# PolicyDrafters

> PolicyDrafters is a fixed-price policy and procedure drafting firm for regulated and scaling businesses, with every document drafted by our senior team, reviewed by our legal team and kept current under a maintenance plan.

PolicyDrafters is a trade name of Drafters Collective LLC. PolicyDrafters drafts, reviews and maintains documents. It does not advise on your legal position.

Founded in 2026.

## Situations
- A customer sent a security questionnaire: Six policies drafted against ISO/IEC 27001:2022 Annex A and the SOC 2 security criteria, so that each question has a clause to point at, with a control table of the questions each document answers. The answers themselves still describe the controls you actually run. [Service](https://policydrafters.com/services/information-security-policies), $1,200 to $2,500, first draft in 12 working days.
- Procurement asked to see your policies and procedures: The policy set and the written procedures a customer's onboarding or vendor review asks for, drafted to be read question by question, or a single policy at $350 to $500 where one document is the gap. [Services](https://policydrafters.com/services), $1,200 to $2,500 a set, first draft in 12 working days.
- A privacy notice and a cookie notice are due: The external privacy notice, the cookie notice and the internal data protection policy, drafted against GDPR, the CCPA and Nigeria's Data Protection Act. The cookie notice is written to sit inside a consent banner that you or your developer configure. [Service](https://policydrafters.com/services/privacy-policy-pack), $1,200 to $2,500, first draft in 10 working days.
- A growing team needs a handbook and written procedures: An employee handbook with a leave section that works and an acknowledgement form to sign, and the procedures a new starter can follow, kept as an SOP library on one template. [Service](https://policydrafters.com/services/employee-handbook), $1,200 to $2,500 each, first draft in 10 to 12 working days.
- A regulator, a bank or an examiner expects a written manual: Documents drafted against a named rule and structured the way the people who check them expect to read: the AML/KYC manual, and the AI governance suite for a business that builds or uses AI. [Service](https://policydrafters.com/services/aml-kyc-manual), $3,000 to $5,000, first draft in 15 to 20 working days.
- Policies you already have need checking: Documents someone else wrote, read against the current text of the rules they name and returned with every change marked and a note of what moved, before a customer or an auditor reads them. [Service](https://policydrafters.com/services/policy-review-and-update), $350 to $500 per document reviewed, returned in 5 working days.

## Services
- [Employee handbook drafting, fixed price](https://policydrafters.com/services/employee-handbook): A first employee handbook, or one that has outgrown a page of house rules, drafted from your intake and reviewed by our legal team, quoted at $1,200 to $2,500.
- [Privacy policy pack: GDPR, CCPA, NDPR](https://policydrafters.com/services/privacy-policy-pack): The privacy notice, cookie notice, data protection policy and request procedure a customer asks to see, drafted against GDPR, CCPA and NDPR, quoted at $1,200 to $2,500.
- [Information security policy set](https://policydrafters.com/services/information-security-policies): Six security documents drafted against ISO/IEC 27001:2022 Annex A and SOC 2 CC6 and CC7, for the questionnaire your customer sent, quoted at $1,200 to $2,500.
- [AML/KYC policy and procedure manual](https://policydrafters.com/services/aml-kyc-manual): An AML/KYC manual drafted against the FATF Recommendations, Directive (EU) 2015/849 and the Bank Secrecy Act, reviewed by our legal team, for $3,000 to $5,000.
- [Standard operating procedures written to one template](https://policydrafters.com/services/sop-library): When a customer or auditor asks for written procedures: five to twelve SOPs on one template, with a register and change control, quoted at $1,200 to $2,500.
- [AI governance documentation suite](https://policydrafters.com/services/ai-governance-suite): Seven AI governance documents drafted against the EU AI Act, the NIST AI RMF 1.0 and ISO/IEC 42001:2023, reviewed by our legal team, first draft in 20 working days.
- [Policy review and update](https://policydrafters.com/services/policy-review-and-update): Policies written years ago, or inherited, read against the current text of the rules they name and returned marked up in five working days, $350 to $500 per document.

## Industries
- [Security and privacy policies for SaaS companies](https://policydrafters.com/industries/saas-technology): Security and privacy policies for SaaS companies and startups, with AI governance, drafted the way enterprise buyers, auditors and investors read them, at a fixed price.
- [AML policies for fintech and financial services](https://policydrafters.com/industries/financial-services): PolicyDrafters drafts the AML/KYC manual, security policies and privacy pack that a fintech or financial services firm shows its regulator and bank, at a fixed price.
- [HR policies and handbooks for small businesses](https://policydrafters.com/industries/small-business-hr): An employee handbook, the HR procedures behind it and a review of the policies a small business already has, drafted for the managers who apply them, at a fixed price.
- [Healthcare administrative and HIPAA documentation](https://policydrafters.com/industries/healthcare-administration): Administrative SOPs, privacy notices and security policies drafted against the HIPAA administrative safeguards, for healthcare clinics, practices and health tech firms.

## Guides
- [How much does an employee handbook cost?](https://policydrafters.com/guides/employee-handbook-cost): Templates cost least, legal practices most. A drafted handbook is priced by jurisdictions, headcount, existing documents and extra policies, then quoted as one figure.
- [Policy vs procedure: what is the difference?](https://policydrafters.com/guides/policy-vs-procedure): A policy states the rule and who it applies to; a procedure states the steps, owners and records. Most documentation fails by mixing the two. How to keep them apart.
- [What goes in an AML/KYC manual for a small firm?](https://policydrafters.com/guides/aml-kyc-manual-contents): The ten sections an examiner expects in an AML/KYC manual, in order, from business-wide risk assessment to independent review, with the rule and record behind each.
- [Policy templates vs drafted policies](https://policydrafters.com/guides/policy-template-vs-drafted): A template is enough when the rule is generic, nobody will audit it and you will edit it honestly. It stops being enough when a reader compares it to what you do.
- [GDPR, CCPA and NDPR privacy notices: what each needs](https://policydrafters.com/guides/gdpr-ccpa-ndpr-privacy-notice-requirements): GDPR, CCPA and Nigerian notices state identity, data, purposes, recipients, retention and rights; GDPR and Nigeria add lawful basis, the CCPA a sale or sharing opt-out.
- [How often should company policies be reviewed?](https://policydrafters.com/guides/how-often-review-policies): Annually by convention, and whenever the rule or the facts change, after an incident or an audit finding. Who reviews, who re-approves, and how the review is recorded.
- [How to write an SOP people actually follow](https://policydrafters.com/guides/how-to-write-an-sop): A standard operating procedure is a numbered set of steps for one process, with an owner and a record for each step. How to capture, write, test and review one.
- [The policies a SaaS startup needs first](https://policydrafters.com/guides/policies-saas-startup-needs): The eight policies a SaaS startup's first security questionnaire asks for, mapped to ISO 27001, SOC 2, the CAIQ and VSAQ, with a ninth where the product uses AI.
- [EU AI Act: what a deployer has to document](https://policydrafters.com/guides/eu-ai-act-required-documents): What the EU AI Act, Regulation (EU) 2024/1689, asks a deployer to document: Article 26 duties, Article 27 impact assessment, Article 4 literacy and Article 50 notices.
- [NIST AI RMF vs ISO 42001: which to document against?](https://policydrafters.com/guides/nist-ai-rmf-vs-iso-42001): Document against the framework your customers name: NIST AI RMF 1.0 for alignment, ISO/IEC 42001:2023 for certification. If nobody asks, start with the shared documents.
- [A customer sent a security questionnaire: what next?](https://policydrafters.com/guides/security-questionnaire-what-to-do): Read it whole, give each section an owner, and answer with the control you run and the evidence you hold. A documented gap with a date and a plan is a normal answer.
- [Who can write or review your SaaS security policies](https://policydrafters.com/guides/who-writes-saas-security-policies): Your own team, a template, an AI draft, a consultant, a virtual CISO, a platform, a law practice or a drafting firm: what each route gives you and what stays with you.
- [Privacy notice vs cookie consent: what each does](https://policydrafters.com/guides/privacy-notice-vs-cookie-consent): A privacy notice says what data you collect and why; a cookie consent setup asks before trackers run and records the answer. What each needs and who builds it.
- [When does a business need an employee handbook?](https://policydrafters.com/guides/when-does-a-business-need-an-employee-handbook): No US federal law requires a handbook. The need is practical: a first manager who is not a founder, a first remote hire, a first leave request or an investor's request.

Where a page names the NDPR: the Nigeria Data Protection Regulation 2019 was retired as an instrument by the Nigeria Data Protection Commission's General Application and Implementation Directive 2025; the documents cite the Nigeria Data Protection Act 2023 and the directive.

## Pricing
- A single policy is $350 to $500; a themed suite (a handbook, a pack or a set of related documents) is $1,200 to $2,500; a bespoke manual is $3,000 to $5,000. Prices are in USD. Every quote is fixed before we start and does not change.
- The maintenance plan is $29 to $99 a month, billed monthly: when a rule a document names changes, a revised version arrives with the changes marked and a new revision code, reviewed by our legal team before it is sent.

## Contact
- Your written quote arrives within 45 minutes of a complete intake during our working hours, Monday to Saturday, 9am to 5pm, Mountain Time.
- We reply within 45 minutes during our working hours, Monday to Saturday, 9am to 5pm, Mountain Time, by email unless you ask for a call.
- Email hello@policydrafters.com, phone +1 (505) 528-6595 (Monday to Saturday, 9am to 5pm, Mountain Time). Registered office: 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, US.

## Key pages
- [Services](https://policydrafters.com/services)
- [Industries](https://policydrafters.com/industries)
- [Pricing](https://policydrafters.com/pricing)
- [How it works](https://policydrafters.com/how-it-works)
- [Guides](https://policydrafters.com/guides)
- [Maintenance](https://policydrafters.com/maintenance)
- [Get a fixed quote](https://policydrafters.com/quote)
- [Contact](https://policydrafters.com/contact)

## Optional
- [Full text of the services, industries and guides](https://policydrafters.com/llms-full.txt)
- [Guides feed (RSS)](https://policydrafters.com/guides/feed.xml)
- [Privacy notice](https://policydrafters.com/privacy)
- [Terms of service](https://policydrafters.com/terms)