Learn Privacy, Security, and Compliance
Plain-English guides to the frameworks, laws, and security reviews that gate your growth. From SOC 2 and GDPR to DSARs and AI governance, written for the team that has to answer the questionnaire, not only pass the audit.
Security & Compliance
What buyers check before they sign.
SOC 2
The default trust signal for SaaS: the framework, the audit, Type 1 vs Type 2, cost, and staying current.
- What Is SOC 2? A Beginner's Guide to the Framework
- The Five Trust Services Criteria, Explained
- SOC 2 Type 1 vs Type 2: What's the Difference
ISO 27001
The international ISMS standard: the certification path, Annex A controls, and the Statement of Applicability.
- What Is ISO 27001? A Guide to the Standard
- The ISO 27001 Certification Process: A Step-by-Step Roadmap
- ISO 27001 Annex A Controls, Explained (93 Controls, Four Themes)
Trust Center
The buyer-facing page that proves your security posture: what it is, why buyers expect one, and what it should include.
All 4 GuidesAI Governance
The EU AI Act, ISO 42001, and NIST AI RMF as one program: AI policies, disclosures, and the AI security review.
- EU AI Act, ISO 42001, and NIST AI RMF: How the Three Fit Together
- What Is the EU AI Act (and What's Actually in Force Now)
- What Is an AI Policy (and Why You Need One)
Data Privacy
Consent, rights requests, and the law behind them.
GDPR
The EU's core privacy law in operational terms: who must comply, the data subject rights, RoPA, and consent.
- What Is GDPR? A Plain-English Guide
- Who Must Comply With GDPR (Even Outside the EU)
- The GDPR Data Subject Rights, Explained
CCPA/CPRA & US State
California plus the wider state patchwork: opt-outs, GPC, and the new ADMT rules, kept current.
- What Is CCPA/CPRA? California's Privacy Law Explained
- US State Privacy Laws: The 2026 Landscape
- CCPA/CPRA's ADMT and Risk-Assessment Rules: What to Do Now
DSAR / Privacy Requests
Data subject access requests end to end: what one is, response timelines by law, and fulfilling them at scale.
- What Is a DSAR? Data Subject Access Requests Explained
- DSAR vs DSR: What's the Difference
- DSAR Response Timelines by Law: GDPR, CCPA/CPRA, and More
Consent Management
Cookie and tracker consent from first principles: Google Consent Mode v2, the IAB TCF, and geo-targeted banners.
- What Is a Consent Management Platform (CMP)
- Do You Legally Need a Cookie Banner?
- Cookie Consent: EU Opt-In vs US Opt-Out
Tools & Reference
Free interactive tools and quick definitions to use alongside the guides.
Compliance Glossary
Short, answer-first definitions for every term across the guides, from DSAR and RoPA to the Trust Services Criteria.
View GlossarySOC 2 Readiness Assessment
A free self-check: answer 13 questions and see how close you are to a SOC 2 audit. No signup.
Open ToolUS State Privacy Law Tracker
Every US state privacy law at a glance: effective dates, opt-out rules, and which ones require honoring GPC.
Open ToolGoogle Consent Mode Scanner
Scan your site to check whether your Google Consent Mode v2 signals are set up correctly.
Open Tool