PoliWriter

Which audits are you facing?

Tick them. The shelf below shows every policy PoliWriter writes for your company, each in under a minute, each citing the controls it meets.

The shelf: 122 documents across 10 framework shelves

KeyCites means the audit requirements a document answers. CC6.1, for example, is the SOC 2 control “Logical & Physical Access: Security Software”.

Also on the shelf

Open one.

Every document carries the same label: framework, sections, the controls it cites, the formats you get. This is the SOC 2 Access Control Policy, opened.

SOC 210 sections
Access Control PolicyDefines requirements for managing user access based on least privilege.
Cites
CC6.1, CC6.2, CC6.3 and 5 more
Sample
3,744 words, written in 49 s
PDF · Word
Sections10
  1. Purpose and Scope
  2. Access Control Principles
  3. User Account Management
  4. Authentication Requirements
  5. Role-Based Access Control
  6. Privileged Access Management
  7. Access Reviews
  8. Remote Access
  9. Third-Party Access
  10. Access Revocation
Controls it cites8
  • CC6.1Logical & Physical Access: Security SoftwareSOC 2
  • CC6.2Logical & Physical Access: CredentialsSOC 2
  • CC6.3Logical & Physical Access: AuthorizationSOC 2
  • ISO A.8.2Privileged Access RightsISO 27001
  • ISO A.8.5Secure AuthenticationISO 27001
  • HIPAA §164.312(a)(1)Access ControlHIPAA
  • PCI DSS Req. 7Restrict AccessPCI DSS
  • CSF PR.AA-5Access PermissionsNIST CSF
Sample, written for a fictional company

Employee and Contractor Termination: The People Operations Manager initiates a termination workflow in Gusto on the employee's last day (or immediately for involuntary terminations). Gusto triggers an automated deprovisioning process that suspends the Google Workspace account within one hour. The suspended account loses access to all SSO-connected systems (AWS, GitHub, Slack, Datadog, Kandji) because those systems rely exclusively on Google Workspace SSO. For systems with any local or separate credentials (none currently at Northwind Health (sample) outside the documented break-glass and service accounts), the IT Administrator manually disables or rotates those credentials within the same one-hour window (CC6.3).

From section 10, Access Revocation, of a 3,744-word policy written for Northwind Health (sample) in 49 seconds.

Write this policyOpen the full template

Written in under a minute. Kept current after.

You answer a short questionnaire once. Each policy is then written for your company, naming your tools and roles and citing the controls it meets. You edit it in the browser, move it from draft to reviewed to approved, and export PDF or Word.

  1. Frameworks
  2. Company
  3. Tech stack
  4. Data
  5. Security
  6. IR & BC
  7. HR & Ops

Measured on 15 and 16 Oct 2026, writing for the sample company Northwind Health (sample):

  • HIPAA Access Control Policy1,915 words25 s
  • SOC 2 Information Security Policy2,975 words37 s
  • ISO 27001 Incident Management Policy3,256 words42 s
  • SOC 2 Access Control Policy3,744 words49 s

Questions before you tick.

Is the first policy really free?

Yes. Your first policy is free and no card is needed to start. The rest of your set comes with a plan.

Which plan covers my set?

HIPAA on its own is covered by HIPAA Starter, $99 a month. One framework, or HIPAA plus one other, is covered by Growth, $199 a month; the other framework is fixed by the first one you write. Two or more frameworks besides HIPAA need Scale, $499 a month, which covers all 11 frameworks and all 122 documents.

Tick your audits at the top of this page and the order slip works it out for you.

Do I need different documents for SOC 2 Type I and Type II?

No. Both use the same 22 SOC 2 documents, so the shelf shows SOC 2 once.

What exactly does each policy cite?

The controls it meets: SOC 2 Trust Services Criteria, ISO 27001:2022 Annex A controls, HIPAA sections, and their equivalents for the other frameworks. Open any document on the shelf to see its full list with names.

Can my team edit what is written?

Yes. Every policy opens in a browser editor, moves from draft to reviewed to approved, keeps its version history, and exports to PDF or Word.

How do refunds work?

30-day money-back guarantee on your first payment. Annual plans: unused full months refunded pro rata. Monthly plans: cancel any time, access runs to the end of the month you paid for.

Who handles my data and my payment?

Policies are written by an AI model from your questionnaire answers. Payments are handled by Dodo Payments. Sign-in and the database run on Supabase.

Your set, priced.

Your setPlansOrder slip

SOC 2 + HIPAA

  • SOC 222
  • HIPAA12
Documents
34
Plan
Growth
Price
$199 a month or $1,990 a year, save $398

HIPAA + one other framework of your choice (fixed by the first one you write). Up to 10 integrations.

On every plan: version history and approvals, a risk register started for you, vendor reviews, an evidence locker, daily checks on connected integrations (34 live), a read-only auditor link with an expiry date, a public trust page, employee acknowledgments, questionnaire answers and six training modules.

PlanCoversPrice
HIPAA StarterHIPAA only (12 documents, including the Security Risk Analysis report and the Business Associate Agreement policy)$99 a month
GrowthHIPAA + one other framework of your choice (fixed by the first one you write)$199 a month
ScaleAll 11 frameworks, all 122 documents$499 a month
EnterpriseAll frameworksFrom $14,990 a year
Start free34 documentsCompare plans

Your first policy is free. No card needed to start. 30-day money-back guarantee on your first payment.

Document

Document

Write this policyOpen the template page