Policyseed

policyseed

Free, offline SOC 2 policy generator. policyseed renders 22 governance policy documents from a single YAML intake file, using a small template engine and zero runtime dependencies.

npx policyseed init    # writes intake.yaml: company, cloud, identity provider, MFA, team size...

npx policyseed build # renders the 22 policies into ./policies/

Prefer a browser? The same templates run at policyseed.io/generate: 23 questions, no signup, nothing uploaded.

• Free and Apache-2.0. Use it, fork it, modify it, ship it internally or to customers.
• Deterministic. The same intake.yaml always produces the same Markdown. No randomness.
• No LLM. Templates are plain Markdown with a Mustache-style tag syntax, not model output.
• No signup. No network calls unless you collect evidence. build, check, init, list and mcp make no network calls and run entirely on your machine or CI runner. evidence calls only the cloud CLIs you already use (aws, gcloud, gh), with read-only commands, and only when you run it.

The policies are a starting point that your company reviews and adopts, not a compliance guarantee. See What this is not.

What the output looks like

Every policy names your tools and people from the intake. An excerpt of the Access Control Policy, rendered by npx policyseed build for an example company (AWS, GitHub, Google Workspace, MFA on, 11-50 people):

4.3 Google Workspace is the single source of workforce identity. Business applications are

integrated with it for single sign-on and, where supported, automated provisioning and

deprovisioning; applications that cannot federate are recorded in the exception register with a

compensating review.

4.8 Access to GitHub is granted through organization membership enforced by single sign-on

with Google Workspace, repository permissions are assigned by team, and protected branches

require a review from someone other than the author before code is merged and deployed by

GitHub Actions. Where headcount makes this impractical, the Security Owner documents the

compensating review.

All 22 policies share the same nine sections: purpose, scope, roles and responsibilities, numbered policy statements, procedures, exceptions, enforcement, review cadence and revision history. The numbered statements make it easy to point an auditor at the exact sentence behind a control.

Quick start

Requires Node.js 18 or later. No install step — run it with npx:

npx policyseed init

edit intake.yaml with your company's details

npx policyseed build npx policyseed check

• init writes a commented intake.yaml in the current directory with every field, its allowed values, and sensible defaults. It refuses to overwrite an existing file unless you pass --force.
• build reads intake.yaml, validates it, and writes all 22 policies to ./policies/ as NN- .md files with a company-titled heading.
• check reads ./policies/ and intake.yaml and exits with status 1 if any policy's last reviewed date is older than its review_cadence allows. This is what the bundled GitHub Action runs on a schedule so an overdue policy shows up as a failing check.
• list prints the 22 bundled templates.
• evidence collects read-only SOC 2 evidence from AWS, Google Cloud and GitHub with the CLIs you already have signed in. See Collecting audit evidence.
• --help and --version do what you'd expect.

If you'd rather install it as a dependency:

npm install --save-dev policyseed

npx policyseed init

Template syntax reference

Templates are plain Markdown files with YAML front matter and a small set of tags, implemented in lib/render.js:

Truthiness matches JavaScript, plus empty arrays count as falsy: false, "", 0, NaN, null, undefined and [] are falsy; everything else is truthy.

A block tag that stands alone on its own line (only whitespace before and after it) is removed together with its line, so conditional paragraphs and loops don't leave stray blank lines behind. Three or more consecutive blank lines collapse to two.

The context available to every template is built by toTemplateContext() in lib/context.js from your intake.yaml — company name, cloud providers, identity provider, MFA status, data types handled, and so on, plus derived booleans like has_mdm, has_vendors, scope_availability and small_team (headcount 1-10) that templates branch on.

The 22 policies

| # | Title | | - | --- | | 1 | Information Security Policy | | 2 | Acceptable Use Policy | | 3 | Access Control Policy | | 4 | Authentication and Password Policy | | 5 | Asset Management Policy | | 6 | Data Classification and Handling Policy | | 7 | Data Retention and Disposal Policy | | 8 | Encryption and Key Management Policy | | 9 | Change Management Policy | | 10 | Secure Software Development Policy | | 11 | Vulnerability and Patch Management Policy | | 12 | Logging and Monitoring Policy | | 13 | Incident Response Policy | | 14 | Business Continuity and Disaster Recovery Policy | | 15 | Backup and Recovery Policy | | 16 | Vendor and Third-Party Risk Management Policy | | 17 | Risk Assessment and Management Policy | | 18 | Human Resources Security Policy | | 19 | Endpoint and Workstation Security Policy | | 20 | Network and Infrastructure Security Policy | | 21 | Physical and Remote Work Security Policy | | 22 | Privacy and Data Protection Policy |

Each one has nine standard sections: Purpose, Scope, Roles and Responsibilities, Policy Statements, Procedures, Exceptions, Enforcement, Review Cadence, and Revision History.

Keeping policies current in CI

Use the GitHub Action in a repo that keeps intake.yaml and policies/ under version control:

- uses: actions/checkout@v4

• uses: odedmoshe/policyseed@v1 with: command: check

It fails the check when a policy is overdue for review, so a stale policy shows up as a red X instead of quietly rotting. .github/workflows/policy-review.yml is a complete weekly workflow to copy; inputs and outputs are in docs/github-action.md.

Use it from an AI assistant (MCP)

policyseed mcp starts a Model Context Protocol server, so Claude, Cursor and other MCP clients can list the policies, ask you the intake questions and render any policy in the conversation. Nothing leaves your machine except what you type to the assistant.

claude mcp add policyseed -- npx -y policyseed mcp

Claude Desktop and Cursor configuration, the tool list and an example conversation are in docs/mcp.md.

Agent skill

skills/soc2-policies/ is an agent skill (a SKILL.md plus an interview guide) that tells Claude Code and other skill-aware agents when to use Policyseed and how: interview for the intake, render with the CLI or the MCP tools, then report what to review. To install it for Claude Code, copy the folder into ~/.claude/skills/ (or .claude/skills/ in a project).

Collecting audit evidence

Auditors ask for proof that controls are configured: branch protection, MFA, encryption at rest, logging, who has admin access. policyseed evidence gathers that with the aws, gcloud and gh CLIs you already have installed and signed in, and saves it as dated JSON files plus an index:

npx policyseed evidence --providers aws,gcp,github \

--repo acme/app --org acme --project acme-prod

evidence/2026-10-23/

INDEX.md criterion -> file -> what it shows -> auditor question CC6.1-aws-iam-account-summary.json CC6.1-aws-iam-credential-report.json CC8.1-github-branch-protection.json ...

How it behaves:

• Read-only. Every command is a Describe, Get or List call (gh api GET requests, no request fields). The one exception in name only is aws iam generate-credential-report, which asks IAM to build the credential report; IAM classifies it as a Read action and it changes no settings. --dry-run prints the exact commands without running anything; --list prints the collectors.
• No shell. Each command runs with Node's execFile and a fixed argument array. --repo, --org, --project, bucket names and trail ARNs are passed as separate arguments, never interpolated into a shell string. Pagers and interactive prompts are turned off.
• Each file wraps the CLI's JSON output with the command that produced it, the time, the CLI version and the exit code. Files are named - .json after the collector's first SOC 2 criterion; INDEX.md lists every criterion a file supports.
• Redaction. Before anything is written or printed, values under secret-looking keys (SessionToken, SecretAccessKey, password, token, ...) are replaced, and so are strings that look like credentials: GitHub tokens, AWS access key IDs and session tokens, Google API keys and OAuth tokens, JWTs, PEM private keys and key=value secrets. Secrets are never requested in the first place. Account IDs are kept, because auditors usually need them; pass --redact-account-ids to truncate 12-digit IDs to their last four digits.
• Failures don't stop the run. A missing CLI, missing credentials or a permission error is written to INDEX.md as not collected: and the run moves on. The exit code is 1 only if nothing at all was collected.
• Re-runs. A run replaces the files its providers wrote earlier the same day and rewrites INDEX.md. Other days' folders, other providers' files and any files you add yourself (such as screenshots) are left alone.
• Scope. Regional AWS checks (EBS default encryption, RDS, CloudTrail) use the CLI's configured region (AWS_REGION or the profile's region). GitHub checks cover one repository and one organization; Google Cloud checks cover one project (--project, or the gcloud default). S3 per-bucket checks stop after --max-buckets buckets (default 50). On Windows, gcloud is a .cmd script that Node can't start without a shell, so the Google Cloud collectors report it as not collected there.

What it collects

| aws-iam-credential-report | CC6.1, CC6.2 | `aws iam generate-credential-