The terms for our fixed-price orders.

Blank Slate Creative, LLC is an Illinois limited liability company. In these terms, “we” and “us” mean Blank Slate Creative, LLC, and “you” means the company or person who places the order.

Our postal address is:

• Custom security policies: five, twelve, or twenty-one. Five, twelve, or twenty-one security policies, written from your answers to our intake. The order page lists the policies in each size. Delivered as Markdown, Word, and PDF. The twenty-one-policy order also includes the SOC 2 criteria map: a table of which of your policies cite each SOC 2 Trust Services Criterion, and which criteria none of them cite. It maps your documents only. It is not an audit or an assessment of your controls. Revisions: one is included with five policies, and two are included with twelve or twenty-one. You must ask for them within ten business days of delivery. For twelve or twenty-one, both revisions fall within that one ten-business-day window, which starts when we first deliver; a revised set does not start a new one. If we get something wrong, we fix it when you tell us, and that doesn’t use a revision.
• Vendor security questionnaire, up to 125 questions. Your customer’s questionnaire, completed from your answers and returned as a spreadsheet with a summary. The optional add-on covers 50 more questions. One revision is included if you ask within three business days of delivery.
• Template downloads: the five-policy bundle, or one policy. The bundle is five editable policy templates and a fill-in guide. A single-policy template is one of those five, with a fill-in guide for that policy alone. Both come as Word and PDF files, downloaded after payment. A single-policy template may use a term, or point to another policy, that is defined in a policy you did not buy; the order page says where.

The custom policy orders and the questionnaire order are the “service orders” in these terms. The template downloads are not.

The order page for each item is part of these terms. If it says an order includes or excludes something, that is what you are buying.

• Documentation and readiness work only. We never perform an audit, an attestation, or a certification, and nothing we deliver is one. SOC 2 attestation comes from an independent CPA firm.
• We do not promise that your company will pass an audit, or that a customer, auditor, or regulator will accept what we deliver.
• We do not test, scan, or access your systems.
• Nothing we deliver is legal advice.

For the service orders, we email you our intake questions after your order comes in. For the questionnaire order, we also ask for your questionnaire file.

Delivery is a set number of business days after the day your completed intake comes back to us: your answers, and your file where it applies. The number is three for five custom policies, five for twelve, and seven for twenty-one. For the questionnaire it is three, or four when you add the extra-50-questions option. The day it comes back is not one of the days. A business day is Monday to Friday, not counting US federal holidays. We count business days in US Central Time. How fast we send the questions never uses up your days. Late or incomplete answers move the date by the same amount. We do not offer faster delivery at the moment. Check that the timing works for your date before you order.

If we are more than two business days past the delivery date, you may cancel before we deliver and get a full refund. See the refund policy.

An AI model helps draft the documents we write. A human security professional reads every custom deliverable before it goes out.

The template downloads need nothing from you. The download page opens as soon as you pay.

• The documents we write describe the controls you tell us you run. You are responsible for the accuracy of your answers, and for making sure your company actually operates what its policies and questionnaire answers say.
• You review what we deliver before you adopt it, share it with a customer, or submit it to an auditor. The decision to rely on it is yours.
• You confirm that you may give us your questionnaire and your answers, and that you may let our service providers, including an AI provider, process them to prepare your order.
• If your questionnaire is under a non-disclosure agreement, redact your customer's name and any other third-party names before you send it, and check what the agreement allows.
• Please do not send credentials, customer data, or other secrets. We do not need them.

We may decline any order before work starts, including for a conflict of interest, and we may end one already started if we can’t finish the work. If we do, we refund it in full.

Prices are in US dollars and are shown on each order page, plus any tax we’re required to collect. You pay through Stripe. Stripe handles your card details, and we never see them. Refunds are covered by the refund policy.

We use what you send only to prepare your order. We handle it with the service providers named in the privacy notice, including the AI provider that helps us draft your documents. We share it with no one else, except where the law requires, with advisers who keep it confidential, or in a sale of the business. Your questionnaire and your answers stay yours. We do not publish them or use them for another customer’s order.

Once you have paid for a service order, you may use and edit the documents we wrote for it, and share them, for your own business, including with your customers and your auditors. We keep our templates, methods, and general know-how, and any rights we have in them.

When you buy the bundle or a single-policy template, you may use it and edit it for your own company’s internal use, and share the edited versions inside your company. You may not resell the bundle or any of its templates, give them away, or publish them as your own product. We keep the copyright.

An AI model helps draft the documents we write. We work from public frameworks, such as the SOC 2 Trust Services Criteria and NIST references. We never draw on any other company’s confidential material.

The service orders are written for your company, and a human security professional reads every custom deliverable before it goes out. The template downloads are the same files for every buyer, so we do not review them order by order.

In these terms, a custom deliverable is a document set we send you for a service order.

We deliver what the order page describes. Beyond that, we make no warranties, express or implied, about what we deliver, including that it suits a particular audit, customer, or purpose. We do not warrant that any customer, auditor, or regulator will accept it. This does not disclaim anything the law does not allow us to disclaim.

To the extent the law allows, our total liability for any claim about an order is limited to the price you paid for that order. We are not liable for indirect or consequential losses, including a lost deal, a delayed sale, or a failed audit. Nothing in these terms limits a liability that the law does not allow us to limit.

These terms are governed by the laws of the State of Illinois. If something goes wrong, please email us first. We would rather fix it than argue about it.

If we change these terms, we post the new version here with a new date. The version in force when you pay applies to your order. Questions: hello@blankslate.biz.