Security policies & compliance documentation
SOC 2 readiness documentation, custom security policies, and vendor questionnaire support for startups and lean engineering teams. Tailored to your actual stack.
Bigger scope? Get a quote.
Practice Areas
Most generic template packs fall apart because they describe controls you do not run. We author defensible policies matched to your actual architecture, tooling, and team size.
Information Security, Access Control, Incident Response, Acceptable Use, and Data Classification. Tailored to your stack, cloud infrastructure, and real workflow.
3 business days from your answers · Markdown, Word, PDF · Sets of 12 and 21 also on sale
Documentation aligned with the Common Criteria and, where a policy supports them, other Trust Services Criteria. Includes inline SOC 2 Trust Services Criteria references, so a reviewer can see which criteria each policy section addresses.
Inline criteria references, in the five policies
Clear, defensible responses to SIG Lite, CAIQ-Lite, and enterprise security questionnaires. Grounded in your real systems so answers match how you actually operate.
Up to 125 questions, 3 business days from your file and answers · Up to 175: +$45, +1 day
Control matrices, gap analyses, policy work beyond the 21-policy set, and technical consulting. Built for teams with specific customer or regulatory requirements.
Custom quote
Have an upcoming audit deadline or a customer questionnaire in hand?
Tell us about it.Sample Proof
We have zero client logos or manufactured testimonials. Instead, we publish complete, full-length sample policies authored for a fictional 14-person B2B SaaS startup (Northwind Labs). See how real controls, inline SOC 2 Trust Services Criteria, and operational matrices look before buying.
Demonstrates role-based access, automated provisioning and deprovisioning SLAs, quarterly access reviews, and mandatory MFA standards. Cites SOC 2 CC6.1, CC6.2, and CC6.3.
Features operational severity matrices (SEV1–SEV4), triage workflows, incident commander roles, customer notification timelines, and post-mortem cadences. Cites SOC 2 CC7.3 and CC7.4.
Want the same, written for your stack?Order the five policies, $85
* Note: Samples are based on fictional infrastructure configurations and do not constitute legal advice. We do not guarantee audit outcomes, which depend on the operational testing performed by your independent CPA firm.
From the guides
Plain-language guides to the paperwork: what the questionnaires ask, which policies to write first, and what to do when you don’t have the control. Each one cites its public sources.
A note on how we operate
Contact
Tell us about your upcoming audit, buyer questionnaire, or policy needs. We aim to reply within one business day, with a flat-fee quote or the questions we need answered first.
Or write to hello@blankslate.biz