Staff Portal
Policies only work when people read them. Get proof from every person.
Policy acknowledgement software in Acuna GRC. Staff Portal is a simple website where every employee reads the company rules and clicks to say they read them. They sign in with the company login they already use, and you get proof of who read which version, and when.
Documents
Sample company · Brenvara AGNew campaign
Sample company · Brenvara AGQ4 policy acknowledgement
Due date · 30-10-2026The problem
Why does "we emailed the policy" fail an audit? An email proves nothing.
An auditor wants to see who read which version of a policy, and when. A sent email shows none of that, and most of your staff have no account in your GRC tool to confirm it.
Most of our staff have no account in our GRC tool.
Fix: employees sign in to the portal with the company login they already use.
We email the policy and hope people read it.
Fix: I have read and understood records the exact version shown and the time.
The auditor asks who read the new version. We cannot say.
Fix: Export acknowledgements (CSV) shows who, which version and when.
How it works
How does policy acknowledgement software work in Acuna GRC? Publish, ask, remind, prove.
You publish an approved policy to the portal, start a campaign with a due date, and staff read it and click I have read and understood. Reminders go to anyone still outstanding, and you export the proof.
How do you get an approved policy in front of every employee?
Once a document is Published in Operate → Documents, its panel shows a Staff portal section with Publish to staff portal. Employees find it in the portal’s Policy library, as a PDF in the page or as a link.
What staff read stays fixed until you click Republish: editing the document changes nothing on the portal. Each revision in Version history shows how many employees acknowledged it.
Write and approve policies in Operate →How do you ask every employee to read and acknowledge a policy by a date?
In Operate → Staff campaigns, click New campaign, pick up to 20 published documents, choose Everyone or Identity provider groups and set a due date. Each person reads and clicks I have read and understood, which records the exact version shown and the time.
Five reminder emails at most, never more than one a day: when the campaign starts, a week and a day before the due date, the day after and a week after. Ask again on republish is ticked by default, so a new version goes back into everyone’s To acknowledge tab.
Can employees sign in to the policy portal with their company login?
Yes. Under Admin → Staff Portal, the Set up your identity provider block lists every value to copy into Microsoft Entra, with a step-by-step guide, or into any SAML 2.0 provider. You send your metadata and email domains to Acuna, and the page shows Waiting for Acuna, then Approved or Refused with the reason.
Someone not assigned to the application in your identity provider cannot sign in. Who may publish and see acknowledgements is set with the Staff portal access on access profiles, which starts at None.
Access profiles and roles in Acuna GRC →How do you prove who read which policy version?
Export CSV on a campaign gives one row per person asked, with the due date and a status: completed, not read yet or overdue. Export acknowledgements (CSV) on a document gives every acknowledgement, current or not: who, how they signed in, what they read and when.
Import a workforce roster and each campaign shows who has never signed in, signed in but not read yet, or has no portal access. Completed counts people who have signed in at least once, not a share of your headcount.
Aiko and Staff Portal
Does AI acknowledge a policy for anyone? No. Each person clicks for themselves.
An acknowledgement is a person clicking I have read and understood, so the proof is theirs. Aiko works across the rest of Acuna GRC, at the pace you set.
Swiss experts
Can someone run our policy acknowledgement campaigns for us? Yes, as part of audit preparation.
Done for you: in audit preparation, our Swiss experts run your acknowledgement campaigns and package the proof for your audit. You decide which policies go out and to whom.
GRC Consulting team leader
Bénédicte Sévin
GRC project leadership, ISO 27001 Lead Implementer
Auditing expert
Jean Munyarugerero
Management systems auditor.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
Do it yourself
You run the program in Acuna GRC, with Aiko.
Done with you
Guidance, reviews and audit preparation with your team.
Done for youOn Staff Portal
Our experts run it. You review.
Integrations
Which identity providers work with the staff portal? Microsoft Entra ID, or any SAML 2.0 provider.
Staff sign in through a single sign-on connection Acuna sets up with you. Microsoft Entra ID has a step-by-step guide, and any other provider that supports SAML 2.0 works the same way.
- Single sign-on
Microsoft Entra ID
A step-by-step guide on Admin → Staff Portal, with each value next to a Copy button.
- Single sign-on
Any SAML 2.0 identity provider
Paste your metadata URL or XML, enter your email domains and click Send to Acuna.
- Campaign audiences
Identity provider groups
When your provider sends the names of a person’s groups, a campaign can target those groups.
- 100+ connectors in all
Missing a connector? We build it. See Integrations and API
Connects with
How does Staff Portal fit with the rest of Acuna GRC? Write it in Operate. Get it read here.
Policies are written and approved in Operate, then published to the portal. Access and the single sign-on request are set in Admin, and when supplier requests are on, staff send them to TPRM from the portal.
FAQ
What else do people ask about policy acknowledgement software?
Which languages does the staff portal support?
The portal is in English. The reminder emails can go out in English, German, French or Spanish, chosen by an administrator under Admin → Staff Portal → Reminder emails.
What do employees see in the portal?
Three things: To acknowledge, with the policies a campaign asks them to read and the due date; Policy library, with every published policy and its version; and My acknowledgements, showing exactly what they saw. Nothing else in Acuna GRC is reachable from the portal.
Can staff with an Acuna GRC account use the portal too?
Yes. Members of your organization sign in to Acuna GRC, then open the same portal address. They lose access if they stop being a member.
Can staff request a new supplier from the portal?
Yes, when supplier requests are on: members and employees send and follow them under My supplier requests. Supplier requests in TPRM.
Does importing a workforce roster give people access?
No. The roster is a CSV of the people you expect, used only to compare completion against your whole workforce. It gives nobody access and sends no email, and if any row is wrong, nothing is imported.
Can we stop someone using the portal?
Yes. Disable the person: they can no longer open the portal, get no reminders and leave every campaign, and what they acknowledged is kept. Re-enable gives access back, and each change is written to the audit log. The audit log in Administration and security.
Is Staff Portal an add-on, and where is our data hosted?
It is an add-on module, switched on per organization by Acuna, then opened to employees by your administrator. Your data is hosted in Switzerland, the EU or the US.
Start with one step.
Tell us which policies your staff must read and how they sign in. We'll show you the campaign, the reminders and the proof you can hand to an auditor.
Hosted in Switzerland, the EU or the US