Complyeasy

Hey Indie Hackers 👋

I'm building ComplyEasy — upload your security/privacy docs, and it tells you exactly what's missing for SOC 2, HIPAA, or GDPR, then helps you actually fix it (not just generate more paperwork).

Why I built this: every small SaaS team I've talked to hits the same wall. An enterprise deal shows up, the prospect sends a security questionnaire, and suddenly you're trying to figure out if you're "compliant enough" with zero budget for a $15-30k/year platform or a compliance consultant. Most teams either fake it and hope, or burn weeks writing policy docs from templates that don't actually map to what an auditor will ask.

What it does today:

Upload a doc (privacy policy, security policy, whatever you've got) and run a gap analysis against a framework — it scores you and tells you specifically what's missing, not just "you're 60% done."

"Draft a fix" on any open finding — this is the part I'm most proud of. It doesn't just spit out policy language. It generates a real checklist of operational steps (e.g., for an MFA finding: "enable MFA in your IdP for all users," "enable MFA on privileged/admin accounts specifically," "set a recurring quarterly access review"), and you check them off with evidence (a file or link) attached to each step before it lets you mark the finding as addressed. It also catches regressions — if a control you fixed shows up broken again on a later run, it flags it as "came back" instead of silently losing track.

A public Trust Center page you can share with prospects instead of a PDF.

Policy templates as a starting point, not the whole answer.

Where it's honestly at: I'm early — no big customer logos to wave around, and I'm not going to pretend otherwise. Evidence management is currently scoped to remediation steps (not yet a standalone library), and things like an auditor marketplace and AWS/GitHub/Slack integrations are on the roadmap, clearly labeled "coming soon" rather than sold as done. What's real and working: the gap analysis, the remediation workflow above, policy templates, and the Trust Center.

Try it free, no credit card: complyeasy.net

If you've been through a SOC 2 or HIPAA push at a small company, I'd genuinely love to hear where it hurt most — and if you want to run your own docs through it and tell me what's wrong, I'll take the feedback over compliments any day.