29 focused workflows
Choose the compliance job you need to finish.
Open a tool to inspect its exact scope, workflow and sample. Checkout remains closed unless that offer has passed every release check.
Data protection and privacy
Requests, records and privacy assessments
- UK complaints procedure packCreate a complaints procedure, statutory acknowledgement clock, templates, register and dated evidence pack.
- Breach 72-hour triage packRecord awareness, risk and response evidence, calculate the controller’s elapsed 72-hour point and retain the notification decision.
- DPIA screening and assessment packScreen one processing activity, record risks and measures and prepare a controlled UK or EU DPIA working record.
- UK transfer and TRA packRecord one restricted-transfer route, transfer-risk evidence and the facts needed for the current official IDTA or Addendum.
- Privacy notice gap checkerCheck one English text-based notice against supported UK or EU Article 13 and Article 14 transparency subjects.
- PECR campaign preflightRecord the subscriber, permission, sender, opt-out and suppression evidence for one UK electronic-mail campaign.
- ROPA validatorMap, validate and convert one local XLSX or CSV record of processing activities.
- DPA clause-coverage validatorCheck one English text-based PDF or DOCX against the supported Article 28 clause subjects.
- Rights-request clockCalculate a supported response date and assemble one local case record with drafts and evidence exports.
- CCPA risk-assessment preflightCheck one user-confirmed covered activity for the supported California assessment fields before review.
- California DROP readiness preflightCheck the supported records and decisions needed before preparing for California DROP obligations.
AI governance
Transparency, literacy and implementation evidence
- Article 50 transparency verifierCheck an AI transparency implementation against the supported Article 50 duties and record the evidence reviewed.
- AI Literacy Measures evidence packRecord role-based AI literacy measures, attendance and dated evidence against the supported EU AI Act source set.
- AI system inventory and governance registerCreate a controlled record of one AI system against a voluntary NIST AI RMF governance baseline, with jurisdiction context kept separate.
- AI vendor due-diligence packReview one AI supplier against a voluntary NIST AI RMF baseline, retain contract evidence locally and assign unresolved items.
- Prohibited AI practices preflightScreen one EU-connected AI use against the supported Article 5 routes and retain the factual decision record.
- AI cyber-security code self-assessmentAssess one AI system against the UK government code, retain tested evidence and assign every open security action.
Financial crime
AML policies, sector packs, KYC and sanctions data
- 2026 AML policy and BWRA validatorCheck whether an AML policy and business-wide risk assessment cover the supported 2026 UK clause subjects.
- 2026 MLR change-impact assessmentRecord how supported 2026 Money Laundering Regulations changes affect an organisation, its policies and controls.
- KYC spreadsheet validatorValidate one local remediation spreadsheet for missing identifiers, dates, ownership fields, statuses and inconsistent records.
- Accountancy and tax AML packPrepare a source-bounded starter set of AML records for an accountancy or tax practice.
- Estate and letting AML packPrepare a source-bounded starter set of AML records for an estate or letting agency.
- MSB and hawala AML packPrepare a source-bounded starter set of AML records for a money service business or hawala operator.
- UK TCSP AML starter packPrepare a source-bounded starter set of AML records for a trust or company service provider.
- Sanctions-list normaliser and change-diffNormalise supported official sanctions lists locally and produce a source-hashed record of additions, removals and changed fields.
- High-value dealer AML packPrepare a source-bounded starter set of AML records for a high-value dealer.
- SRA legal-practice AML packPrepare a source-bounded starter set of AML records for an SRA-regulated legal practice in England and Wales.
- Art-market AML packPrepare a source-bounded starter set of AML records for an art-market participant.
- UK SAR quality preflightCheck an ordinary POCA or TACT record and create a restricted human report or no-report decision pack.
Before you start
Direct answers about files, payment and recovery
What do these tools produce?
Each tool names the exact files it produces. Open the product page to inspect the workflow, file count and current sample before you start.
Can I inspect a sample before paying?
Yes where a current sample has passed inspection. A product without an accepted sample remains closed for checkout.
Are the tools legal advice?
No. They support a bounded operational job and show the sources and assumptions used. You remain responsible for legal and risk decisions.
Who can use the US launch products?
The planned launch accepts US adults buying personally or for an organisation. UK, EEA and unknown-country checkout attempts remain blocked.
Is this a subscription?
No. The initial offers are one-time purchases. They do not renew automatically.
When will I see the price?
A provider-verified launch offer shows its price before checkout. The page labels the price as closed until every release check passes.
Will tax be added?
Paddle calculates applicable tax during checkout. The pre-purchase summary explains that tax may be added before payment.
Where are my case facts stored?
Case facts and uploaded working files stay in your browser. The server receives only the completed ZIP when you deliberately archive it.
How long is the server archive kept?
A successfully verified private ZIP is retained for 30 days unless a refund, dispute, corruption check or deletion rule removes it sooner.
Can I download from another device?
After fulfilment, Account provides five one-time recovery codes and a recovery sheet. A valid code can transfer access to another browser while recovery remains available.
Can the server rebuild a lost output?
No. The server does not keep your case facts. It can return a verified archived ZIP during its retention period, but it cannot reconstruct an expired or missing output.
Who sends the receipt and invoice?
Paddle is the merchant of record and sends the payment receipt or invoice. Account provides a separate downloadable supplier confirmation.
What happens after a full refund?
Future access and recovery are revoked. The private archive enters immediate deletion handling.
What happens after a partial refund?
The refunded amount is recorded while access remains active, unless another valid revocation event applies.
Why is checkout closed on a product?
Checkout stays closed until the source record, provider mapping, privacy, accessibility, recovery and Sandbox evidence all pass for that offer.