Compliance docs, drafted in minutes
not months

GDPR & CCPA compliant privacy policy drafted from your actual data practices — subprocessors, retention, lawful bases, and user rights.

Plain-English ToS covering acceptable use, payment, subscriptions, UGC, liability cap, and governing law — adapted to your business model.

Cookie-category table with provider disclosures, opt-out links, and ePrivacy Directive notes — matched to your actual analytics and ad stack.

Refund & cancellation policy for SaaS subscriptions. Covers pro-rata refunds, free trial terms, EU 14-day cooling-off rights, and governing law.

Define prohibited uses, enforcement actions, and user obligations for your platform. Covers spam, scraping, UGC, IP infringement, and enforcement procedures.

Article 28 DPA ready to send to B2B customers. Sub-processor list, TOMs, breach notification, international transfer clauses, and audit rights included.

HIPAA BAA for US healthcare SaaS. Covers ePHI safeguards, breach notification, permitted uses, sub-contractor BAA chain, and state-specific addenda.

Mutual or one-way NDAs for contractors, investors, and partnerships. Optional non-compete, non-solicitation, and liquidated damages clauses. Jurisdiction-specific.

SOC 2–aligned InfoSec policy covering access control, encryption, vulnerability management, incident response, and vendor risk. Tailored to your stack.

Generate a NIST-structured Incident Response Plan. Covers severity classification, CSIRT roles, containment playbooks, GDPR 72-hour breach notification, and post-incident review.

Generate a GDPR Article 35 Data Protection Impact Assessment. Covers necessity & proportionality test, risk assessment table with residual risk ratings, safeguards map, and Art. 36 DPA consultation check.

Generate a GDPR-compliant Data Retention Policy with per-category retention schedules, deletion procedures, legal basis table, backup retention, and legal hold process.

Generate your CCPA/CPRA compliance pack: Notice at Collection, Do Not Sell or Share opt-out page, and California Consumer Privacy Rights summary.

Generate a GDPR Art. 28(4) public sub-processor list with 40+ pre-loaded vendors, transfer mechanisms, processing countries, and DPA links.

Generate a Business Continuity & Disaster Recovery Plan with RTO/RPO objectives, recovery playbooks, and SOC 2 A1 / GDPR Art. 32 alignment.

Generate a security questionnaire to send to new SaaS vendors before onboarding. Covers data handling, access controls, SOC 2, GDPR, and sub-processor obligations.

Generate GDPR-compliant response letters for Data Subject Requests — access, erasure, portability, rectification, restriction, and objection. Covers all 8 rights under Art. 15–22.

GDPR Article 13/14 compliant privacy notice for employees, contractors, and job applicants. Covers HR data, lawful bases, monitoring, retention, and data subject rights.

Form-based Records of Processing Activities builder. Document each processing activity with data subjects, lawful basis, retention periods, recipients, and international transfers.

Evaluate your current security controls against SOC 2 Trust Service Criteria. Get a gap report with prioritised remediation roadmap and policy document checklist.

Assess readiness for ISO/IEC 27001:2022 certification across 28 Annex A controls in 14 domains. Gap report with phased remediation roadmap.

Generate Art. 50 transparency notices and provider/deployer compliance documentation for your AI system under Regulation (EU) 2024/1689.

Assess your organisation against all 10 NIS2 Art. 21 cybersecurity requirements. Get a scored gap report with prioritised remediation roadmap for EU digital service providers.

Generate a HIPAA SRA covering all Administrative, Technical, and Physical Safeguards (45 CFR Part 164). Required for all covered entities and business associates.

Generate a Schrems II-compliant TIA for all international data transfers. Covers SCCs, EU-US DPF, UK IDTA, BCRs, country risk analysis, and supplementary measures.

Generate a PCI DSS v4.0 Self-Assessment Questionnaire. Covers SAQ A, SAQ A-EP, SAQ C, and SAQ D for merchants and service providers.

Generate a LGPD-compliant Aviso de Coleta, Data Subject Rights Summary, and Privacy Policy addendum for Brazil's Lei Geral de Proteção de Dados.

Generate a complete Third-Party Risk Management policy with vendor tiers, due diligence matrix, contract requirements, and monitoring controls.

Audit your CMP configuration, consent banner, consent records, and Google Consent Mode v2 against GDPR, ePrivacy, and CCPA requirements.

Generate a documented Legitimate Interests Assessment (LIA) for GDPR Art. 6(1)(f). 3-step balancing test with conclusion and privacy notice guidance.

Generate an EU AI Act–compliant Model Card for your AI system. Covers GPAI Art. 53 technical documentation, risk classification, bias evaluation, training data governance, and safety measures.

Generate a Whistleblower (Speak Up) Policy compliant with EU Directive 2019/1937 and UK PIDA. Covers reporting channels, protected disclosures, anti-retaliation protections, and GDPR-compliant data handling.

Generate an AI Acceptable Use Policy for your SaaS product. Covers EU AI Act obligations, prohibited AI inputs and outputs, bias and accuracy disclosures, human oversight levels, data training transparency, and enforcement mechanisms.

Generate a COPPA-compliant and GDPR Article 8 Children's Privacy Notice. Covers parental consent verification, age thresholds by jurisdiction, data minimisation for children, UK Children's Code obligations, and parental rights.

Generate a GDPR Article 33 supervisory authority breach notification form, Article 34 individual notification letter, and Art. 33(5) breach register entry — with 72-hour deadline guidance and DPA-specific filing instructions.

Get a personalised SOC 2 evidence collection checklist by Trust Service Criteria control area — with exact evidence items, auditor expectations, collection steps for AWS/GitHub/GCP, and PBC folder organisation guide.

Generate a complete security & compliance Trust Centre page for your SaaS website. Covers certifications, infrastructure, encryption, pen testing, bug bounty, sub-processors, privacy & a security FAQ for enterprise prospects.

Generate a GDPR Article 35 DPIA specifically for AI systems. Covers EU AI Act risk classification, Annex III use cases, automated decision-making (Art. 22), bias assessment, human oversight documentation, and DPA consultation analysis.

Assess your readiness for ISO/IEC 27701:2019 PIMS certification — the privacy extension to ISO 27001. 26 controls across 8 domains. Annex A (controllers) + Annex B (processors). Includes ISO 27701 ↔ GDPR alignment map and certification roadmap.

Generate a complete Security Awareness Training Policy for your SaaS. Training schedule, curriculum, phishing simulation programme, completion tracking, and graduated consequences. Mapped to SOC 2 CC1.4, ISO 27001 A.6.3, HIPAA §164.308(a)(5), NIS2 Art. 21(2)(g), PCI DSS Req 12.6, GDPR Art. 32.

Generate an internal GDPR data subject access request (DSAR) policy covering all 8 rights, identity verification, per-right procedures, timelines, refusal grounds, DSR register template, and escalation paths.

Generate a comprehensive AI risk register covering EU AI Act compliance, GDPR Art. 22 ADM risks, algorithmic bias, prompt injection, model drift, and ISO 42001 — with inherent risk scores and mitigation plans.

Generate Art. 28(3)(c) TOMs documentation — encryption, access control, incident response, audit rights, and sub-processor obligations.

Generate an employee IT acceptable use and BYOD policy covering device controls, network access, cloud apps, remote work, and monitoring disclosure.

Generate a complete Access Control Policy covering RBAC, least privilege, MFA, privileged access management, user provisioning, access reviews, and remote access controls.

Generate a Data Classification Policy with tiered classification levels (Public/Internal/Confidential/Restricted), handling standards, storage controls, labelling, and disposal procedures.

Generate a Vulnerability Management & Patch Management Policy with scanning cadence, CVSS severity classification, remediation timelines, exception handling, and compliance mappings.

Generate a Cryptography & Encryption Policy with approved algorithms, at-rest and in-transit encryption requirements, key management lifecycle, TLS standards, and compliance mappings.