Product

Your code and your policies,
checked together.

Sooner or later a buyer, their counsel, or an investor asks what your product does with personal data. The true answer lives in your code, and the promise lives in your privacy policy. Most startups find out whether the two agree on the day somebody else checks.

StartupDocs watches the code: connect a GitHub repository and every push is checked against the standards you choose. It also holds the policies that describe it, drafted and checked in the same place. Nothing is written to your code, and nothing changes in a document until you say so.

Start here

Connect it, watch it, prove it.

That is the whole loop for a repository. You choose the standards; working out what they ask of your code is our job.

01

Connect it

Give us a read-only token for one GitHub repository and choose the standards it is held to: UK GDPR, PECR, CCPA, the EU AI Act, SOC 2, ISO 27001. We read the code and never write to it.

02

Watch it

We work out what those standards oblige this repository to do, look for the evidence across the whole codebase, and check again on every push to the default branch. One issue per problem, not one per file.

03

Prove it

Download the compliance review: the obligations checked, what passed, what is open, grouped by standard. A document you can send to a customer's security team.

Repositories

What a monitored repository gets.

£49 per repository a month on a Pro or Team plan, with a monthly spend cap you set. These are automated checks against the standards you pick. They are not an audit and they do not collect evidence for one.

01

Obligations, not file-by-file noise

Your standards become a checklist of about a dozen things this repository must do. Each one is assessed against the files that bear on it, so something missing is a finding too.

02

Proven or assessed, and said which

A committed private key is proven by a pattern. A missing retention period is an assessment. Every issue says which it is, names the standard, and lists every file it touches.

03

Only what changed

A repository is indexed once. After that a push re-checks only the obligations its changes bear on, which is what keeps the price flat for an ordinary repository.

04

Told when it matters

Serious issues email you the moment they appear. Everything else waits for a daily summary, grouped by problem rather than by file.

The policy workspace

Where the policies live.

The other half of the product. Three panes: your documents, the document you are working on, and the assistant you talk to. The privacy policy, terms, cookie policy and DPA that describe your product are drafted, edited and checked here.

Left: your documents

Every document your company has, in folders you control. Versioned from the first save, so nothing is ever lost to an overwrite.

Middle: the document

A normal document editor. The highlighted text is a tracked change waiting for you: accept it, or reject it and it never happened.

Right: the assistant

Where you ask for changes and run checks. It answers with findings and proposed edits, and it writes nothing into the document without showing you first.

Documents, step by step

Import, prompt, review, export, re-check.

01

Import what you have

Drop in DOCX, Markdown, or plain text. Everything lands in folders you control, versioned from the first save.

Import

  • privacy-policyDOCX
  • employment-contractMD
  • dpa-templateMD

12 files imported · versioned

02

Prompt the change

Tell the assistant what you need in plain English. No legal phrasing required — that is its job.

Assistant

Add a data retention clause and tighten the consent wording

DRAFTING EDITS…

2 tracked changes ready for your review.

03

Review every edit

Edits arrive as tracked changes, never silent rewrites. Accept or reject each one.

Tracked changes

We retain personal data only for as long as necessary. Backups are deleted within 35 days of erasure requests.

AcceptReject
04

Export and ship

Print-ready PDF for signing, DOCX your lawyer can redline, and Markdown for the technical crowd.

Export

PDFDOCXTXTMD
privacy-policy.pdfprint-ready
05

Check, and keep checking

Run rulepacks like GDPR and UK DPA before you ship, then again whenever your company details or the rules change. Every affected document gets re-checked, and fixes come back as tracked changes.

Re-check · GDPR · 3 documents

2 of 3 fixed
  • Retention terms present
  • Consent clause specific
  • DPA reference outdated — fix proposed

Capabilities

And everything the documents need.

01

Import anything

Bring DOCX, Markdown, or plain text. Every document lives in folders you control, with full version history from the first save.

02

Edits you can trust

Ask for changes in plain English. Every edit lands as a tracked change you accept or reject, never a silent rewrite.

03

Compliance is a button

Run a document against curated rulepacks for GDPR, UK DPA, CCPA, and more. Findings come with one-click fixes.

04

Templates to start from

Employment contracts, NDAs, sales agreements, founder agreements. Each one is generated from settings you control: jurisdiction, notice period, IP assignment.

05

One set of documents, kept in sync

Change a company detail once and re-run the checks. Every document that mentions it comes back with fixes for review.

06

Export that holds up

Print-ready PDF for signing, DOCX your lawyer can redline, and Markdown for the technical crowd.

ON THE TEAM PLAN

Dispatch an agent for bulk jobs.

Tell an agent to sweep a whole folder: it works through every document, runs the checks, and comes back with fixes for your review. Hundreds of documents, one instruction. Built for teams and agencies managing document sets across clients.

See the Team plan

Scope

What this is, and what it isn't.

Being clear about the limits is what makes everything above worth believing.

What StartupDocs does

  • Checks a GitHub repository against the standards you choose, on every push
  • Produces a compliance review of the repository you can send
  • Drafts and edits documents from professionally drafted templates
  • Checks documents against curated rulepacks and proposes fixes
  • Keeps your document set consistent when your company details change
  • Exports to PDF, DOCX and Markdown, with every change reviewed by you

What StartupDocs does not do

  • Give legal advice, or replace a solicitor for anything unusual or high-value
  • Audit your repository, or collect evidence for a SOC 2 or ISO 27001 audit
  • Issue a SOC 2, ISO 27001, or any other certification
  • Write to your repository: access is read-only, always
  • Guarantee compliance in any jurisdiction
  • File anything with Companies House or HMRC on your behalf

Repositories: GitHub today. Templates are drafted for England & Wales. Standards and rulepacks reach further: UK, EU, and California. Automated checks are not legal advice.

Compliance, checked on every push.

Connect a GitHub repository, choose the standards it is held to, and every push is checked against them. The policies that describe your product are drafted and checked in the same place. Plans are 7 days free, and accounts created now carry a founding member tag.