Job compliance-policy-set-drafted-from-what-you-actually-do · revised 12 October 2026
Get security policies drafted from what you really do, each line confirmed
Up to 6 short policies, such as access and backup, written from a fact sheet your owner fills in. Every sentence is confirmed as true today; what you do not do becomes a goal, not a claim.
You might be seeing
- You downloaded a template whose sentences describe controls you do not run
- A customer asks you to show that a policy is followed and you cannot
No passwords, keys, card details or admin invites needed to start.
What usually happened
Template and machine-written policies state controls the company may not operate. A policy that says all laptops are encrypted when three are not becomes a false statement the moment a customer relies on it. A policy helps only when every sentence matches what the company really does.
Who it’s for: Founder or operations lead asked for written security policies by a customer, insurer or auditor.
Usually starts when: A customer, insurer or auditor asks for your policies, and you have none, or downloaded ones that do not match what you do.
The result: You get up to 6 short policies written from a fact sheet your owner fills in. Each sentence is tagged with the fact-sheet answer it comes from, and your owner confirms it as true today. Anything you do not yet do is left out or written as a dated goal, and a goals list shows each goal and who owns it.
Check whether this job fits
Answer these without sending files or logins. Nothing is submitted unless you choose to contact us.
Checks you can run yourself
Answer five questions honestly
Write down who can log in to your main systems, how a leaver loses access, and whether laptops are encrypted.
Look for: Answers you are unsure of. Those are statements a policy must not make yet.
What you get
- The policies, each sentence linked to its fact
- The goals list and the removed list
- The filled fact sheet
Included
- A fact sheet of about 40 plain questions about what you do today: access, backups, devices, incidents, suppliers and staff leaving
- Up to 6 short policies, each sentence linked to the fact-sheet answer behind it
- A goals list: things you want to do but do not yet, with an owner and a date, never written as facts
- A removed list: statements your owner marked not true
- Scripts check that every sentence has a fact behind it; the language model drafts plain wording from the answers
Not included
- Inventing controls, or writing a policy for something you do not do
- Legal advice, or any statement that the policies satisfy a law, framework or contract
- Any promise of a certification, a pass or an audit result: the assessor or auditor decides
- Checking that your systems match the answers (a separate monthly service compares policies with exports)
- Training staff or rolling the policies out
How we know it’s done
Agreed with you before work starts. Each check produces evidence you keep.
Every sentence in every policy points to a fact-sheet answer your owner gave, and your owner confirms in writing that each sentence is true today. A sentence without a fact fails the whole test.
Evidence: The sentence-to-fact table and your owner's confirmation.
Of up to 10 fact-sheet answers marked "no, we do not do this" (all of them if fewer than 10), none appears in any policy as a statement of practice. Each appears only on the goals list. A pass on all of them is a smoke test, not a rate.
Evidence: All of them beside the policies and the goals list.
A checker finds no sentence that claims a certification, legal compliance or a control missing from the fact sheet.
Evidence: The policies read sentence by sentence.
Sign-off. Your owner and a director inspect the test results and the delivered output, and sign off in writing. Payment follows sign-off.
If it fails. If the agreed tests do not pass, you do not pay for this fixed scope. We hand over what we found and agree whether to stop or re-quote; no surprise work.
When it fits, and when we stop
It fits when
- One owner can answer the fact sheet and confirm each sentence
- You accept seeing "we do not do this yet" in the output
- A director signs the policies as the company's own
We stop and tell you if
- You ask for sentences describing controls you do not run
- You want a policy to satisfy a named framework without the work behind it
- Nobody can answer the fact sheet
What could go wrong
The job reads files you send and writes a report or draft; it changes nothing in your systems, so there is nothing to undo. Our copies of your files are deleted when the job ends.
Scroll the table sideways to read it all.
| Risk | How we handle it |
|---|---|
| A policy states a control you do not operate | Every sentence links to a fact your owner confirmed. A sentence without a fact is removed, and answers marked not yet go to the goals list. |
| The policies are read as meeting a law or framework | The page and every file say they are your own statements of practice and make no claim about any law or framework. |
| Practice changes and the policy goes stale | Each policy carries a review date. Comparing policies with your systems is a separate monthly service. |
| Your files pass through an AI model provider | The written agreement names the provider type, its country and how long it keeps data before you send anything. Entry jobs use redacted or synthetic copies, or your own provider account if you prefer. We delete our copies when the job ends. |
A separate automated reviewer checks every sentence against its fact-sheet answer before it reaches you. Your owner confirms each sentence is true today, and a director signs the policies. No human supervisor is included unless your agreement names one, and at launch the work is largely automated.
How we deliver
We arrange the work and independent review, then show you the result against the agreed checks. You keep authority over your systems.
- Agree the policies wanted, the fact sheet and who confirms the answers
- Send the fact sheet; your owner answers each question and marks unknowns
- Draft each policy sentence only from a confirmed answer, with a link
- Put every not-yet answer on the goals list, never in a policy
- A separate automated reviewer checks every sentence has a fact and no extra claim
- Your owner confirms each sentence is true today; a director signs
This is a one-off job, not emergency cover or a subscription. We confirm eligibility, the total price, a start window and a delivery date before you accept. Work starts only after agreed inputs, secure access and any needed permissions are in place. Hosting, supplier and platform charges are excluded unless the written quote includes them. An enquiry creates no charge or booking.
Need to keep it working?
Want the policies compared with your systems every month? A standing service does that and lists any drift.
Ongoing work is separately scoped and quoted: no monitoring, response-time guarantee or automatic subscription is included in this job.
Explore an ongoing managed lane, or mention the responsibility you need in your enquiry.
What you can check
This is a new service. We have not delivered this job for a client yet.
Other ways to get this done
- Start from a free template from a recognised body and delete every sentence you cannot show is true.
- Ask your auditor or customer which policies they actually need before writing any.
Questions
Will these policies get us through a security review?
Not by themselves. They state what you really do, in your words. Whether that meets a law, framework or contract is for the other party or your adviser to judge.
What if we do not do something a customer expects?
It goes on the goals list with an owner and a date. It is never written as something you already do.
Do you check that we follow them?
Not in this job. A separate monthly service compares policies with your system exports.
Send an enquiry
Send us
- Which policies you were asked for, and by whom
- Whether any policy already exists, even a draft
- Who can answer questions about how things really work. No real policies or credentials in the first enquiry
Later, once you agree
- The filled fact sheet, answered by your owner
- Any existing policy or template, as a redacted copy
- A director who signs the final policies
You keep the facts and the decision to adopt each policy. We work from the fact sheet you fill in, return the policies and lists, and delete our copies when the job ends. We do not check your systems or log in to anything.
Email fallback: open your mail app
If website submission is unavailable, review and send the fallback email yourself. An email fallback is not a website receipt. Or write to hello@syntheticindustry.ai with “compliance-policy-set-drafted-from-what-you-actually-do” as the subject.