Build · 8 min read

Why I Built policyandcompliance.com

Compliance comes down to three things: rules someone wrote, people who check that you follow them, and the proof you keep. Most business owners find out which rules apply to them only after something goes wrong. I wanted a place where you could find out before.

The problem I kept running into

Building AllyMatter, I talk to a lot of people who run small and growing businesses. The same questions come up again and again. Does this law apply to us? What exactly do we have to write down? Who checks it? Who can help, and who is just selling something?

The answers exist, but they are scattered. Some sit in a statute. Some sit on an agency page that moved twice. Some are buried in a standard you have to buy to read. And most of what turns up in a search is written by someone selling software or services, so it tends to make every rule sound like it applies to you, urgently, and that their product is the fix.

Directories have the same problem. Many copy each other, so a firm that closed years ago can live on in five lists. Nobody is checking.

What the site is for

policyandcompliance.com explains standards, regulations and certifications in plain words. For each one it tries to answer the questions people actually ask: what it is, whether it applies to you, what you have to write down, who checks it, and who can help.

• Obligations by kind of business. Start with what you do, and see the rules that tend to come with it, each linked to the authority that enforces it.
• Standards and frameworks. The well-known ones and the obscure ones, explained without assuming you already know the jargon.
• Policies. Which written policies a standard really requires, and which ones people keep alongside it out of habit.
• Who can help. Tools, consultants and the assessors who certify the work, kept apart, because the firm that helps you prepare should never be the one that certifies you.

The goal is understanding, not fear. If a rule does not apply to you, the site should say so, and say why.

How the research is done

This is the part I care about most, and the part that takes most of my time. I sit down with two other researchers and we work through it by hand, one standard, one obligation, one firm at a time.

• We read the original. Not a summary of it. The statute, the rule, the agency's own page, the standard's own text. Every claim we make is checked against that document, line by line.
• Two sources where they exist. Every record is built from the publisher's own material and checked against a second source wherever one is available.
• Our own words. Nothing is copied as-is. If we cannot explain it simply, we do not understand it well enough yet, and it waits.
• Firms are checked one by one. A directory only tells us that a firm exists. We look at each firm's own website and public records ourselves. Assessors are listed only when they appear on the public register kept by the body that accredits them.
• "Not required" needs proof too. Saying a rule does not apply is as much a claim as saying it does. When we write that nothing applies, we explain where we looked and what applies instead.
• "Required" needs a clause. A policy is listed under a standard only when we can point to the clause that requires it, in the standard's own text.

It is slow. A single obligation means finding the right authority, reading the actual rule, checking the trigger and the dates, and then writing it so a business owner can follow it in a couple of minutes. We would rather publish less and be right.

Verification is never finished

Rules change. Agencies reorganise their websites. Deadlines move. Firms merge, rename themselves or close. A page that was right in September can be wrong by December without anyone touching it.

So checking is not a stage we finished before launch. It is the job. Links to every authority are re-checked every month. Dates and triggers are checked against the source again before anything is published or updated. And every page carries an address for corrections: when a reader tells us something is wrong, we go back to the source, check it, and fix it.

Most weeks, this is where my hours go. Not on design, not on new features, but on sitting with the sources and making sure what is on the page is still true.

Rules the site will not break

A reference site has one asset: that people can believe it. So a few things are never for sale, whatever anyone offers.

• No affiliate links, anywhere.
• No paid reviews, and nothing that buys a better ranking, order or match. A sponsor can buy a clearly labelled space on a page, never a position.
• No guessed prices. We show a vendor's price only when the vendor publishes it, and say plainly when they do not.
• No gates. The core pages are never behind a signup or a paywall.
• Ownership in the open. The site is published by AllyMatter, which makes one of the tools in the directory. That is disclosed on every page, and AllyMatter is never picked as anyone's recommendation.

How it is put together

Behind the site is a research database where every record, source and check lives. Each time the research changes, the whole site is rebuilt from it as plain, fast pages and published worldwide in about a minute. There is no login, nothing to install, and nothing that follows you around the web afterwards. It went live in September 2026, and it has been changing every week since.

What it should become

The long-term goal is simple to say and hard to do: the place anyone, anywhere, can go to understand which rules apply to their business and how to meet them, with every answer traceable to its source. It is English and mostly American today. Other countries and other languages will follow, with the same sources-first rules.

None of it replaces a lawyer or an auditor, and the site says so. What it can do is make sure you walk into that conversation already understanding the question.

Sid Varma, October 2026. Questions or ideas: [email protected]