Compliance,
checked on every push.

Connect a GitHub repository and choose the standards it is held to. We work out what they oblige your code to do, look for the evidence across the whole codebase, and check again on every push. The privacy policy and terms that describe your product are drafted and checked in the same place.

  • Read-only access to your code
  • Every push to the default branch checked
  • A monthly spend cap you set

GitHub today. UK, EU, and US standards. Policies drafted for England & Wales.

startup-docs.com/app

3 issues open

acme/platform · checked on every push

4 minutes ago

1

High

2

Medium

0

Low

  • high · UK GDPR art. 32Proven

    A private key is committed to the repository.

    deploy/ci-key.pem

  • medium · UK GDPR art. 5(1)(e)Assessed

    No retention period is set for the analytics events table.

    db/migrations/0031_events.sql · and 2 more files

And 1 more · 12 obligations checked, 9 met

When someone asks

The answers live in your code.

A buyer, their counsel, or an investor will eventually ask what your product does with personal data. Three moments, and not one of them arrives with notice.

PROCUREMENT

A buyer sends the security questionnaire.

How long do you keep personal data. Where are the keys. Who are your sub-processors. The true answers live in your code, and a questionnaire filled in from memory is a promise you may not be keeping.

Ready before they ask: The repository's compliance review, a DPA, a privacy policy

THE SECURITY REVIEW

Their counsel compares your policy to your product.

A privacy policy that says one thing while the code does another is worse than no policy. It is evidence. Monitoring checks the code side, and the policies are drafted and checked in the same workspace.

Ready before they ask: Consent and retention in the code, and the policies that describe them

DUE DILIGENCE

An investor's lawyer asks for a technical review.

A key committed two years ago, an events table nobody set a retention period for, a licence nobody read. Each one is cheap to fix the week it lands and expensive the week before a close.

Ready before they ask: A review document, with monitoring history since the day you connected

Checks your code against

  • UK GDPR
  • EU GDPR
  • PECR
  • CCPA
  • EU AI Act
  • SOC 2
  • ISO 27001

Connects to

  • GitHub

Not sure what any of those are? Compliance, in plain English

How it works

Connect, choose, check, watch, prove.

Five steps, and the fourth is the one that keeps paying: a repository is read once, then only what a push changed is checked again, and you get one issue per problem rather than one per file.

See the full product, screen by screen

01

Connect

Pick a GitHub repository and give us a read-only token. We never write to your code.

02

Choose

The standards it is held to: UK GDPR, PECR, SOC 2, ISO 27001, and more. Change them later without reconnecting.

03

Check

We work out what those standards oblige this repository to do, then look for the evidence across the whole codebase.

04

Watch

Every push to the default branch is checked again. Serious issues email you at once, the rest arrive as a daily summary.

05

Prove

Download the compliance review: a document you can send to a customer's security team, not a screenshot of a dashboard.

And the policies your code has to agree with.

The privacy policy, cookie policy, terms and DPA that describe what your product does are drafted around your business, edited with tracked changes, and checked against the same rules, in the same workspace. Employment, NDA, sales and founder templates are there too, for the day you need them.

Browse the template libraryEvery document a startup needs

Straight answers

Your three other options, honestly.

Each one has a real strength, and we would rather name it than pretend otherwise. None of the three checks your code against the law and keeps the policies that describe it in one place.

AN AUDIT PLATFORM

Built for the audit, priced for it.

When a certificate is the goal, an audit-automation platform is the right tool, and it is excellent at collecting evidence for an auditor. Whether your code does what your privacy policy says is a different question, and it is the one a customer's counsel asks.

StartupDocs reads the code itself on every push, and is useful long before an audit is worth paying for.

A SCANNER IN CI

Precise, and blind to the law.

Secret scanners, linters and dependency audits catch real problems, and you should keep them. None of them knows what PECR asks of a cookie, or that a table of user events needs a retention period.

Here a check starts from the obligation and looks for the code that meets it, so something missing is a finding too.

A CHATBOT

Reads a file, forgets the repo.

Paste a file into ChatGPT or Claude and it will spot problems in it. It cannot see the rest of the repository, will not look again when you push, and keeps no record a customer can read.

Here the whole repository is indexed, every push is checked again, and the result is a review you can send.

What it costs to find out: £49 a repository a month on a Pro or Team plan, with a monthly spend cap you set, and the plan itself is 7 days free. How we compare to named products

Limits

What this is not.

We check code against the standards you choose and draft the written policies an auditor asks for. We are not an audit or evidence-collection platform, and an automated check is not legal advice.

  • Give legal advice, or replace a solicitor for anything unusual or high-value
  • Audit your repository, or collect evidence for a SOC 2 or ISO 27001 audit
  • Issue a SOC 2, ISO 27001, or any other certification
  • Write to your repository: access is read-only, always
  • Guarantee compliance in any jurisdiction
  • File anything with Companies House or HMRC on your behalf

What a compliance check actually does

Fair questions

Asked before the card.

What access do you need to my GitHub?

A fine-grained personal access token for the one repository, with Contents set to read-only. We read the code and never write to it. GitHub makes these tokens expire, so monitoring stops on the date you pick when you create it.

Does my code get sent to an AI model?

The files a check needs are sent to third-party model providers, solely to produce that check. Dependencies, build output and binaries are skipped by default, and you can narrow what is read further when you connect. We do not train AI models on your code, and we are confirming the retention terms of each provider we route to.

What does monitoring cost, really?

£49 per repository per month on top of a Pro or Team plan. Includes 1,000 deep checks a month, and a repository pushed to every working day stays inside the allowance. Large monorepos with busy CI are what the blocks are for.

Past the allowance it is £6 per 500 checks, shown on your dashboard as it accrues and added to your next invoice. Every repository has a monthly cap you set, £60 by default. At the cap monitoring pauses until the month rolls over, so a runaway build loop costs you a pause and never a surprise bill.

Is this legal advice?

No. StartupDocs drafts, edits, and checks documents automatically, and every automated finding is shown to you for review. It does not give legal advice and it is not a law firm. For anything unusual or high-value, have a solicitor review the final document.

What if it does not work out?

Then you should not pay for it, and the promise is that you will not. The first 7 days are free on every plan, so if it is not doing what you needed, cancel and the card is never charged. If you have already paid, email [email protected] within 30 days of your first payment and we refund everything you have paid, in full. No forms, no retention call, no questions, and no need to justify it.

Every document you exported stays yours either way, which makes the worst case a set of finished paperwork that cost you nothing. The guarantee is written into our terms, not just this page.

Why do you need a card if the first week is free?

Because it is what separates a real trial from a tyre-kick, and that decision is what lets us give trials the whole product rather than a crippled demo: full functionality, every rulepack, and exports included from the first minute.

Nothing is charged during the 7 days. Cancel before day 7 from the plan page in your account and your card is never touched. You do not have to email anyone to do it.

Which jurisdictions do you cover?

Templates are drafted for England & Wales, and that is the only jurisdiction we claim today. Compliance rulepacks reach further: UK DPA 2018 and PECR for the UK, GDPR and the EU AI Act for the EU, and CCPA for California. EU and US template coverage is in progress.

How is this different from asking ChatGPT or Claude?

A general chatbot will draft you a document, and often a decent one. It will not remember what it wrote for you last month, keep your six documents consistent with each other, or re-check them when the law or your company changes.

StartupDocs holds your whole document set in one place: edits arrive as tracked changes you accept or reject, checks run against curated rulepacks, and when a company detail changes you can run the checks again across everything that mentions it.

And unlike a chatbot, the result is covered: if it does not do what you needed, one email inside 30 days refunds every penny and the documents you exported stay yours.

Do I still need a lawyer?

For anything unusual, contested, or high-value: yes, and we say so on every template. StartupDocs handles the everyday paperwork in between, so the solicitor time you do buy goes on the judgement calls only they can make.

What happens to my documents if I cancel?

You can export everything in full before your cancellation takes effect: PDF, DOCX, and Markdown. Cancelling applies at the end of the period you have paid for, so you keep complete access, including export, until then. Your documents are not held hostage.

Who wrote the templates?

Our team drafts and maintains them against standard England & Wales precedents, and every template states plainly that it is a starting point, not legal advice. We are arranging independent solicitor review of the core pack; when a reviewer has signed off, their name and firm will be published on this page.

Is my data used to train models?

We do not train AI models on your documents. Automated edits and checks send the document being worked on to third-party AI model providers, solely to produce the response you asked for. We are confirming the retention terms of each provider we route to, and we will publish those details here.

Anything else, ask us

Pricing

Priced per repository watched.

Monitoring is £49 for each repository you connect, on a Pro or Team plan. The plan carries the workspace your policies live in. 7 days free on any plan. Card required, cancel anytime, no charge if you cancel before day 7.

Compare the plans in detail

Per repository

Repository monitoring

£49 per repository / month

Each repository you connect, watched on every push. Added to a Pro or Team plan.

  • Indexed once, then only what changed is re-checked
  • Checked against the standards you choose, on every push
  • Findings name the file, the standard, and the fix
  • Instant email for the serious ones, a daily summary for the rest

Includes 1,000 deep checks a month. A repository pushed to every working day stays inside the allowance. Large monorepos with busy CI are what the blocks are for.

Past the allowance it is £6 per 500 checks, shown on your dashboard as it accrues and added to your next invoice. Every repository has a monthly cap you set, £60 by default. At the cap monitoring pauses until the month rolls over, so a runaway build loop costs you a pause and never a surprise bill.

These are automated checks against the standards you pick. They are not an audit and they do not collect evidence for one.

The plan underneath

Every plan carries the policy workspace. Pro and Team are the ones a repository can be connected to.

Starter

Your policies in order, before there is code to watch.

£190per year

  • Privacy, terms, cookie and DPA policies, drafted and checked
  • Core rulepacks: GDPR, UK DPA 2018
  • 1 business template a month
  • 50 documents a month
  • 400 AI edits a month
  • Repository monitoring starts on Pro
Start 7-day trial

Pro

One founder, one codebase, watched on every push.

£490per year

  • Monitor GitHub repositories, £49 each a month
  • Every standard we check, UK, EU, and US, plus SOC 2 and ISO 27001
  • Full template library, 10 a month
  • 500 documents a month
  • 1500 AI edits a month
  • Single user
Start 7-day trial

Team

MOST TEAMS

Your codebase and your whole team, one hub.

£390per seat per year

Minimum 2 seats

  • Everything in Pro, per seat
  • Company profile: your details fill every template, everywhere
  • Unlimited template library
  • Shared folders and roles
  • Compliance audit log
  • Bulk agent runs across folders
  • Priority support
Start 7-day trial

The guarantee

Worst case, you keep everything and pay nothing.

Cancel inside the free week and the card is never charged. Pay, change your mind, and one email inside 30 days returns every penny. Either way the documents you exported are still yours, so the downside of trying this is a set of finished paperwork and a bill for nothing.

No lawyer, template site, or chatbot puts money on the outcome. We do.

Written into our terms, not just this page.

What the free week covers

The whole operating set, not a starter pack. Drafted around your business, checked, and exported to sign.

  1. 01

    Privacy policy

    The day your site collects anything

  2. 02

    Cookie policy

    PECR, and a banner that agrees with it

  3. 03

    Terms of service

    Cover for what you sell, and how

  4. 04

    Data processing agreement

    The first customer whose procurement asks

  5. 05

    Mutual NDA

    Partnerships, pilots, data rooms

  6. 06

    Sales agreement

    So deals open on your terms, not theirs

  7. 07

    Employment contract

    Required in writing by day one

  8. 08

    Contractor agreement

    The document that makes the work yours

  9. 09

    Advisor agreement

    Scope, equity, and vesting, in writing

  10. 10

    Founders' agreement

    Agreed while everyone still agrees

Nothing is charged for 7 days

The card is asked for up front and not touched. It is what separates a real trial from a tyre-kick, and it is why trials get full functionality, exports included, instead of a crippled demo.

30 days to change your mind

Paid, and it did not do what you needed, or you simply changed your mind? One email within 30 days of your first payment refunds everything you have paid. No forms, no retention call, no questions.

Every export stays yours

Documents you export are yours to keep, refund or not. Which makes the worst case a finished set that cost you nothing.

Enterprise: SSO, custom rulepacks, custom template packs built from your house documents, data residency, and a DPA for accelerators and studios. [email protected]

Connect a repository tonight.

Create an account, connect a GitHub repository with a read-only token, choose its standards, and the first full check starts straight away. Every issue names the standard behind it, the files it touches, and the fix. Accounts created now carry a founding member tag.