A fixed-price, documents-only option for the client who isn't ready.

Documents, written from the client’s own answers. For the policy sets, the client answers about 35 intake questions by email, which takes 10 to 15 minutes. We write policies tailored to the client’s stack, team size, and operating model, with SOC 2 Trust Services Criteria cited inline. Where the client’s answers show a gap against a policy, we list it for the client to close or accept before adopting the set.

• 5 custom security policies

  $85

  Information Security, Access Control, Incident Response, Acceptable Use, and Data Classification. Delivered 3 business days after the day we have the client’s answers; 1 revision.

• 12 custom security policies

  $195

  The five above, plus Risk Management, Vendor Management, Business Continuity and Disaster Recovery, Change Management, Encryption and Key Management, Logging and Monitoring, and Vulnerability and Patch Management. Delivered 5 business days after the day we have the client’s answers; 2 revisions.

• 21 custom security policies, with a SOC 2 criteria map

  $395

  The twelve above, plus nine more policies, and a SOC 2 criteria map across the set. The map covers the documents only. It isn’t a gap analysis. Delivered 7 business days after the day we have the client’s answers; 2 revisions.

• Vendor security questionnaire answers

  $85

  A customer’s CAIQ-Lite or custom questionnaire, up to 125 questions, answered to match how the client operates, with anything that needs the client’s check flagged. 50 more questions are $45 and add one business day. Delivered 3 business days after the day we have the file and answers; 1 revision.

Revisions are asked for within 10 business days of delivery (3 for the questionnaire). Control matrices, gap analyses, and other work beyond these are quoted, not priced here.

• No audits, attestations, opinions, or certifications. We do advisory, readiness, and documentation work only. The audit stays with your firm.
• We don’t decide for the client. We draft. The client reviews what we deliver before adopting it, and the decision to rely on it is theirs.
• We don’t operate, implement, or test their controls. We never touch the client’s systems.
• No promise about an audit outcome. Your firm decides what is enough. We can’t promise how anyone will judge a document.

Independence rules limit how much of this work a CPA firm can take on for its own audit client. We never audit or attest, for anyone, so we are not on the audit side of that line. How the rules apply to your firm and your client is your call, and we don’t advise on it.

• No referral fee, either way. We pay none and accept none.
• The client contracts with us directly and pays us the fixed price. Your firm is not a party to the order.
• We don’t contact your firm about the client unless the client asks us to. We don’t ask for your client list or your audit work.

Eric Cecchi founded Blank Slate Creative, a one-founder studio. He has 15 years of engineering experience and leads security engineering in his full-time role, where he writes security policies, runs vendor assessments, and answers enterprise security reviews.

An AI model helps draft the documents we write. A human security professional reads every custom deliverable before it goes out. We say so on every order page and in the terms.

We are new. Blank Slate Creative, LLC is an Illinois company formed in 2025. We have no references or case studies to share yet, and we claim no certifications. The sample policies on our home page are written for a fictional company, and say so.

That is why we ask for one client, not a commitment.

Send us one client who needs documents. They order at the fixed price above, on the same terms as anyone else. If it isn’t what you hoped for, you have committed to nothing: no exclusivity, no minimum, no fee. If we decline an order or can’t finish the work, the client gets a full refund (refunds).

1. 1You give the client our address. This page, blankslate.biz/buy, or hello@blankslate.biz. That is all we ask of you.
2. 2The client orders and answers our questions. They pay on Stripe's page, and we email the intake questions after they pay.
3. 3We deliver, and the client decides what to adopt. You see the documents only if the client shows you.

Write to hello@blankslate.biz with a question about the work, or to say a client may be in touch. Clients can also ask for a quote on the quote form.