Stop leaking data into AI - in about five minutes.

Everything hangs off one thing: your workspace key (looks like shield_…). It identifies your workspace, carries your coverage rules, and meters your plan.

1. Create a workspace. Go to the sign-up page, enter a name and your email. You'll get a workspace key instantly - no card, and a 7-day free trial with 250 requests.
2. Sign in any time at /login - we email you a one-time link (magic link). No passwords.
3. Open your dashboard at /my?key=shield_… - coverage, integration snippets, usage, the Leak Audit, team and billing all live here.

PII Shield meets your team wherever they use AI. Six surfaces sit over one redaction engine and one coverage config - none let raw PII reach the model. Pick whichever fits; most workspaces use several at once.

A · Gateway - one base-URL change

Point any app or SDK at the shield. It applies your coverage rules, forwards the request, and re-hydrates the reply - including streaming re-hydration, so tokens are restored to real values inside the stream, not just the buffered response. Bring your own provider key (BYOK - forwarded, never stored) or let the operator hold an encrypted managed key for you.

# Anthropic API key clients - SDKs, apps, anything ANTHROPIC_BASE_URL-aware
# NOT Claude Code - see the callout below
export ANTHROPIC_BASE_URL=https://piishield.ai
export ANTHROPIC_API_KEY=your-anthropic-key
# tell the shield which workspace this is
# header on each request:  x-shield-key: shield_your_keyCopy

# OpenAI-compatible (ChatGPT API, Kimi, Groq, Mistral, xAI, …)
base_url = "https://piishield.ai/v1"
headers  = { "x-shield-key": "shield_your_key",
             "x-shield-provider": "openai" }   # or kimi, groq, mistral, xai…Copy

B · Browser extension - in-chat, key-gated

For the web UIs, the extension redacts what you type in the box before it's sent - entirely in your browser. Add it from the Chrome Web Store (one click - Chrome, Edge and Brave; setup guide), then pick what to mask in the popup. It works across claude.ai, ChatGPT, Gemini, Grok, DeepSeek, Kimi, Mistral, Perplexity and Copilot.

• Key-gated: redaction uses your workspace key; without a valid key a PII-bearing message is blocked rather than leaked.
• "Scan my Claude history": a one-time, in-page leak backfill - detection runs locally in the browser and only masked/ciphered events leave, never your conversation text. Feeds the Leak Audit. It checkpoints after every conversation, so you can hit Pause (or close the tab, or run out of plan requests) and pick up exactly where you stopped - already-scanned chats are never scanned or billed twice.
• "Redact a file": drop a file in the popup and get a redacted copy back to upload.

C · MCP server - one command

Add the shield as an MCP server; any MCP-aware agent gets the redaction and coverage tools. Put your key in the URL so usage is metered to your plan.

claude mcp add --transport http shield https://piishield.ai/mcp?key=shield_your_keyCopy

Quick start — have your AI set it up

Not the person who edits config files? You don’t need to be. Paste this into Claude Code or Claude Desktop, swap in your key, and it will do the setup and then prove it worked.

Set up PII Shield in front of our ATS MCP server, so candidate data is
redacted before it reaches you. My PII Shield key is shield_…

1. Install the wrapper:
     claude plugin marketplace add aerynquarmby/pii-shield-plugin
     claude plugin install pii-shield@piishield

2. Find my MCP configuration - claude_desktop_config.json for Claude
   Desktop, or .mcp.json / ~/.claude.json for Claude Code - and show me
   the entry for the ATS server before you change anything.

3. Rewrite that entry to run through the wrapper: command node, args
   [<plugin path>/mcp-wrap.mjs, --, <the original command and args>].
   Keep the original env and add PII_SHIELD_KEY.

4. Show me the before and after, then restart the connection.

5. Prove it: fetch one candidate and tell me whether you received tokens
   like [PERSON_1] and [EMAIL_1] or real names. If you can see any real
   personal data, say so plainly and stop.Copy

Step 5 is the one not to skip. Ask it to prove the redaction rather than report success — the failure that matters here is silent, and asking what it actually received is what makes it visible.

Wrapping an MCP server you don’t control

Your ATS, CRM or helpdesk probably ships its own MCP server, and it hands a model whole records — names, emails, ID numbers, CVs. You don’t need that vendor to build anything. Put the shield in front of their server and the model never receives a real one.

Claude  <──stdio──>  [ PII Shield wrapper ]  <──stdio──>  their MCP server

One line in your MCP config. Everything after -- is their own command, unchanged:

{ "mcpServers": { "ats": {
    "command": "node",
    "args": ["~/.claude/plugins/pii-shield/mcp-wrap.mjs",
             "--", "npx", "-y", "mcp-remote", "https://your-ats.example.com/mcp"],
    "env": { "PII_SHIELD_KEY": "shield_…" } } } }Copy

What changes, in one sentence: results are redacted on the way to the model, and the model’s tokens are turned back into real values on the way out — so an agent can act on a person it was never shown.

• The tool contract does not change. Tool names and JSON schemas pass through byte-for-byte, so the agent calls exactly what it called before. Free-text descriptions are the one exception and are scanned — a server that generates one tool per candidate puts the candidate’s name in every description, and a tool listing reaches the model before any tool is called.
• One person, one token. The same candidate keeps the same token for the whole session, so “[EMAIL_2] applied twice” is a sentence about one person.
• It fails closed. No key, an unrecognised key, an unreachable shield or an exhausted plan and the tool call returns an error — never the record. Over limit, your ATS isn’t even queried.
• Same workspace, same coverage. A rule you add in Coverage applies here too, and usage counts against the same plan.

Ships with the Claude Code plugin as mcp-wrap.mjs. Use it and the API if you also have your own pipelines — they are not alternatives.

• redact - mask PII in any text
• detect_pii - report what would be masked, without changing the text
• redact_document - mask PII in an uploaded file (Word, Excel, PowerPoint, PDF, text…)
• get_coverage / set_coverage - read or change what's masked, right from chat

D · Claude Code plugin - local, no key in flight

Claude Code gets a local plugin instead of the gateway. It redacts file reads, command output and MCP results before Claude sees them, and restores the real values before Claude writes to disk - all on your machine, with no credential in flight.

claude plugin marketplace add aerynquarmby/pii-shield-plugin
claude plugin install pii-shield@piishield
# then give the plugin your workspace key
export PII_SHIELD_KEY=shield_your_key   # or: echo shield_… > ~/.pii-shield/keyCopy

• Check your usage anytime with /pii-shield:status - the CLI version of Claude's own usage view. It shows your monthly allowance used/left and any pay-as-you-go credits in reserve, so you always know where you stand.
• Text is redacted; images pass through. The plugin redacts text (file contents, command output). An image or binary file a tool returns is left untouched so it works normally - to redact an image or scanned PDF, use Document redaction first, then attach the clean copy.
• Fails closed. Without a valid, in-quota key, PII-bearing tool output is withheld rather than passed through. Prompts and @-mentions containing PII are blocked, because Claude Code does not let a hook rewrite a prompt.

Everything above needs a config file on somebody’s machine. This does not. Add your ATS, CRM or helpdesk in the dashboard’s Connections tab, and we hand you one web address to paste into Claude under Settings › Connectors. Claude then talks to the shield, and the shield talks to your system — so the records that come back are already tokenised.

Setting one up

1. Open Connections in your dashboard and press Add a system. Search for it by name — about half of what the MCP directory lists is a hosted server we can point at — or paste the address your vendor gives you.
2. Say how it signs you in. A key as a bearer token, a key in a named header, a key in the address, no key at all — or Sign me in, where there is no key to find and you just approve it in a browser window. Press Test it before you save; it will tell you what actually happened.
3. Copy the address from the row and paste it into Claude under Settings › Connectors › Add custom connector. That address carries a key of its own, so treat it like a password — and if it ever gets out, press New address in Connections to replace it.
4. Ask Claude for something. Records come back as [PERSON_1], [EMAIL_1] and so on. When Claude sends a token back — looking someone up by email, say — the real value is restored on the way out, so the lookup still works.

One address for everything

Connect more than one system and each still gets its own address, but there is also a bundle address that carries all of them at once. Paste that single address into Claude and it sees every tool from every connected system, prefixed by which system it came from.

• One set of tokens across all of them. The same person keeps the same token whether they came out of your ATS or your helpdesk, so “[PERSON_1] emailed twice” is a sentence about one person rather than a coincidence.
• Add and remove without touching Claude. The bundle address never changes; tick a system in or out of it in the dashboard.
• One system failing does not take the rest down. A server that will not answer is left out of the tool list and logged; the others still work.

Telling us something got through

Every connector also exposes pii_report_missed. If Claude spots a real name or number in what it just received, it can report it — the same “anything missed?” loop as Document redaction, and reports feed straight into your coverage rules. It costs no quota: telling us we missed something must never be the thing your plan has run out of.

In your dashboard's Coverage tab, toggle exactly what gets masked. Everything is stable and reversible - jane@acme.com becomes [EMAIL_1] on the way out and is restored on the way back. One config drives all six surfaces.

Two detectors ship off: person names (a heuristic, and the hardest thing to match without false positives) and GPS coordinates. Both are one switch away in Coverage. Every shape detector is checksum- or format-validated (Luhn, Verhoeff, structure) so it stays high-precision. Plus label-driven pickup of any labelled identifier (medical aid, policy, passport, account…) and your own custom terms/regex - see below.

Label-driven detection & custom PII

Label-driven auto-detection catches values sitting next to a sensitive label (e.g. "Patient ID: …") even when they don't match a fixed pattern. On top of that, add always-mask terms - an internal project name like Project Titan, a client codename, a supplier.

Custom patterns need no regex knowledge. Type one real example of the identifier - EMP-123456 - and the builder derives the pattern (\bEMP-\d{6}\b), then shows you exactly what it matches in a sentence of your own text before you save it. Tick letters vary too if the prefix changes as well, or start from a ready-made recipe for invoice numbers, patient numbers, policy references, account codes or ticket keys. You can still paste a regex by hand if you prefer.

The Coverage screen groups every detector into Keys & secrets, Contact details, Identity & government IDs, Financial and Technical & device, with a search box, an "only what's on" view and paging - so finding one switch does not mean reading two dozen. All of it applies on every surface: gateway, extension, MCP, connectors, documents and the CLI plugin.

Text that tries not to be found

Personal data does not always arrive in a clean shape. An address can be typed with a zero-width space inside it, or with full-width digits that look identical on screen and are different characters underneath - both of which slip past a plain pattern match while reading perfectly to a person and to a model. Before anything is detected, the shield folds these away: zero-width spaces and joiners, word joiners, byte-order marks, soft hyphens, and full-width forms of ASCII. What is matched is what a reader sees, not what the bytes happen to say.

What the workspace sets, a seat cannot unset

Coverage is set once, in the dashboard, by the workspace owner - and it is a floor, not a suggestion. Every seat inherits it automatically, and the extension shows those rules ticked, greyed out and marked workspace. A seat can add cover (their own always-mask terms, extra detectors, a pattern from the shared recipes) but cannot remove anything the workspace requires. A detector you leave off is only a default: a seat may still switch it on for themselves.

PII isn't only in prompts - the biggest leaks are the files people upload. PII Shield redacts documents format-preserving: it edits the text in place and hands back a file that looks identical, minus the personal data. If you switch on restoring, the round trip closes: the edited file the AI hands back can have the real values put in again.

• Review before you redact: in the dashboard and the extension, a file is first scanned as a dry run - it detects only, bills nothing, and shows every proposed redaction (lowest confidence first, each with its rationale). You approve or reject each finding, then apply. Nothing is produced until you do.
• Automatic quality review: after applying, the shield re-scans the produced file to prove the approved values are actually gone, and reports a pass (or flags anything still present) - so you never hand over a file that only looks redacted.
• Mark what we missed - and it becomes a rule. Detection is a heuristic, so the review also shows you the document's own text with everything we found shaded. Highlight anything we didn't catch - a client codename, an internal reference, a name our detector doesn't know - and it is masked in this file and saved to your workspace coverage, so every document, chat and integration catches it from then on. Where the value has a shape (CASE-889120) you can save the pattern (\bCASE-\d{6}\b) instead of the single value, and cover the whole series. Or highlight the field LABEL - CLIENT: - and the rule becomes “mask whatever follows this label”: the label stays readable, the value is masked, and the next contract with a different client is covered without touching anything. The person who spots the miss fixes it, in the moment they spot it - no trip to the Coverage screen.
• But a pass is not a guarantee. It confirms the values we found are gone. It cannot confirm we found them all: detection is automated, and it can miss personal data. Always review a file yourself before you share it with an AI. PII Shield reduces the risk of a leak; it does not remove it, and you use it at your own risk.
• On the gateway, Anthropic document blocks (PDFs and text) are redacted inline before the model sees them.
• The MCP redact_document tool and the dashboard's /api/my/redact-document take a file and return a clean copy.
• The extension's document redactor (its own full-page drop zone) runs the identical flow - same review, same mark-what-we-missed panel, same quality review, same coverage, and the same Redact / Restore tabs. It is the same component, shared between the two screens, so they cannot drift apart.
• Each file redacted is one metered unit (OCR files can bill heavier, per page).

Digitally signed documents (DocuSign, Adobe Sign)

PII Shield detects a digital signature before it touches the file and stops, telling you which provider signed it. This is deliberate, and the reason is worth stating plainly: redacting a signed PDF always breaks its signature. A signature is a cryptographic seal over the exact bytes of the document, so changing any of those bytes - which is what redaction is - makes it stop verifying. No product can redact a signed PDF and keep the signature valid; anything claiming otherwise is either stripping the signature or not redacting.

So you get the choice rather than a surprise. Choose Redact a copy anyway and the shield produces a redacted copy - your signed original is never modified - and the response carries the warning with it. Keep the signed original in your system of record; use the redacted copy only for AI processing or sharing.

Via the API this is the SIGNED_PDF response code; re-send with "allowSignatureInvalidation": true to proceed.

You redact a contract, send it to an AI to rewrite, and get back a good draft full of [PERSON_1] and [EMAIL_2]. Restoring puts the real values back into that returned file, in place, in the same format. It is off until a workspace owner turns it on, because it is the one feature that asks us to keep something.

What we keep, and what we can read

Redaction builds a map of token to value. Normally it lives in memory for one request and is then gone. With restoring switched on, that map is sealed in your browser to your workspace key and stored - we hold ciphertext and no key that opens it. Matching a returned file to its map also happens on your device, so we never learn which document you restored or what was in it. Each map kept is one metered unit.

Turning it on

1. The workspace owner opens Profile → Your data → Restoring redacted documents. Admins and members cannot: this decides what we may keep on the organisation's behalf.
2. Set how long maps are kept: 7, 14 or 30 days. Thirty is the maximum, because that is what our terms and the DPA already promise. A map past its date is deleted and cannot be recovered.
3. Tick the confirmation. It states that your organisation is the controller for this data, has a lawful basis for keeping it, has given affected staff notice, and has completed any consultation or impact assessment required where you operate. Templates: DPIA and staff notice.
4. You need a workspace key first. Without one there is nowhere to seal the maps to, and we will not fall back to a key we hold. If you have not set one up, the Leak Audit tab creates it and downloads the key file.
5. Press Turn it on. A Restore tab appears beside Redact in Documents, for every seat.

Turning it off hides the tab and stops new maps being kept. It does not delete the maps you already have - that is Profile → Your data → Delete your data, which lists token maps as its own scope.

Restoring a file

1. Open Documents → Restore and drop in the file the AI gave you back.
2. Press Restore. Your browser finds the matching map, opens it with your key, and downloads the file with the real values in place - same file type, same formatting.
3. What each token stood for lists every value put back, searchable by token or by value.

What restoring cannot do

• PDFs cannot be restored. Redacting a PDF turns the pages into pictures and paints over the values, so there is no text left to put anything back into. Restore the text your AI tool gave you, or redact a Word version instead.
• Only documents redacted here, after you turned this on. Anything redacted before that, or in another workspace, has no map and cannot be restored by us or by anyone.
• Not after the retention period, and not on a device without your key. The key never leaves the browser it was made in - import your key file first on a new machine.
• It gives you the file you were sent, not your original. Anything the AI rewrote stays rewritten; only the tokens change back.
• Capitals may not match. One person is one token, so a name written MOKOENA in one cell and Mokoena in another comes back with the spelling we saw first. The name is right; the capitals may not be. In a 9,776-row spreadsheet we tested, this affected two cells.
• If two of your redactions used the same token for different people, we stop and tell you rather than guess. Tokens are numbered per document, so [PERSON_1] means someone different in each one, and guessing would put the wrong person's details into your file.
• Check the file before you use it. As with redaction, this is automated and you use it at your own risk.

Every other tool starts protecting you today. Leak Audit also shows you what already got out - a retrospective, per-seat view of exactly what PII has reached AI, so management can see and close the exposure.

• Per-seat attribution: each member's exposures, by type, by conversation, over time - plus a "prevented vs. already-leaked" split.
• Opaque placeholders by default (•••). We used to store a partial like j***@acme.com, but that exposes a domain - and ****1234 a card's last four - to anyone with database access. Nothing readable is stored. Raw values appear only when you deliberately reveal them, decrypted in your own browser.
• Owner/admin-only reveal, itself audited: a privileged reveal decrypts a single value on click and writes its own audit event - so revealing is on the record, and fishing is discouraged.

Tenant-held end-to-end encryption

Where a value is stored for possible reveal, it's encrypted with an RSA public key your workspace generates in its own browser (RSA-OAEP wrapping AES-256-GCM). The private half never leaves that browser; reveal happens on your device. PII Shield holds nothing that can decrypt it - we literally cannot read your leaked values, in the dashboard or in the database. There is no fallback to a key we hold: a workspace without a reveal key simply stores no value. A blind index (HMAC) still answers "was this same value leaked again, or by someone else?" without ever decrypting, and it's what makes Not PII suppression work. The browser extension and CLI plugin go further and encrypt on your device, so the value never reaches our servers even in transit. Prefer to store nothing reversible at all? Turn cipher storage off and keep only the type.

How the history gets read

There are only two lawful ways to read a user's past AI history - and PII Shield uses the right one per tier:

• Enterprise → the Anthropic Compliance API gives a true, central, lifetime content audit with no per-user install. Enter your Compliance API credentials self-serve in the dashboard; it activates once your org's Primary Owner enables the API on Anthropic's side.
• Team / Pro → no content API exists, so the extension does an opt-in, in-page "Scan my Claude history" backfill - detection runs locally, only masked/ciphered events leave.

A daily monitor cron scans workspaces that opted into automatic monitoring, records new exposures, and can send a counts-only digest email ("3 new PII exposures across 2 seats today") that links into the dashboard for masked detail.

The dashboard

Leak Audit lives as a sub-tabbed tab in your workspace dashboard:

Public links: shared chats and published artifacts

A shared chat or a published artifact is a public web page. In July 2026 Google indexed thousands of them from claude.ai/share and claude.ai/public/artifacts, and people discovered that "anyone with the link" had quietly come to mean "anyone who searches" - the same mental model as an unlisted video. Reporting at the time found API keys, wallet keys, résumés, medical records and internal documents among them.

The browser extension now interrupts the share. Before a public link exists it tells the user what that tab has masked - "1 API key, 1 email address" - and escalates the confirm button when a credential is involved. Whichever they choose is recorded under Public links, because an admin needs to know a public link exists, not only what was in it.

On any paid plan, invite teammates to share a workspace - no key passing around.

1. Open the Team tab in your dashboard (appears on paid plans).
2. Enter a teammate's email, pick Member or Admin, and Invite.
3. They sign in with their own email via a magic link and land straight in the shared workspace - same coverage, same key, metered together.
4. Remove anyone with one click; their access ends immediately.

What a member sees is a scoped version of the dashboard: their own usage, the tools, and their own Leak Audit exposures - but no Team tab and no billing (those are owner/admin only), and no inviting others. Their guided onboarding leads with turning on two-factor to secure the account first.

Add a second layer to sign-in with any authenticator app - for owners, admins and teammates alike.

1. Open Profile → Security and click Turn on two-factor.
2. Scan the QR code with Google Authenticator, 1Password, Authy or Aegis - or enter the setup key by hand.
3. Type the 6-digit code it shows to confirm. From then on, signing in needs that code as well as your email link.
4. Turning it off later needs a current code, so a lost session can't quietly disable it.

Every surface is usage-metered against your plan's allowance, and the Billing tab shows your usage in real time. A new workspace starts on a free trial: 250 requests or 7 days, whichever ends first - no card required. It runs once and does not renew.

Two ways to upgrade

• Manual (EFT / bank transfer): pay by transfer and the operator upgrades your workspace on their side - no card needed. Handy for enterprise procurement.
• Self-service checkout: upgrade instantly through the built-in billing portal. The operator switches this on when they're ready to accept card payments; until then, upgrades go through the manual path.

• Team is per-seat, like Claude: minimum 5 seats, 200k requests per seat. Adding a teammate uses a seat; when seats are full you're prompted to add one.
• Three billing terms - monthly, 6-month, and annual - with growing discounts. Switch terms on the Billing tab; annual is the best value.
• Hit your limit? Every surface (gateway, extension, MCP, connectors, documents) returns a clear "upgrade" response - no silent overage. Upgrading raises your allowance immediately. Cancelling leaves the workspace with no allowance, so redaction pauses until you resubscribe; nothing is deleted.
• Your allowance has two parts, spent in order: your plan allowance first, then any pay-as-you-go credits (packs of requests that never expire). Protection stays active - and every surface keeps working - until both are exhausted; only then does it pause. So a workspace at its cap with credits in reserve is still fully protected. Buying a pack during a trial also takes the workspace off the 7-day clock, so those credits keep working.
• See exactly where you stand, everywhere: the Billing tab and Overview show used/left plus your credit balance, and during a trial the days remaining as well; the browser extension popup shows the same picture; and in Claude Code, /pii-shield:status prints your allowance, your trial days and any pay-as-you-go credits on demand. You are warned in the dashboard and by email before a trial ends.
• Manage your subscription (cancel, change plan, invoices, payment method) via the built-in billing portal - VAT/tax is handled for you.
• Your model token costs stay with your own AI provider - you only pay for the shield.

PII Shield is layered so each role sees exactly what it should - and no more. Three tiers, strictly separated:

Using the console

The console is organised into four pages you switch between in the side-nav:

1. Go to /console and sign in with your operator email; we email a one-time link.
2. Analytics - three sub-tabs. Traffic: visitors, visits, bounce rate and where they came from, first-party and cookie-less. Acquisition: the funnel from session to paid, signups and conversions. Revenue: active subscribers, MRR/ARR, revenue and pay-as-you-go, paid seats, the per-plan breakdown and the billing-events feed, in USD. Ranges run from 7 days to 12 months or any custom from/to pair, and clicking a page, source or campaign filters everything to it.
3. Billing requests - the queue of tenant upgrade requests raised from their "Contact us to upgrade" form. Review one, record the payment you received, and apply the plan/seats - the tenant's usage updates automatically. (Card / self-service payments apply on their own and show in Analytics, not here.)
4. Invoices - bill a client for a manual EFT payment. Pick the client, plan, seats and term; the line items prefill at the list prices and stay editable. A Team workspace mid-term asking for more seats prefills as a pro-rata seat upgrade for the remainder of what they already paid - never the full price again - and paying it grows the seats without resetting their cycle. Create, download the PDF (the PII Shield mark, the fixed banking details and the invoice number as the payment reference) and email it yourself. When the money lands, Mark paid records it in the books, applies the plan and emails the client their confirmation. Paid terms are tracked: the Renewals due card (and a daily reminder email) prompts you when a term is ending, with the renewal invoice one click away - nothing ever expires on its own.
5. Clients - search the paginated index (or the top-bar search box), open a client, then use its sub-tabs: Overview (connect details, connected systems + live stats), Plan (adjust plan / credits / seats, manual EFT upgrades), Team & seats (seats bought against seats used), Coverage (a read-only view of what this client masks, plus a live tester - coverage itself is the client's to change in their own dashboard), Leak audit, and Audit log (filter by seat, status and date, export CSV - counts only, never the data).
6. Create a new client any time with + New client in the top bar.

The whole point: your personal data is masked before it reaches the model and before it reaches us.

• Never stores raw PII: prompts, personal data, and the token↔value map live in memory for a single request, then are discarded. If you switch on restoring redacted documents, the map is kept - sealed on your own device to a key we do not hold.
• Counts-only logs: all we keep is how many of each type were masked, plus a timestamp / model / status line - to bill and show your usage.
• AES-256-GCM encrypts anything that must be stored (managed provider keys; revealable Leak Audit values under a per-tenant key), with a privileged, self-audited reveal.
• Self-host the whole thing in your own cloud - data never leaves your network and the platform operator has zero access.
• GDPR / POPIA-aligned by design - masked-by-default, short retention, right-to-erasure, DPIA & employee-notice templates included.
• ISO 27001 / SOC 2 in progress - a starter ISMS kit (policies, risk register, subprocessor register, incident-response plan, key-rotation runbook) ships in the repo.