it is honest documentation, not a certification.
- Documents data flows, processing and controls clearly
- Written by the people who know the build
- Gives reviewers accurate answers, without certification claims
$2,500
10–20 working days
What it is
Compliance Documentation Pack is an add-on that documents the data flows, controls and processing of an existing Upmark Labs product for your own compliance reviews. It is documentation, not a certification. It fits governance, security, infrastructure and document processing products, and is written from the live build.
Why businesses buy it
Larger customers, partners and regulators increasingly ask detailed questions about AI systems before they sign. Answering from memory is slow and risky, and vague answers stall deals. A clear written account of your product's data flows and controls speeds up reviews and shows you take data seriously. The written scope covers data flows, processing and controls as they actually exist in one product, with one revision round, and it is clear throughout that it supports reviews rather than certifies anything.
Problems this solves
A customer or auditor asks how your AI product handles data
The Compliance Documentation Pack documents the product's data flows, controls and processing. You have a written answer ready for your own compliance reviews, rather than piecing one together under pressure.
Existing documents describe the plan, not the system actually running
The pack is written from the live build, not from early design notes. It describes what the product really does today, so reviewers read an accurate picture.
Teams confuse documentation with a formal certification
The pack is clearly documentation for your own reviews, not a certification. That keeps expectations honest when you share it with customers, insurers or internal reviewers.
A good fit if
Your security, privacy or risk team must review the product before or after it goes live.
A customer or partner has sent a questionnaire asking how your AI handles data.
You need a record of data flows and controls you can keep up to date yourself.
The product is an Upmark Labs governance, security and infrastructure build or a document processing build.
Not the right fit if
You need a certificate or an audit opinion. This pack documents; it does not certify. Use an accredited auditor for that.
You want a tamper-evident record of actions inside the product. Audit Logging Add-on adds it.
You want AI policies and ownership set across the organization. AI Governance System is the wider build.
You want ongoing checks of AI workflows against internal rules. AI Compliance Monitoring does that.
How it works
- The product is traced. We follow the data from where it enters the product to every system, model and log it reaches.
- Processing is described. What each step does with the data, why, and how long it is kept.
- Controls are listed. Access, redaction, retention, logging and any other controls the product actually has.
- The pack is assembled. Data flow diagrams, a processing description and a controls list, written for your reviewers.
- You review it with one revision round, then receive the final pack, a handoff note and a written walkthrough.
What you provide within 72 hours
Your portal lists these the moment you order. Delivery starts the working day after everything is in and your access is checked.
- The order reference of the product being documented
- Any questionnaire, template or framework your reviewers want answered
- Your internal policies that apply, such as retention or access rules
- Contact details for your security or privacy reviewer
- One person who approves the final pack
The 72-hour rule. Send everything on your checklist, including access, within 72 hours of ordering so your build starts on time.
Timeline
Start
Reviewer needs and templates gathered
Weeks 1–2
Data flows traced through the product
Week 2
Processing and controls written up
Week 2
Diagrams drawn, draft pack assembled
Week 2
Your review and one revision round
Go-live
Final pack delivered, walkthrough recorded
| Option | Delivery time | Price |
|---|---|---|
| Standard | 10–20 working days | $2,500 |
What you receive at handover
- Written documentation of the product's data flows, controls and processing (documentation only, not a certification)
- Content written from the live build
- Updated product documentation and a test report
- A handoff note and a short written walkthrough
Expected benefits and how to measure them
- Can make compliance questionnaires quicker to complete
- Helps your reviewers understand how data moves through the product
- Gives you one accurate reference to keep up to date
- Questionnaire turnaround
- Log the time taken to answer security or compliance questionnaires before and after the pack.
- Follow-up questions
- Count follow-up queries from reviewers on each questionnaire, before and after.
- Review findings
- Note gaps raised in your next internal review and compare with the last one.
Before you start: Gather the last questionnaire you answered and note how long it took. List the questions you found hardest to answer.
These are things to track, not promised results. Outcomes depend on your data, your team and your market.
Running costs
Documentation adds no running cost. The product keeps running in your own accounts as before.
Ask about running costsCustom requirements
Answering long customer security questionnaires line by line, documenting systems outside the product, or mapping to several frameworks at once can be quoted. Add a checkout note for a written Change Quote. Larger or bespoke projects go through the Custom AI request form instead.
Request a custom versionKeep it running
When the product changes, the pack should be updated so it stays accurate. That work uses the change hours of the parent product's maintenance, which grows in line with the add-on's price.
Adds $125/mo to maintenance
Covered by the main product's maintenance, which grows by this amount.
How maintenance worksHow this compares
| Do it yourself with a SaaS tool | Hire a custom agency | Upmark Labs | |
|---|---|---|---|
| Price | Compliance platforms bill yearly and you still write the content | A consultancy quotes after scoping | Ours is one fixed price, shown before you buy |
| Accuracy | Templates filled in by you | Depends on the brief | Ours is written by the people who know the build |
| Claims | May imply compliance | Set per project | Ours documents what exists and is clear it is not a certification |
Questions about this product
Does the Compliance Documentation Pack make us compliant?
No. It documents how the product handles data and which controls exist, so your reviewers can judge compliance against the rules that apply to you. Whether the product meets a particular law or standard is your reviewers' decision. The pack gives them accurate material to make it.
What goes into the compliance pack?
Data flow diagrams showing where data enters and travels, a description of the processing at each step, how long data is kept, and a list of the controls the product actually has, such as access rules, redaction, logging and retention. Everything is written for a reviewer, not an engineer.
Can you follow our own template or framework?
Yes. If your reviewers use a template, questionnaire or framework, share it at intake and we organize the pack around it. Mapping to more than one framework, or answering a long external questionnaire line by line, is larger work that is quoted separately.
Which products is this pack available for?
Governance, security and infrastructure products and document processing products. Those handle the kind of data and controls reviewers most often ask about. For other product types, describe your review needs in the checkout note and we tell you what we can offer.
How should the pack be used in a customer security review?
As the accurate source your team answers from. It describes the product's data flows, processing and controls as they exist, so answers stay consistent. Long questionnaires answered line by line need a Change Quote. The pack follows the delivery speed chosen for its product, with a fixed price and date shown before you pay.
Will the documentation stay accurate after changes?
Only if it is updated when the product changes. Each section notes what it depends on, so you can see what a change affects. Updates fit within the change hours of the parent product's maintenance, and we recommend reviewing the pack whenever a new connection or data type is added.
Give your reviewers something accurate to review.
Add the Compliance Documentation Pack and your product's data flows, processing and controls are written up for your reviewers, plainly and without certification claims.
Works well with
Compliance Operations
AI Data Governance Assistant
Classifies data and enforces handling rules in AI workflows.