Dantian Policy Management & Acknowledgements

Did everyone read the new policy? Which version did they acknowledge? Can you prove it to an auditor?

Dantian Policy Management answers those questions on infrastructure you already own — no vendor cloud, no subscription, no data leaving your building. Every document is version-controlled and visible only to the roles you choose; every acknowledgement is locked to the exact version the staff member read. When an auditor asks for proof, you export a report — who read it, which version, what role, and when — with a digital fingerprint proving the text has not changed since.

No telemetry, no “phone home”, no vendor cloud. The Free plugin’s own code makes no external network requests. The one exception is a check to this site’s own uploads address that the private upload folder is not publicly readable. (Third-party media an administrator chooses to embed in FAQ answers — for example a YouTube or Loom video — is loaded by the visitor’s browser as normal, restricted by the dpma_faq_allowed_iframe_hosts allowlist.)

Core features

• Acknowledgement tracking — require formal acknowledgement, with expiry, automatic reminders, and re-acknowledgement on each new version; every record captures who, which version, and what role.
• Version approval — once a document is published, every later content change (including restores and accepted edit suggestions) can be held for approval — by the document owner or, when it has none, by the people in the approver roles, who approve or reject it from an emailed link (a confirm step, no login needed) or from the Pending Approvals list; every version is snapshotted and can be restored.
• Role-based visibility, gated by default — out-of-audience staff cannot find, search, or open a document at all.
• Tamper-evident audit history — a document-text fingerprint embedded in every acknowledgement record and export.
• Compliance dashboard & attestation export — per-role compliance, and the checksummed CSV/PDF report you hand an auditor.
• Comprehension gate, campaigns, page gating, edit suggestions — optional: prove engagement, group policies into campaigns, lock pages until policies are read, and let staff propose edits.
• Regulatory frameworks — optional, off by default (Settings → Features → Enable Regulatory Frameworks): a hierarchical framework taxonomy to map documents to the standards you follow, with CSV import and export of the terms and their document assignments, shown on documents and in their PDFs.

Knowledge base & search

A complete, role-gated knowledge base ships in the same plugin — a tabbed hub, AJAX search, filterable listings, category browsing, and FAQs with feedback: [dpma_hub], [dpma_search], [dpma_documents], [dpma_kb], [dpma_faqs], plus personal compliance views.

• Related documents — link related policies on any document; readers see them on the page and as Appendix A of the PDF, filtered to what each reader may see.

Pro add-on (separate plugin)

Dantian Policy Management Pro adds accreditation-readiness matrices, curated framework libraries (ISO 27001/9001, HIPAA, GDPR, SOC 2, and more), sealed SHA-256 evidence packs, multi-stage approvals, scheduled manager digests, opt-in AI authoring with a built-in confidentiality gate (your own OpenAI/Anthropic key), signed acknowledgement webhooks, and additional PDF template designs.

Third Party Services

Embedded Content in FAQ Answers and Documents

An FAQ answer or a document may embed a video, document, form, presentation or audio player from an allowed service — by default YouTube, Vimeo, Google Docs, Google Drive, Google Calendar, Microsoft Forms, Microsoft Sway, Microsoft Office Online, Termageddon, Loom, Canva, SlideShare, Spotify, SoundCloud. Site code can change the allowed services with the dpma_faq_allowed_iframe_hosts filter. When a visitor opens that answer or document, their browser loads the embedded content from that service, which receives the visitor’s IP address and browser details under its own privacy policy.

• YouTube: privacy https://policies.google.com/privacy · terms https://www.youtube.com/t/terms
• Vimeo: privacy https://vimeo.com/privacy · terms https://vimeo.com/terms
• Google Docs: privacy https://policies.google.com/privacy · terms https://policies.google.com/terms
• Google Drive: privacy https://policies.google.com/privacy · terms https://policies.google.com/terms
• Google Calendar: privacy https://policies.google.com/privacy · terms https://policies.google.com/terms
• Microsoft Forms: privacy https://privacy.microsoft.com/privacystatement · terms https://www.microsoft.com/servicesagreement
• Microsoft Sway: privacy https://privacy.microsoft.com/privacystatement · terms https://www.microsoft.com/servicesagreement
• Microsoft Office Online: privacy https://privacy.microsoft.com/privacystatement · terms https://www.microsoft.com/servicesagreement
• Termageddon: privacy https://termageddon.com/privacy-policy/ · terms https://termageddon.com/terms-conditions/
• Loom: privacy https://www.atlassian.com/legal/privacy-policy · terms https://www.atlassian.com/legal/atlassian-customer-agreement
• Canva: privacy https://www.canva.com/policies/privacy-policy/ · terms https://www.canva.com/policies/terms-of-use/
• SlideShare: privacy https://www.slideshare.net/privacy · terms https://www.slideshare.net/terms
• Spotify: privacy https://www.spotify.com/legal/privacy-policy/ · terms https://www.spotify.com/legal/end-user-agreement/
• SoundCloud: privacy https://soundcloud.com/pages/privacy · terms https://soundcloud.com/terms-of-use

Remote Content in PDFs

PDF generation does not fetch remote images or fonts. Site code can turn remote fetching on with the dpma_dompdf_options filter; if it does, the server requests those files from the sites hosting them when a PDF is built, which gives those sites the server’s IP address and the address of each file requested.

Bundled Libraries

This plugin bundles the following open-source libraries. No external network requests are made by the libraries themselves; they run locally inside the plugin.

• Dompdf (https://dompdf.github.io/) 3.1.6 — LGPL-2.1. Server-side HTML/CSS-to-PDF generation for document, attestation, and report exports.
  • dompdf/php-font-lib 1.0.2 — LGPL-2.1-or-later.
  • dompdf/php-svg-lib 1.0.2 — LGPL-3.0-or-later.
  • masterminds/html5 2.12.0 — MIT.
  • sabberworm/php-css-parser 9.5.0 — MIT.
  • DejaVu Sans fonts (Dompdf’s Unicode font, vendor-prefixed/dompdf/dompdf/lib/fonts/) — DejaVu Fonts License (Bitstream Vera and Arev terms; free, GPL-compatible); full text in licenses/DejaVu-Fonts-LICENSE.txt.
• Parsedown (https://parsedown.org/) 1.8.0 — MIT. Markdown-to-HTML conversion used during bulk document import.
• PdfParser (https://github.com/smalot/pdfparser) 2.13.1 — LGPL-3.0. Pure-PHP text extraction from uploaded PDF files during bulk document import.

Two dependencies are LGPL-3.0-family (php-svg-lib and PdfParser itself), not GPL-2.0-compatible on their own — GPLv2-only code cannot legally combine with LGPL-3.0 code. This plugin is licensed GPL-2.0-or-later, so the distributed combination resolves under the GPL-3.0 terms that grant permits, making it GPL-compatible; it would not be compatible under a strict GPL-2.0-only grant. Full license texts are shipped inside the respective vendor-prefixed/ subdirectories.

Privacy

This plugin stores personal data relating to knowledge-base and policy governance activity. Site administrators are responsible for disclosing this processing to their users where required (GDPR, HIPAA, etc.). The full list of what is stored, why, and how long each item is kept with the default settings is the plugin’s suggested privacy-policy text under Settings → Privacy → Policy Guide, generated from the same personal-data registry the export and erasure tools use. The Privacy & Data Management page of the user guide covers it in more depth.

What it stores:
* In its own database tables: Document acknowledgements, Edit suggestions, FAQ and document feedback, PDF downloads, Document view history, Search queries, Document version snapshots, Governance event log, Event log index, Repeat-view throttle.
* On user profiles: Bookmarks, Saved searches, Reminder email preference, Dismissed notices, Notices after an action (on the user profile), Comprehension quiz attempts.
* In post meta and options: Suggestion being applied (kept on the document), Applying a suggestion (kept on the document), Search suggestion list, Version history, Changes awaiting approval, Scheduled versions, Approval decisions, Kept change text, Owner review sign-offs, Audience lists, Document owner assignments, Reminder history, Compliance reminder history, Queued reminders, Scheduled reminders, Email sender address, Deleted accounts.
* Short-lived data: Generated export files, Cached PDFs, Background export and import jobs, Rate limiting, Cached document lists, Notices after an action (short-lived copy), File imports.
* Cookies: View throttle cookie.
* Client-side storage: Browser search cache.

Whether a person’s identity, an IP address or a download is recorded is controlled by these settings under Settings → Access & Privacy:

• Record IP Address with Acknowledgements (Document acknowledgements): off by default
• Store FAQ Feedback IP Address (FAQ and document feedback): off by default
• Track PDF Downloads (PDF downloads): off by default
• Track View User Identity (Document view history): off by default
• Track Search User Identity (Search queries): off by default

Content from other websites:
Embedded content, Remote content in PDFs. Each is described under Third Party Services above.

Data shared with third parties:
Apart from the content from other websites listed above — which a visitor’s browser loads from the service hosting it, and which the PDF generator fetches only if site code turns that on — this plugin alone shares no data with third parties.

WordPress Privacy API integration:
The plugin registers a personal data exporter and a personal data eraser for the kinds of data that an export or erasure request can reach; the lists below name the kinds each request does not reach. Administrators can invoke these from Tools → Export Personal Data / Tools → Erase Personal Data. What an export request leaves out:

• Not included in an export: Suggestion Being Applied (Kept on the Document), Applying a Suggestion (Kept on the Document), Search Suggestion List, Event Log Index, Repeat-View Throttle, Dismissed Notices, Notices After an Action (On the User Profile), Queued Reminders, Scheduled Reminders, Email Sender Address, Generated Export Files, Cached PDFs, Rate-Limit Counters, Cached Document Lists, Notices After an Action (Short-Lived Copy), Document File Imports in Progress, Browser Search Cache, View Throttle Cookie — an export request does not include these; the suggested privacy-policy text says what each holds and how long it is kept.

Acknowledgement records are anonymised on erasure (user ID set to 0, IP removed) rather than deleted, so the compliance audit trail survives: the document, version, date, the role the person held, how it was given, any quiz answers and score, reading time and reach, and the expiry date are kept. What an erasure request does to each kind of data:

• Anonymised (the person’s identity is removed and the record is kept for the audit trail): Document Acknowledgements, Version Snapshots, Event Log, Document Version History, Changes Awaiting Approval, Scheduled Versions, Approval Decisions, Kept Change Text, Owner Review Sign-offs.
• Deleted: Suggestion Being Applied (Kept on the Document), Applying a Suggestion (Kept on the Document), Document Edit Suggestions, FAQ and Document Feedback, PDF Download History, Document View History, Search History, Event Log Index, Bookmarked Documents, Saved Searches, Reminder Email Preference, Dismissed Notices, Notices After an Action (On the User Profile), Comprehension Quiz Attempts, Acknowledgement Reminder History, Compliance Reminder History, Queued Reminders, Scheduled Reminders, Generated Export Files, Background Export and Import Jobs, Document File Imports in Progress, Deleted Account Records.
• Kept: Audience Lists — Audience-list memberships naming this person were kept: removing them would change who is required to acknowledge a policy. An administrator can remove the person from each list.
• Kept: Document Owner Assignments — Document owner assignments naming this person were kept: removing them would leave documents with no reviewer or approver. An administrator can reassign them; they are removed when the user account is deleted.
• Note kept: Document Version History — the person’s identity is removed, but the free-text note written with each record is kept as part of the audit trail.
• Note kept: Changes Awaiting Approval — the person’s identity is removed, but the free-text note written with each record is kept as part of the audit trail.
• Note kept: Scheduled Versions — the person’s identity is removed, but the free-text note written with each record is kept as part of the audit trail.
• Note kept: Owner Review Sign-offs — the person’s identity is removed, but the free-text note written with each record is kept as part of the audit trail.
• No eraser of its own: Search Suggestion List, Repeat-View Throttle, Email Sender Address, Cached PDFs, Rate-Limit Counters, Cached Document Lists, Notices After an Action (Short-Lived Copy), Browser Search Cache, View Throttle Cookie — no eraser is registered for these; the suggested privacy-policy text says what each holds, how long it is kept and what removes it.

Note: the WordPress exporter and eraser match rows by user account. Deleting an account does not anonymise or delete the person’s records; the plugin records a one-way hash of the deleted account’s email address, so a later request for that address still finds them, and the hash is removed when the erasure completes. Feedback submitted by logged-out visitors (which carries no account) cannot be targeted by an individual erasure request; those rows are cleared by the configurable retention purge instead. Suggested privacy-policy text is registered via wp_add_privacy_policy_content() and appears on Settings → Privacy → Policy Guide for administrators to copy into their site privacy policy.

Retention settings: the retention windows are settings under Settings → Access & Privacy → Analytics & Data Retention; a value of 0 retains indefinitely.

On uninstall: all plugin data is preserved by default — removing the plugin code does not destroy your acknowledgement evidence trail or configuration. Two opt-in toggles under Settings → System Configuration → Uninstall Behaviour, both OFF by default, remove it before you delete the plugin:

• Remove content & data on uninstall — hard-deletes every Document and FAQ post, the plugin’s taxonomy terms and its own database tables, including the acknowledgement evidence trail and activity logs, and the private upload folder. This cannot be undone. Of the personal data above, it removes: Document Acknowledgements, Suggestion Being Applied (Kept on the Document), Applying a Suggestion (Kept on the Document), Document Edit Suggestions, FAQ and Document Feedback, PDF Download History, Document View History, Search History, Search Suggestion List, Version Snapshots, Event Log, Event Log Index, Repeat-View Throttle, Bookmarked Documents, Saved Searches, Reminder Email Preference, Dismissed Notices, Notices After an Action (On the User Profile), Comprehension Quiz Attempts, Document Version History, Changes Awaiting Approval, Scheduled Versions, Approval Decisions, Kept Change Text, Owner Review Sign-offs, Audience Lists, Document Owner Assignments, Acknowledgement Reminder History, Compliance Reminder History, Queued Reminders, Scheduled Reminders, Cached PDFs, Deleted Account Records.
• Remove configuration & capabilities on uninstall — deletes all plugin options, transients and scheduled events, and the plugin’s capabilities and role. Of the personal data above, it removes: Search Suggestion List, Document Owner Assignments, Acknowledgement Reminder History, Compliance Reminder History, Queued Reminders, Scheduled Reminders, Email Sender Address, Rate-Limit Counters, Cached Document Lists, Notices After an Action (Short-Lived Copy), Document File Imports in Progress, Deleted Account Records.

Background export and import jobs and their generated files are temporary working data and are always removed on uninstall, whatever the toggles.