The paste test is ten scenarios, one at a time: would you paste this? It scores out of ten and produces a card you can download.
Five minutes, no sign-up, nothing recorded anywhere. Which is both the appeal and the limitation — see below.
Three of the ten scenarios are perfectly safe, and that is the part that catches people. Someone who answers "wouldn't paste" to everything scores between five and seven — the composition of the question pool is held to that by an automated test, deliberately.
That is the lesson the whole thing exists for. "Never use AI for anything" is not a policy anyone follows for longer than a fortnight. Knowing which three of ten are fine is the skill people actually need, and it is the only version that survives contact with someone under deadline.
It also inoculates against the usual failure of awareness training, which is teaching a reflex so blunt that the first sensible exception discredits the whole session.
Staff awareness activity is an evidence requirement in most of the frameworks an organisation ends up under — ISO/IEC 27001 A.6.3, SOC 2 CC1.4, Essential Eight maturity reporting, and the "appropriate organisational measures" language that appears in nearly every privacy regime.
The score card carries the date and the result, so it can sit in a training folder alongside everything else you keep.
Describe it accurately, which here means describing it narrowly.
This is evidence that a person completed an awareness activity on a given date. It is not accredited training, it is not a certification, and it does not by itself satisfy any control.
Anyone who writes "certified" on it has created a worse problem than the one they were solving — an overstated control is the kind of thing an assessor finds and then starts wondering what else was overstated. Claim the small true thing.
Nothing about a run of the test is recorded anywhere. The score exists in the page in front of the person and in the card they download, and that is all — there is no server-side record, no account, and therefore no attendance report.
That is a deliberate trade and it costs something real. If you need completion tracking across a headcount, this is not the tool: use it as the content inside whatever LMS you already run, and let that system do the counting. If you need something lighter, ask people to send you the card — which is a nudge rather than a control, and worth calling what it is.
The reason it works this way is the same reason the checker does. A tool that recorded who scored badly on a data-handling quiz would itself be a small pile of sensitive personnel data, held by us, about your staff. Not collecting it is the only version we would be comfortable defending on the privacy page.
Everything in this kit is released under CC0 — public domain. No attribution, commercial use fine, and rewriting it in your own voice is encouraged rather than merely tolerated. Deliberately not CC BY: an attribution requirement nobody can satisfy inside an internal policy document would make ordinary use technically infringing, and this exists to be used.
One ask, not a rule: leave a link to dontpastethat.com somewhere in it. It is the only thing that turns a paragraph someone skimmed into a page they can actually read when they need it.