How many clients does one Agency license cover?

Up to 5 companies. The key carries 440 policy runs: one run tailors one policy, and a pass over all 22 policies uses 22 runs, so the key holds 20 passes, or 4 per company if you spread them evenly. The key counts runs, not companies, so passes are not reserved per client; the terms limit the license to 5 companies in total. Runs that the model refuses or that fail validation are refunded to the key and not counted.

Can I deliver the documents to my clients?

Yes. The terms allow Agency outputs to be delivered to clients. You receive a perpetual, royalty-free license to use, copy, modify and distribute the tailored documents, crosswalk, checklist, forms and calendar for the companies the license covers, including sharing them with auditors, customers, investors and advisors. Policyseed claims no ownership of the outputs and does not require attribution in them. You may not resell the unmodified kit as a product of your own, or present the outputs as legal advice or as a compliance guarantee.

Do the files carry Policyseed's name?

In a few places, listed on this page: the DOCX footers and author property, the crosswalk workbook's author property and its ISO 27001 Annex A note, the calendar event descriptions and the README. The policy Markdown files and registers.xlsx do not. There is no white-label setting; because every file is editable Word, Excel, Markdown or plain text, you can change or remove those lines yourself, and the terms do not require attribution.

What happens to my clients' answers?

Policyseed has no database and no accounts. The answers saved in your browser travel with the checkout as metadata, which Polar keeps as the merchant of record. Each tailoring request sends that client's answers and the policy text to the Anthropic API, and the response comes back to your browser. The generated files exist only on your machine.

Does the Agency key work for the Questionnaire Pack?

No. The Questionnaire Pack ($19 one-time) is a separate product with its own key; kit keys, including Agency keys, do not work for questionnaire answers.

Can I get a refund after using it for some clients?

Yes, within 14 days of purchase, on request and with no reason needed, even if you have used runs across several client companies. The refund revokes the license key, so further runs stop; files you already downloaded remain yours.

SOC 2 policy kits for your clients: the Agency license

For fractional CISOs, vCISOs, compliance consultants and MSPs who prepare several small SaaS companies for SOC 2. One $149 license key carries 440 policy runs, enough for 5 client companies at 4 passes each. Every client gets the same files as the $39 Audit Kit, tailored from that client's own answers, and you may deliver them to the client.

Buy the Agency license, $149 See the sample kit

What the license covers

Up to 5 companies. Run each client from its own answers; nothing is shared between kits. Buying the Audit Kit separately for each would cost $195.
440 runs on one key. One run tailors one policy; a full pass is 22 runs, so the key holds 20 passes. Polar counts the runs; only successful ones count.
Outputs you can deliver. The documents are licensed to you perpetually for the companies the license covers, may be delivered to clients, and need no attribution. See section 6 of the terms.
One-time purchase. No subscription and no seats. Polar is the merchant of record, and the whole purchase can be refunded within 14 days on request (refund policy).

What each client gets

The same ZIP as the Audit Kit, built in your browser for each company:

policies/01-…22-<slug>.docx: 22 Word documents, one per policy, with a document control table (owner, approver, version, effective date, review cadence) and a footer carrying the generation time and intake hash.
policies-markdown/01-…22-<slug>.md: The same 22 policies as Markdown.
crosswalk.xlsx: Four sheets. Crosswalk: every Trust Services Criterion in your scope (the 33 common criteria CC1 to CC9, plus Availability A1 and Confidentiality C1 when selected; up to 38), each mapped to the policy and section that addresses it, with a plain-language paraphrase. Evidence Checklist: one row per criterion, policy and artifact, with owner and status columns. Policies: owner, review cadence and next review date per policy. ISO 27001 Annex A: each of the 93 ISO/IEC 27001:2022 Annex A controls mapped to the policies that address it, with the controls the set does not cover marked and the reason; this is Policyseed's own policy-based mapping, not an official ISO or certification-body one.
registers.xlsx: The working registers the policies require, started from your answers. Vendor Inventory: every tool you named, with what it is used for and a suggested tier to confirm. Risk Register: ten starter risks tied to the policies (account takeover, cloud misconfiguration, vendor breach, former staff keeping access and more); you enter likelihood and impact, and the score and rating compute on the policy's own scale. Access Review: one row per in-scope system for the quarterly review. Service Accounts: the non-human identity inventory.
policy-acknowledgment.docx: A per-employee acknowledgment form listing all 22 policies, plus a roster page to track who has signed.
review-calendar.ics: All-day events starting the month after your effective date, laid out from the review cadence you chose: with an annual cadence, eleven monthly sessions that cover two policies each; with a semi-annual or quarterly cadence, six or three sessions that repeat every six or three months. Every session names the owner role of each policy it covers, and an annual attestation of the whole set repeats yearly.
README-auditor-questions.md: What is in the ZIP, how to adopt the set, which policies were tailored, and the 25 questions auditors ask about policies with a suggested answer and a pointer to the document that supports it.

Claude rewrites only sections 4 (Policy Statements) and 5 (Procedures) of each policy around the client's named tools; the other sections are the deterministic template text with the answers filled in.

Branding: what carries Policyseed's name

There is no white-label setting. This is exactly where Policyseed appears in a kit, so you can decide what to edit before delivery:

File	Where the Policyseed name appears
Policy and acknowledgment DOCX files	The page header carries the client's company name and the document title. The footer reads "Generated <date and time> from intake <hash> - Policyseed" next to the page number, and the document properties list Policyseed as the author.
Policy Markdown files	No Policyseed name in the text.
crosswalk.xlsx	The workbook properties list Policyseed as the author. The ISO 27001 Annex A sheet opens with a note that the mapping is Policyseed's own, and one column is headed "Summary (Policyseed paraphrase)". The other three sheets carry no Policyseed name.
registers.xlsx	No Policyseed name.
review-calendar.ics	Each event description ends with a short note that begins "Generated by Policyseed", and the calendar's identifiers name Policyseed.
README-auditor-questions.md	The opening disclaimer and the description of the ISO 27001 Annex A sheet name Policyseed, and the file ends with a "Generated by Policyseed" line with the site address.

Every file is editable, so you can change or remove these lines, and the terms do not require attribution.

Free tools to use with clients

These need no license key and cost nothing, so you can use them in a first meeting:

SOC 2 readiness check: 20 yes, partly or no questions; a score out of 100 and the gaps in priority order, each with the fix. It runs in the browser and the answers stay in the page URL, so the link can go in the client's file.
SOC 2 gap assessment template: An Excel workbook with one row for each of the 38 criteria and columns for status, owner, evidence location and remediation; opened from a readiness result, the answers pre-fill the status column. The last line of the instructions sheet and the workbook properties name Policyseed.
SOC 2 system description template: A first draft of the system description in Word or Markdown, built from the client's generator answers, with marked placeholders for everything the answers do not state. Its first section says it was drafted from Policyseed generator answers, and the Word footer ends with "Policyseed".
Trust page generator: A public security page for the client's website that states only what you tick, downloaded as one HTML file or Markdown. The "Security page generated with Policyseed" footer link is a checkbox you can clear.

The policy generator itself is free too: all 22 policies as Markdown, rendered from the client's answers.

How a typical engagement uses it

Baseline the client with the readiness check. Go through the 20 questions together. The score and the prioritized gap list give the engagement its starting point, at no cost.
Track remediation in the gap assessment. From the readiness result, open the gap assessment and download the workbook with the status column pre-filled from those answers, then assign owners and target dates per criterion.
Answer the 23 generator questions for the client. Company, stack, owners, data types, scope and review cadence. All 22 policies render for free as you type, and the answers live in the page URL, so you can bookmark one link per client.
Tailor that client's kit with your Agency key. With the key saved in your browser, the generator offers "Continue to your Audit Kit", which opens the download page with that client's answers. Claude rewrites sections 4 and 5 of all 22 policies (22 runs) and your browser builds the ZIP. The browser keeps tailored text for one set of answers at a time, so save each client's ZIP before you start the next.
Review and adopt with the client. Each policy owner reads the tailored statements with the tools open and corrects anything that is not true. Management approves the set, staff sign the acknowledgment form, the review calendar goes into the owners' calendars, and the registers become the working vendor inventory, risk register and access review.
Draft the system description and the trust page. Both free tools start from the same generator answers, so the system description and the public security page describe the same stack the policies do.
Rerun after corrections. If the client's answers change, another pass tailors all 22 policies again (22 runs). Rebuilding the ZIP for the most recent client's unchanged answers, in the same browser, uses no runs.

The kit prepares the policy portion of a SOC 2 examination. The client's management adopts the policies and operates the controls, and the CPA firm the client engages performs the examination.

Frequently asked questions

How many clients does one Agency license cover?: Up to 5 companies. The key carries 440 policy runs: one run tailors one policy, and a pass over all 22 policies uses 22 runs, so the key holds 20 passes, or 4 per company if you spread them evenly. The key counts runs, not companies, so passes are not reserved per client; the terms limit the license to 5 companies in total. Runs that the model refuses or that fail validation are refunded to the key and not counted.
Can I deliver the documents to my clients?: Yes. The terms allow Agency outputs to be delivered to clients. You receive a perpetual, royalty-free license to use, copy, modify and distribute the tailored documents, crosswalk, checklist, forms and calendar for the companies the license covers, including sharing them with auditors, customers, investors and advisors. Policyseed claims no ownership of the outputs and does not require attribution in them. You may not resell the unmodified kit as a product of your own, or present the outputs as legal advice or as a compliance guarantee.
Do the files carry Policyseed's name?: In a few places, listed on this page: the DOCX footers and author property, the crosswalk workbook's author property and its ISO 27001 Annex A note, the calendar event descriptions and the README. The policy Markdown files and registers.xlsx do not. There is no white-label setting; because every file is editable Word, Excel, Markdown or plain text, you can change or remove those lines yourself, and the terms do not require attribution.
What happens to my clients' answers?: Policyseed has no database and no accounts. The answers saved in your browser travel with the checkout as metadata, which Polar keeps as the merchant of record. Each tailoring request sends that client's answers and the policy text to the Anthropic API, and the response comes back to your browser. The generated files exist only on your machine.
Does the Agency key work for the Questionnaire Pack?: No. The Questionnaire Pack ($19 one-time) is a separate product with its own key; kit keys, including Agency keys, do not work for questionnaire answers.
Can I get a refund after using it for some clients?: Yes, within 14 days of purchase, on request and with no reason needed, even if you have used runs across several client companies. The refund revokes the license key, so further runs stop; files you already downloaded remain yours.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.