Target
Assign a doc to a group, a person, or All Employees. When someone joins the group, the doc appears on their list. No static onboarding pack.
Prove they read the policy.
Listor turns any policy link into a tracked attestation, then chases the renewals and keeps the audit log. It was built for teams with real obligations and no GRC budget, the ones working toward SOC 2 or ISO 27001 rather than the ones who already have both. And we never host your documents.
$2 / user / month. Free for 10 assigned people. No card.SOC 2 and ISO 27001 in flight · No DPA needed · Self-serve
The attestation moment: click in the app, modal on the canvas, log on the server.
The moat
We never see your policies.
Listor stores a title and a link. Your documents stay wherever they already live: Notion, Confluence, Google Drive, your intranet. No upload, no DPA review, no data-residency question.
Stays with you
Your document
Notion, Drive, Confluence, your intranet
- The policy text
- Every past version
- Attachments and comments
boundary
Reaches Listor
Listor
Four fields, and nothing else
- The title you typed
- The URL you pasted
- Who attested, and when
- Their IP and browser
Your employees open the link and read the policy where it already lives. Listor records that they did.
Three moves, one audit trail.
Attest
Employees click the doc, read it where it lives, then confirm. We capture IP, user-agent, and the re-attestation round the confirmation belongs to.
Renew
Set a cadence in months. When the window opens, Listor emails the right people, re-tracks attestation, and writes everything to the audit log.
The log
Receipts.
Every entry carries the actor, their IP address, the user-agent, the timestamp, and the re-attestation round it belongs to. The page groups them by day. Export the lot as CSV or JSON whenever the auditor asks.
Filter by event type, then export exactly what you filtered, as CSV or JSON.
Who it's for
Built for teams that need proof without the GRC tax.
Law firms, accounting firms, schools, manufacturers: anyone with policies to enforce and no Vanta budget to enforce them with. Listor sits at the price and the posture that buyer expects.
Pricing
The price is on the page.
Free for ten assigned people, then $2 a head. Business adds SSO and retention controls. Every price is on the pricing page, from a single seat upwards.
Free
$0forever
Up to 10 assigned people, 5 documents.
Start freePro
$2/ user / month
Unlimited documents, renewals, audit log.
Start freeBusiness
$4/ user / month
SSO, custom retention, priority support.
Talk to usQuestions buyers actually ask.
Does your IT team have to review you?
No. We never see your documents. Listor stores a title and a URL. The doc itself stays in Notion, Drive, Confluence, or wherever you already keep it. No DPA review, no data-residency question.Can we export the audit log?
Yes. CSV or JSON, any time. The export covers every attestation, document open, and admin change, each carrying the actor, IP, user-agent, and timestamp.What happens when a new hire joins?
If you target documents to a group, anyone added to that group automatically gets the relevant docs on their reading list. The "onboarding pack" maintains itself.Do you support SSO?
SAML SSO and SCIM are on the Business tier. Google and Microsoft sign-in are on every tier.Is there a free trial?
There is a free tier: up to 10 assigned people and 5 documents, forever, no card needed. Upgrade only when you outgrow it.What if a policy changes?
Force re-attestation with one click. Listor emails the targeted people, tracks a fresh round of attestations, and the audit log records who triggered it and when. The previous round stays intact underneath.