Open-source SOC 2 policy generator

Your 22 SOC 2 policies, free, in 90 seconds, in your browser.

No signup. Nothing uploaded: the policies render on your machine from Apache-2.0 templates you can fork. Also a CLI, so the same set builds in CI.

Generate my 22 policiesView the source on GitHub

Optional: the $39 Audit Kit tailors sections 4 and 5 to your stack with Claude and adds the Word, crosswalk, acknowledgment and calendar files. See a sample.

How it works

Three steps, no account

  1. 1

    Answer 23 questions

    Company, product, headcount, cloud, source control, identity provider, MFA, MDM, data types, vendors, owners, scope and review cadence. Takes about a minute; answers stay in your browser.

  2. 2

    The 22 policies render instantly

    The templates are deterministic Markdown with conditional blocks. The same answers always produce the same text, so there is nothing to wait for and nothing to send anywhere.

  3. 3

    Download, commit, adopt

    Get a ZIP of 22 Markdown files, read them with the tools open, have management approve them and have everyone acknowledge them. The CLI keeps the review dates honest in CI.

Free vs Audit Kit

The free set is complete. The kit is for the examination.

Everything you need to adopt a policy set is free. The Audit Kit adds stack-specific wording and the documents a CPA firm asks for alongside the policies.

FeatureFreeAudit Kit, $39
PoliciesAll 22All 22
CustomizationDeterministic text from your 23 answersClaude rewrites Policy Statements and Procedures for the tools you named; you review the result
FormatsMarkdown ZIPWord (DOCX) with document control tables, plus Markdown
Criteria crosswalkNocrosswalk.xlsx: every criterion in your scope (33 common criteria, plus Availability and Confidentiality when selected; up to 38) mapped to policy and section, with an evidence checklist
Acknowledgment formNopolicy-acknowledgment.docx (form and roster)
Review calendarCLI check for overdue reviewsreview-calendar.ics: eleven monthly review sessions covering all 22 policies, plus an annual attestation
Auditor questionsGuide on this siteREADME with 25 questions, answers and pointers into the kit
Where it runsYour browser or the CLIYour browser; tailoring calls a stateless API
Price$0, Apache-2.0$39 one-time, 14-day refund on request
Start with the free setWhat is in the Audit Kit

The policy set

22 policies, one owner each

Every policy has the same nine sections: Purpose, Scope, Roles and Responsibilities, Policy Statements, Procedures, Exceptions, Enforcement, Review Cadence and Revision History. Open any one to read the template and the criteria it addresses.

Not sure which to write first? Read the 22 policies a startup needs, in order.

How this compares

Free SOC 2 templates already exist. Here is what is different.

You do not need Policyseed to get a free policy set. StrongDM Comply (Apache-2.0, 27 policies, Go and pandoc toolchain) and JupiterOne security-policy-templates (CC BY-SA 4.0, 25 policies and a large procedure library) are both solid, and several compliance vendors publish template packs in exchange for an email address.

What Policyseed adds is the customization step. The templates carry conditional blocks for your identity provider, MDM, data types, scope and work model, so the output describes a company like yours rather than a generic one, and it renders in the browser in seconds with nothing installed and nothing uploaded. The CLI runs the same templates in CI and fails the build when a review is overdue. The paid Audit Kit then covers the audit-prep artifacts that the free projects leave to you: stack-specific wording, Word documents, the criteria crosswalk and evidence checklist, acknowledgment forms and a review calendar.

A feature-by-feature comparison of the three open-source projects is on the comparison page; the free template index is at free SOC 2 policy templates.

Generate the 22 policies now

About 90 seconds, in your browser, no account. Upgrade to the Audit Kit later if you want the tailored Word set and the crosswalk.

Open the generatorSee pricing

Frequently asked questions

Is the generator really free?
Yes. The 22 templates, the renderer and the CLI are published under Apache-2.0 on GitHub, and the web generator runs entirely in your browser without an account. The Audit Kit ($39 one-time) is optional and adds AI tailoring plus the Word, spreadsheet and calendar files.
Do you store my answers or my policies?
No. The free generator never sends your answers to a server; they are kept in your browser's local storage so you can come back to them. If you buy the Audit Kit, the answers travel as metadata on the Polar checkout and are sent to the tailoring API for the duration of each request. Policyseed has no database and stores nothing.
Are these policies enough to pass a SOC 2 audit?
Policies are one part of a SOC 2 examination, not the whole of it. The CPA firm you engage examines your controls and forms its own opinion; the policies must describe what you actually do, and you need evidence that the procedures run. Policyseed produces governance policy templates and, in the Audit Kit, AI tailoring and audit-prep documents. It is not legal advice and it does not guarantee any examination outcome.
How is this different from the free templates on GitHub?
StrongDM Comply and JupiterOne security-policy-templates are good open-source policy sets, and vendor template packs exist as well. Policyseed adds instant customization in the browser (conditional content by identity provider, MDM, data types, scope and work model), a CLI check that fails CI when a review is overdue, and the optional Audit Kit with Word documents, a criteria crosswalk, an acknowledgment form and a review calendar.
What exactly does the Audit Kit add?
Claude rewrites sections 4 (Policy Statements) and 5 (Procedures) of each policy using your intake, so the text names your identity provider, cloud, source control and vendors. You get 22 DOCX files, crosswalk.xlsx with an evidence checklist, policy-acknowledgment.docx, review-calendar.ics and a README with 25 auditor questions, all assembled as a ZIP in your browser. Four generation passes per license key; refund within 14 days on request.
Can I run it in CI instead of the browser?
Yes. The CLI (npx policyseed init, build, check) renders the same 22 policies from an intake.yaml file with no network calls, and check exits 1 when any policy's last revision date is older than its review cadence. The docs include a GitHub Action that runs it weekly.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.