Control matrix, policy templates, evidence checklists, four read-only GitHub scripts, an AWS IAM review helper, and a monthly review runner. Built for teams that need to get audit-ready without pretending they need enterprise tooling on day one.
Best fit: teams under about 25 people, first SOC 2 push, GitHub-heavy workflow, limited budget, and no appetite for a compliance platform before the process itself is stable.
Why teams buy this
Start cheaper
Not ready to buy? Take the free starter pack first. It gives you the first-week checklist, access review checklist, and risk register template you can use immediately.
Get the starter pack by emailStarter control matrix, gap-analysis walkthrough, evidence checklists, risk register templates, and a monthly security review template.
Twelve editable policy templates sized for smaller SaaS teams instead of enterprise theatre.
Four read-only GitHub evidence scripts, an AWS IAM review helper, and a monthly runner with sample output.
Comparison
When the DIY path is enough, when it is not, and what you actually need before paying for a platform.
Comparison
The blunt version for early teams: what software helps with, what it does not, and where the money goes.
Decision guide
Usually not. This page walks through the exceptions.
A plain starting point for policies, evidence, and a monthly review rhythm.
The order of operations that avoids rework.
Useful immediately, even if you never buy the paid toolkit.
Launch price
$129
Use code LAUNCH50 at checkout. Standard price is $179. The launch code is for the first 20 buyers.
Preparation tooling for small SaaS teams building an ISMS without a compliance platform: all 93 Annex A controls in a starter matrix, gap-analysis walkthrough, scope statement and SoA templates, risk and asset registers, 10 editable policy templates, a 22-item audit-readiness checklist, and management review formats.
One-time price
$169 / £129
Prep tooling, not certification. Only an accredited certification body can audit and certify you — this gets your documents and routine in order before that audit.
This helps you prepare for SOC 2. It does not certify you. You still need a licensed auditor. What this toolkit does is stop you starting from a blank page and give you a sane evidence rhythm before fieldwork.
If your stack is sprawling, customers demand continuous monitoring, or you are already deep into Type 2, a platform may be worth it. If not, start smaller.