You have IT handled.
You need the compliance program.
Comply is for organizations with an existing IT provider managing their systems that need a compliance program built, documented, and maintained. HIPAA, PCI DSS, or SOC 2 — policies, risk assessments, evidence tracking, and ongoing management at a flat monthly rate.
A compliance program. Not a document package.
Most small organizations have paid a consultant to write policies once. That is not a compliance program. A compliance program generates evidence every month.
Three frameworks. Real specialisation in each.
One framework is included in Comply. Each has distinct control sets, evidence requirements, and audit processes — we build your program for the specific framework that applies to your organization.
HIPAA
For healthcare practices, dental offices, therapy groups, medical billing organizations, and any organization that creates, stores, or transmits electronic protected health information. No external certification — compliance is demonstrated through an active program and evidence trail that can withstand an OCR investigation.
What we build: Risk assessment · 12 security policies · BAA register · Workforce training records · Monthly audit log reviews · Breach notification procedure · Annual confirmation.
PCI DSS
For organizations that store, process, or transmit payment cardholder data. Validated annually via Self-Assessment Questionnaire (SAQ) for most small businesses. Non-compliance exposes organizations to card brand fines of $5,000–$100,000 per month and increased liability in the event of a breach.
What we build: Scope definition · SAQ completion support · All 12 PCI DSS requirements addressed · Vulnerability scanning program · Evidence package for annual validation.
SOC 2
For SaaS companies, technology service providers, and professional services organizations whose clients require evidence of security controls. SOC 2 Type II requires a 6-month observation period minimum. We build the control framework, generate the evidence trail, and prepare your organization for the formal CPA firm audit.
What we build: All five Trust Service Criteria mapped · Control framework implementation · Evidence collection system · Vendor management program · Audit preparation and evidence package.
Eight managed compliance services. One flat monthly rate.
Every service your compliance program requires — built from scratch, maintained monthly, and ready to evidence when a regulator, auditor, or insurer asks.
Initial Compliance Gap Analysis
Every current control assessed against your framework requirements. Every gap documented with the specific regulatory citation, risk level, and remediation priority — before a single policy is written.
All 12 Security Policies — Customized
Every required security policy written for your specific organization. Not templates. Customized documents reviewed and re-signed by your designated Security Officer annually.
Operational Procedure Documentation
Step-by-step operational procedures for every security process — access provisioning, incident response, offboarding, backup verification. The documentation an audit requires.
Annual Risk Assessment
Formal risk assessment completed, dated, and signed every year. The foundational requirement of HIPAA, PCI DSS, and SOC 2 — and the most commonly missing control in regulatory investigations.
Monthly Compliance Evidence Tracker
Every compliance activity documented every month — audit log reviews, training completions, access reviews, policy reviews. The evidence trail that answers an OCR investigation or SOC 2 audit.
Semi-Annual Access Review
Twice-yearly review of who has access to what — systems, files, and sensitive data. Access rights confirmed or revoked. Every review documented and dated.
Quarterly Compliance Meetings
Four times per year we meet to review your compliance status, address any gaps, update documentation for organizational changes, and prepare for the next evidence cycle.
Annual Compliance Confirmation
Annual review of your complete compliance program — policies re-signed, risk assessment completed, training confirmed, evidence reviewed. Your program confirmed current and operating.
Audit-ready in 90 to 120 days.
A structured four-phase process that builds your compliance program from the ground up — no prior compliance work required.
Assess
Full gap analysis against your framework. Every gap documented with regulatory citation and risk level — before a single policy is written.
Build
All 12 policies written. Risk assessment completed. BAA register established. Evidence tracker configured. Your program foundation is in place.
Activate
Documentation signed and dated. Workforce training initiated. Access controls reviewed. Evidence tracking live. Your program is operating.
Audit-Ready
First monthly evidence records generated. BAAs executed. First quarterly review complete. You can now respond to a regulator or auditor with confidence.
A complete, managed compliance program for your regulatory framework — built from scratch, maintained monthly, and ready to evidence at all times.
Most Comply engagements for organizations with 15 to 50 employees start between $800 and $1,500 per month depending on organization size and framework. Request a proposal for a tailored flat-rate quote.
No setup fee · One framework included · Additional frameworks available as add-on · 12-month initial term · No per-incident billing
