Skip to content
Get a fixed quote

Policies for SaaS and technology companies

Security and privacy policies for SaaS companies and startups, with AI governance, drafted the way enterprise buyers, auditors and investors read them, at a fixed price. Each of the three services is quoted at one fixed figure between $1,200 and $5,000 before we start.

Get a fixed quoteSee pricing

Updated

What you have to show, and to whom

  • Information security policy set, for enterprise customers, SOC 2 and ISO 27001 auditors
  • Access control policy and acceptable use policy, within the information security policy set, for staff and the auditor who samples them
  • Incident response procedure and business continuity and backup policy, within the same set, for the customers who send security questionnaires
  • Privacy notice, cookie notice, data protection policy and data subject request procedure, within the privacy policy pack, for users, regulators and the data protection questions in procurement
  • AI governance suite, for customers and regulators where the product uses or offers AI

The three services that draft these documents

  • Information security policy set

    $1,200to $2,500

    First draft in 12 working days.

    An information security policy set is the group of written policies and procedures that states how a company protects its systems and data: who may access what, how staff may use company devices, how incidents and outages are handled, which vendors may hold the data, and who owns each control.

    Usually first: the questionnaire opens by asking for it.

  • Privacy policy pack

    $1,200to $2,500

    First draft in 10 working days.

    A privacy policy pack is the set of public notices and internal documents that state what personal data an organisation collects, why, who receives it, how long it is kept and how people exercise their rights, drafted against each privacy law that applies, such as GDPR, the CCPA or the Nigeria Data Protection Act 2023.

  • AI governance suite

    $3,000to $5,000

    First draft in 20 working days.

    An AI governance documentation suite is the set of policies, procedures and record templates that sets out how an organisation approves, risk-assesses, oversees and monitors the AI systems it builds or uses, and keeps the evidence of each step in the form the EU AI Act, the NIST AI RMF and ISO/IEC 42001 describe.

What the documents have to do

An information security policy set is the collection of policies and procedures that states how a company protects its systems and data: who may access what, how changes and incidents are handled, and who is responsible. Each reader looks for something specific.

A procurement team checks that the policies answer the questions on its questionnaire, in the order the questionnaire asks them. An auditor checks that each policy names an owner, a review date and the control it supports, and that the procedure matches what the sampled evidence shows. A data protection authority or a user checks lawful bases, retention and rights. A customer deploying your AI feature checks risk management and human oversight. A generic template gives each of them nothing specific to check, because it names no owner, no tool and no control.

  • Enterprise procurement

    Document

    Information security policy set

    What they look for

    Answers to the questionnaire, named owners, a review date

  • SOC 2 or ISO 27001 auditor

    Document

    Information security policy set, including the access control policy and incident response procedure

    What they look for

    Controls mapped to ISO/IEC 27001:2022 Annex A and SOC 2 criteria CC6 and CC7, procedures that match the evidence

  • Data protection authority or user

    Document

    Privacy policy pack, drafted against GDPR Articles 13 and 14, CCPA sections 1798.100 to 1798.135 and Nigeria Data Protection Act 2023 section 27 as they apply

    What they look for

    Lawful bases, retention, rights, transfers, named processors

  • Customer deploying your AI feature

    Document

    AI governance suite

    What they look for

    Risk management (EU AI Act Article 9), data governance (Article 10), record-keeping (Article 12), human oversight (Article 14)

Who needs these documents, and when

These documents are for a SaaS company whose first enterprise prospect has sent a security questionnaire, a team preparing for a SOC 2 Type 1 report or an ISO/IEC 27001 certification audit, a product that processes personal data from more than one jurisdiction, or a company that has added AI to its product and now has customers asking how it is governed. The readers are procurement teams, auditors, data protection authorities, users and the customers who deploy your AI, and the documents are drafted for them.

What we draft for a SaaS company

Each document and what it is drafted against:

  • Information security policy set: ISO/IEC 27001:2022 Annex A and the SOC 2 Trust Services Criteria for security, principally CC6 on logical and physical access controls and CC7 on system operations. It is set out in the structure a questionnaire follows.
  • Privacy policy pack: whichever of GDPR (Regulation (EU) 2016/679, Articles 13 and 14), the CCPA as amended by the CPRA (California Civil Code sections 1798.100 to 1798.135) and the NDPR apply to your users, covered in one set. It holds a notice for each audience and the internal procedures behind it.
  • AI governance suite, where your product uses or offers AI: each system documented against the EU AI Act (Regulation (EU) 2024/1689, Articles 9 to 14 and 26), the NIST AI RMF 1.0 and ISO/IEC 42001:2023.

The information security policy set and the privacy policy pack are each $1,200 to $2,500. The AI governance suite is $3,000 to $5,000. The quote is fixed before we start and does not change. Each document is drafted from your intake, reviewed by our legal team and delivered in Word and PDF.

The order to write them in is set out in the policies a SaaS startup needs first. What each privacy notice has to contain is in GDPR, CCPA and NDPR privacy notices: what each needs, and what an AI deployer has to keep on file is in EU AI Act: what a deployer has to document.

Nigerian data protection law is still known as the NDPR, but the Nigeria Data Protection Regulation 2019 was retired as an instrument by the Nigeria Data Protection Commission's General Application and Implementation Directive 2025, so the privacy policy pack cites the Nigeria Data Protection Act 2023 (section 27) and the directive (Article 27(3)).

Drafted against

  • SOC 2 Trust Services Criteria for security: CC6 and CC7
  • ISO/IEC 27001:2022 Annex A
  • GDPR, Regulation (EU) 2016/679: Articles 13, 14 and 30
  • CCPA as amended by CPRA: California Civil Code sections 1798.100 to 1798.135
  • Nigeria Data Protection Act 2023: section 27
  • Nigeria Data Protection Commission General Application and Implementation Directive 2025: Article 27(3)
  • EU AI Act, Regulation (EU) 2024/1689: Articles 9 to 14 and 26
  • NIST AI RMF 1.0: Govern, Map, Measure, Manage
  • ISO/IEC 42001:2023

What the intake asks about your tools and data

The intake asks which tools you run and who administers them, where your customers and users are, what data the product stores and for how long, who is on call when something breaks, and which questionnaires or audit criteria you have been sent. Send the questionnaire once we reply, and the documents are drafted to answer it in its own order.

Start the intake

Questions about security and privacy policies for SaaS companies

Will the information security policy set get a SaaS company through a SOC 2 audit?
The information security policy set is structured the way SOC 2 auditors expect to read it and is drafted against the Trust Services Criteria for security, principally CC6 and CC7. The audit also tests whether you follow the policies, and that part is your operation, not the document. PolicyDrafters drafts the documents and, under the maintenance plan, keeps them current.
We are an early-stage SaaS startup. Which document do we need first?
The first document a SaaS startup needs is usually the information security policy set, because an enterprise security questionnaire opens by asking for it. The privacy policy pack follows as soon as the product processes personal data from the EU, California or Nigeria.
Can the information security policy set name the tools we actually use?
The information security policy set can name the tools you actually use. The intake asks which identity provider, cloud, ticketing and monitoring tools you run, and the procedures name them, so the set describes your company rather than a generic one.
What happens when SOC 2, ISO 27001 or privacy law changes?
Under the maintenance plan, PolicyDrafters tracks the rules each document names, such as ISO/IEC 27001 Annex A, the SOC 2 Trust Services Criteria and the privacy laws the privacy policy pack was drafted against. When one moves, you receive a revised document with the changes marked and a new revision code, reviewed by our legal team before it is sent.

Guides that go deeper