Skip to content

Five security policies, written for your stack.

Information Security, Access Control, Incident Response, Acceptable Use, and Data Classification, tailored to your stack and team, with SOC 2 criteria cited throughout. Flat fee. Three business days after the day we have your answers.

Who it’s for. For small companies asked for security policies by a customer, an investor, or a SOC 2 effort.

$85

Flat fee, paid once.

Order the five policies, $85

You pay on Stripe’s secure page. We never see your card details.

Refunds. If we decline your order or can't finish the work, you get a full refund. Ask before we have your answers and you get one too. The refund policy has the cases.

Who reads it. An AI model helps draft the documents we write. A human security professional reads every custom deliverable before it goes out. Who we are.

Delivery
3 business days after the day we have your answers
Formats
Markdown, Word, PDF
Revisions
1, within 10 business days of delivery
Five policy documents standing in a row, drawn as an isometric plan.

5 custom security policies

What you get

  • Five policies: Information Security, Access Control, Incident Response, Acceptable Use, and Data Classification.
  • Tailored to your intake answers: your cloud, your identity setup, your team size, and how you work.
  • SOC 2 Trust Services Criteria cited inline, so a reviewer can see which control area each section addresses.
  • Delivered as Markdown, Word, and PDF.
  • One revision, if you ask within ten business days of delivery. If we get something wrong, we fix it when you tell us, and that doesn't use your revision.

See the standard first. Two full sample policies, written for a fictional company:

Security policies

What we need from you

  • Intake answers, about 35 questions that take 10 to 15 minutes: company size and industry, tech stack and cloud provider, your target framework (SOC 2 Type I, Type II, or baseline policies), any policies you already have, and what prompted this.
  • We email the questions after you pay. You answer by reply.
  • An AI model helps draft the documents we write. A human security professional reads every custom deliverable before it goes out.

Three sets

Which set fits?

Each set includes the one before it, written from the same intake. Pick the one you will actually adopt: a reviewer compares every policy with how you really work.

What this is not

  • Documentation and readiness work only. Never an audit, an attestation, or a certification. SOC 2 attestation comes from an independent CPA firm.
  • No promise that your company will pass an audit, or that a customer will accept what we write.
  • Not penetration testing or vulnerability scanning. We never touch your systems.
  • Not a control matrix or a gap analysis. Those are quoted separately.

Practical rigor · No manufactured claims

How it works

From payment to delivery.

  1. Step 01

    You pay

    On Stripe's page, for a flat fee. We never see your card details.

  2. Step 02

    We send the intake

    We email you the intake questions after your order comes in.

  3. Step 03

    The clock starts

    Three business days after the day your completed intake comes back to us. The day it arrives is not one of the three. The sooner it arrives, the sooner you have your policies.

  4. Step 04

    We deliver, and revise once

    The finished policies come by email. Ask for your one round of revisions within ten business days.

Order the security policies.

$85

Flat fee, paid once.

Order the five policies, $85

You pay on Stripe’s secure page. We never see your card details.

Questions

Questions about the security policies.

What formats do the policies come in?
Markdown, Word, and PDF, so you can edit in whichever one you use.
What does the one revision cover?
One round of changes to the five policies we delivered, if you ask within ten business days of delivery. Send all your changes in one email: a role, a tool name, a retention period, or a clause that doesn't match how you work. We make every change, check that the five policies still agree with each other, and send the set back once. A revision changes what we delivered. It doesn't add a policy, a gap analysis, or a control matrix. Those are quoted separately.
Will these policies get us through a SOC 2 audit?
No document can promise that. We write readiness documentation, and we never audit, attest, or certify. A SOC 2 report comes from an independent CPA firm, which tests whether you do what the policies say.
Can I see what the policies look like first?
Yes. Above, there are two full sample policies, an Access Control policy and an Incident Response policy, written for a fictional company. Your five are written from your own intake answers.
Who reads them before they reach me?
An AI model helps draft the documents we write. A human security professional reads every custom deliverable before it goes out. We say so on this page and in the terms.
What if we have nothing written down yet?
That is common for early-stage teams. Your intake answers are what we work from.
Can you do faster than three business days?
Not at the moment. Check that three business days works for your date before you order.
Which set should I choose?
Core 5 if a customer or a questionnaire asked for your basic policies. The 12-policy set if reviewers are asking about risk, vendors, continuity, or change control. The 21-policy set if you are preparing for a SOC 2 audit and want every policy in our library plus the criteria map. A bigger set is a bigger read for your team, so pick the one you will actually adopt.
Can you write more than these five policies?
Yes. The 12-policy set ($195) adds seven more, and the 21-policy set ($395) adds the rest of our library and a SOC 2 criteria map. Control matrices, gap analyses, and policy work beyond our 21-policy set are quoted, not priced here. Email us and describe what you need.
Do you take every order?
We may decline an order before work starts, including for a conflict of interest, or end one if we can't finish the work. If we do, you get a full refund.

Your order is covered by our terms, refund policy, and privacy notice. Questions first? Email us.

Pricing

Other orders.

See every order and price

Need something bigger? Control matrices, gap analyses, and policy work beyond our 21-policy set are quoted.

Ask for a quote