Documentation, productized.

The legal obligation

GDPR’s accountability principle (Art 5(2)) is operationalised in documentation: Records of Processing (Art 30), processor agreements (Art 28), privacy notices (Art 13–14), breach handling (Art 33–34). ISO 27001 / SOC 2 documentation is where contracts or partners demand formal security posture. None of it is optional paperwork — it is how compliance is demonstrated.

How we solve it

Productized, self-serve packs, with a commercial use license and no attribution required:

• GDPR documentation pack — RoPA, DPAs, privacy policy, breach & DSAR procedures, retention policy.
• ISO 27001 policy pack — policy set + Statement of Applicability.
• SOC 2 readiness pack — controls mapped to the Trust Services Criteria.
• Vendor security questionnaire pack — standardised, repeatable assessment.
• AI governance / EU AI Act policy pack — policy and risk work for AI providers and deployers.

Buy once, keep the annual-update edition, adapt to your stack.

What you provide at purchase

• Company legal details (name, reg. no, address).
• Processing profile: systems, purposes, data categories, recipients, countries.
• Roles/staff relevant to data handling.
• Any existing contracts and DPAs you have in place.

Pricing

Commercial use license, no attribution. Unless an exemption applies. Talk to us.