🏛️ PolicyCraft — AI Compliance Policy Generator for Startups

Date: 2026-07-19 Difficulty: ⭐⭐ (Medium) Estimated Build Time: 2.5 days (~20 hours) Category: compliance, ai-powered, documentation Tech Stack: Next.js 15 + React 19 + TypeScript + Gemini AI + PostgreSQL + PDF generation

🎯 Elevator Pitch

PolicyCraft lets founders generate legally-ready HR, security, privacy, and operational policy documents in under 5 minutes. Answer a 60-second questionnaire about your company — size, industry, location, team structure — and get beautifully formatted, compliant PDFs ready to share with investors, employees, and compliance auditors. No lawyers, no templates, no weeks of drafting.

❓ Problem

Early-stage startups (pre-seed to Series A) face a brutal compliance catch-22:

1. Investors demand policies. Due diligence checklists require an Employee Handbook, Data Privacy Policy, Code of Conduct, Security Policy, Remote Work Policy — often 15+ documents.
2. Lawyers cost $300–800/hr. A full policy set costs $5K–$15K to draft. Pre-seed founders can't afford that.
3. Free templates are dangerous. Generic templates from Google Docs are:
   • Not jurisdiction-aware (CA vs NY vs TX requirements differ)
   • Missing critical clauses (arbitration, data retention, whistleblower)
   • Not framework-aligned (SOC 2, ISO 27001, GDPR readiness)
4. Wasting founder cognitive load. Founders should be building product, not copy-pasting HR policy templates for 3 days.

Current alternatives: Lawyers (too expensive), generic template marketplaces (incomplete/dangerous), DIY with Notion (hours of work, no compliance confidence).

💡 Solution

PolicyCraft is an AI policy co-pilot that:

1. Asks structured questions about your startup (team size, location(s), industry, headcount, tech stack, data types handled, existing compliance frameworks)
2. Generates complete policy documents using Gemini AI with structured prompt templates that embed jurisdiction-specific legal requirements
3. Outputs polished, brandable PDFs with your company name, logo, and color scheme
4. Stores everything in your dashboard for version tracking, re-generation, and bulk download
5. Provides a Compliance Readiness Score — a 0–100% gauge showing how many common due diligence requirements you've covered

Each policy is jurisdiction-aware (CA, NY, TX, UK, EU variants) and framework-tagged (SOC 2, ISO 27001, GDPR, HIPAA readiness), so founders know exactly which compliance boxes each document checks.

👥 Target User

🛠️ Full Tech Stack

Frontend

Backend & Infrastructure

Testing & CI/CD

Monitoring & Analytics

Key SDKs & Libraries

🎨 UI Design Language

🏗️ Full System Architecture

Repository Pattern

Single repo (Next.js monolith) — all code in one Next.js 15 app:

policycraft/
├── app/
│   ├── (marketing)/       # Landing, pricing, about pages
│   │   ├── page.tsx
│   │   └── pricing/page.tsx
│   ├── (dashboard)/       # Authenticated routes
│   │   ├── dashboard/
│   │   │   ├── page.tsx       # Policy listing + compliance score
│   │   │   └── policies/
│   │   │       ├── [id]/      # Single policy view + download
│   │   │       └── new/       # Questionnaire wizard
│   │   └── layout.tsx         # Dashboard layout with sidebar
│   ├── api/
│   │   ├── generate/          # Server Action (preferred) or route
│   │   ├── regenerate/[id]/   # Re-generate a policy
│   │   └── webhooks/          # LemonSqueezy webhook endpoint
│   └── layout.tsx             # Root layout (ThemeProvider, etc.)
├── components/
│   ├── ui/                    # shadcn/ui components
│   ├── wizard/                # Multi-step questionnaire components
│   ├── policy-card/           # Policy card with status badge
│   └── pdf/                   # React-PDF document definitions
├── lib/
│   ├── db/                    # Drizzle schema + client
│   ├── ai/                    # Gemini prompt templates + client
│   ├── pdf/                   # PDF generation helpers
│   └── auth/                  # NextAuth configuration
├── drizzle/
│   └── schema.ts              # Database schema (single file, MVP)
└── types/
    └── index.ts               # Shared TypeScript types

API Layer

• Server Actions for all CRUD operations (policy generation, regeneration, deletion)
• Route Handlers for:
  • POST /api/webhooks/lemonsqueezy — handle subscription events
  • GET /api/policies/[id]/download — download PDF via direct URL
• No GraphQL, no tRPC — keeping it simple with Server Actions + React Query

Database Schema (PostgreSQL via Neon)

users
  id: uuid (PK, default)
  name: text
  email: text (unique)
  image: text (nullable, avatar URL)
  createdAt: timestamp

companies
  id: uuid (PK)
  userId: uuid (FK → users.id)
  name: text
  size: text (enum: solo/1-5/5-15/15-50/50+)
  industry: text
  locations: jsonb ([{state, country}])
  techStack: jsonb (array of tech categories)
  dataTypes: jsonb (PHI, PII, financial, etc.)
  frameworks: jsonb (SOC2, ISO27001, GDPR, HIPAA, none)
  createdAt: timestamp

policies
  id: uuid (PK)
  companyId: uuid (FK → companies.id)
  type: text (enum: employee-handbook, code-of-conduct, data-privacy, security-policy,
                remote-work, ip-assignment, acceptable-use, incident-response,
                data-retention, whistleblower, anti-harassment, social-media)
  title: text
  content: jsonb (full generated markdown)
  frameworkTags: jsonb (which frameworks this policy supports)
  jurisdiction: text (e.g. "CA, NY, TX" or "UK, EU")
  version: int (default 1)
  createdAt: timestamp
  updatedAt: timestamp

subscriptions
  id: uuid (PK)
  userId: uuid (FK → users.id, unique)
  lemonSqueezyId: text (unique)
  tier: text (free / pro / business)
  status: text (active / cancelled / past_due)
  currentPeriodEnd: timestamp
  createdAt: timestamp

Relationships:

• User → Companies (1:N) — one user can set up multiple companies/brands
• Company → Policies (1:N) — each company has many generated policies
• User → Subscription (1:1) — single active subscription per user

Auth Flow

• NextAuth.js v5 with GitHub + Google OAuth providers
• Session stored in JWT (no database session table for MVP simplicity)
• Protected routes via middleware matching /dashboard/*

PDF Generation Flow

1. User completes questionnaire wizard (multi-step form, Zustand manages wizard state)
2. On final step, Server Action fires:
   • Gathers all questionnaire answers + company profile
   • Sends structured prompt to Gemini API with policy-type-specific template
   • Receives markdown content back
   • Parses/extracts sections from structured response
   • Renders PDF via @react-pdf/renderer on server
   • Stores markdown content in PostgreSQL (policies table)
   • Uploads PDF to Vercel Blob
   • Returns policy ID + preview content to client
3. User can preview markdown (react-markdown) or download PDF

AI Prompt Engineering Strategy

Each of the 12+ policy types has a dedicated prompt template:

// Example: Employee Handbook prompt structure
const EMPLOYEE_HANDBOOK_SYSTEM_PROMPT = `You are an expert employment law compliance assistant.
Generate a complete Employee Handbook for a {size}-person company in {industry}
located primarily in {jurisdiction}. The company handles {dataTypes} data.

The handbook must cover:
1. Introduction & Company Mission
2. Employment Policies (at-will, equal opportunity, anti-discrimination)
3. Compensation & Benefits
4. Work Schedule & Remote Work
5. Code of Conduct
6. Leave Policies (vacation, sick, parental)
7. Data Protection & Privacy
8. IT & Security Policy
9. Discipline & Termination
10. Acknowledgment Form

Format as clean markdown with ## headings, each section 3-5 paragraphs.
Include jurisdiction-specific clauses for {jurisdiction}.
Flag any section that touches {frameworks} compliance requirements.
Add [COMPLIANCE_FLAG: SOC2-CC6.1] type annotations where relevant.
`;

This is sent as a chat request to gemma-4-31b-it via the Google Gemini API key from .aienv.

Caching Strategy

• React Query with staleTime: 5min for policy list (dashboard)
• No Redis needed for MVP — PostgreSQL handles query load
• Vercel Edge Cache for marketing pages (ISR with revalidate: 3600)
• CDN via Vercel's built-in edge network for PDF downloads from Blob

Environment Structure

# .env (local) / Vercel Environment Variables
DATABASE_URL=postgresql://...
GEMINI_API_KEY=...
AUTH_SECRET=...
AUTH_GITHUB_ID=...
AUTH_GITHUB_SECRET=...
AUTH_GOOGLE_ID=...
AUTH_GOOGLE_SECRET=...
LEMON_SQUEEZY_API_KEY=...
LEMON_SQUEEZY_STORE_ID=...
LEMON_SQUEEZY_WEBHOOK_SECRET=...
RESEND_API_KEY=...
BLOB_READ_WRITE_TOKEN=...
NEXT_PUBLIC_APP_URL=http://localhost:3000

Deployment Topology

┌──────────────┐     ┌──────────────────┐     ┌─────────────┐
│   Browser    │ ──▶ │  Vercel (Edge)   │ ──▶ │  Neon DB    │
│  (React SPA) │     │  Next.js 15 App  │     │ PostgreSQL  │
└──────────────┘     │  + Server Actions│     └─────────────┘
                     │  + API Routes    │        ▲
                     └────────┬─────────┘        │
                              │                  │
                     ┌────────▼─────────┐        │
                     │   Gemini API     │────────┘
                     │  (Google Cloud)  │(stores markdown
                     └──────────────────┘ in policies.content)
                     
                     ┌──────────────────┐
                     │  Vercel Blob     │
                     │  (PDF storage)   │
                     └──────────────────┘
                     
                     ┌──────────────────┐
                     │  LemonSqueezy    │
                     │  (payments)      │
                     └────────┬─────────┘
                              │ webhook
                              ▼
                     Vercel /api/webhooks/lemonsqueezy

Data Flow (Policy Generation)

1. User fills questionnaire wizard (Zustand state, client-side)
2. Clicks "Generate" → Server Action called
3. Server Action:
   a. Validates input with Zod
   b. Upserts Company record in PostgreSQL
   c. Calls Gemini API with structured prompt + company data
   d. Receives markdown policy content
   e. Parses response for section structure
   f. Inserts Policy record in PostgreSQL with content as jsonb
   g. Renders PDF via @react-pdf/renderer
   h. Uploads PDF to Vercel Blob
   i. Returns { policyId, previewMarkdown, pdfUrl }
4. Client shows preview (react-markdown), download button appears
5. User can download PDF, share link, or regenerate with modified answers

Monitoring & Observability

• Sentry: Error tracking for Server Actions, API routes, and client errors
• PostHog: Usage analytics (policies generated per user, completion rate, feature usage)
• Vercel Analytics: Core Web Vitals, traffic patterns
• Gemini API logging: Cost tracking via Google Cloud Console (token usage per generation)

Background Jobs

• None in MVP — all generation is synchronous (Gemini response is <10s)
• Future: Inngest for batch generation, email delivery of PDFs, subscription expiry cron

📋 PRD — Functional Requirements

FR-01: Authentication & Onboarding

• Users sign up via GitHub or Google OAuth (NextAuth.js v5)
• First-time users see an onboarding flow: "Tell us about your company"
• Onboarding collects: company name, size, industry, locations, tech stack, data types, compliance frameworks
• Onboarding data saved to companies table (upsert)

FR-02: Questionnaire Wizard

• Multi-step stepper UI (steps: Company Info → Locations → Tech & Data → Frameworks → Review)
• Each step collects specific data for policy generation
• Previous answers pre-filled when returning
• Progress indicator (% complete, step X of 5)
• "Generate All Policies" button on final review step or "Generate Single Policy" dropdown

FR-03: Policy Generation

• 12+ policy types available (see schema policies.type enum)
• Each generates via a dedicated Gemini prompt template
• Generation takes 3–10 seconds (streaming markdown preview as enhancement)
• Policies are created with a unique ID, stored as markdown in PostgreSQL
• Each policy tagged with applicable compliance frameworks and jurisdictions

FR-04: Dashboard & Policy Management

• Card grid showing all generated policies per company
• Each card shows: policy type, generated date, version number, status (draft/final)
• Compliance Readiness Score gauge (0–100%) based on which critical policies exist
• Click policy → full markdown preview with syntax-highlighted compliance flags
• Download PDF button (triggers server-side rendering + Blob upload)
• Regenerate button (re-runs with updated company data)
• Delete policy (soft-delete or full — TBD)

FR-05: PDF Export

• Polished PDF output with company name/logo (if provided), generated date, page numbers
• Professional PDF layout: cover page → table of contents → sections → acknowledgment page
• Custom fonts (Inter via @react-pdf/font)
• Downloadable directly from dashboard

FR-06: Compliance Readiness Score

• Algorithm: weighted checklist of 20+ critical policies × framework alignment
• 50% = all "Critical" policies exist (Employee Handbook, Code of Conduct, Data Privacy, Security Policy, IP Assignment)
• 30% = framework alignment (SOC2, ISO27001, GDPR policy coverage)
• 20% = recency/version freshness
• Displayed as a circular gauge on dashboard header

FR-07: Multi-Company Support

• Users can add multiple companies (important for consultants/agencies)
• Company switcher in sidebar
• Each company has its own policy set
• Billing per-company or per-user? Per-user for MVP (one subscription covers all)

FR-08: Billing & Subscription

• LemonSqueezy integration for payment processing
• Three tiers: Free, Pro, Business
• Free tier: 3 basic policies (Employee Handbook, Code of Conduct, Data Privacy), no PDF download
• Pro tier: All 12+ policies, PDF download, regeneration, 1 company
• Business tier: All policies, multi-company, custom branding on PDFs, priority generation
• LemonSqueezy webhook handles subscription lifecycle (created, updated, cancelled)

FR-09: Usage Tracking (PostHog)

• Track: sign-ups, questionnaire completions, policies generated, PDF downloads, regenerate clicks
• Track: which policy types are most popular (product feedback)
• Track: conversion funnel (signup → questionnaire → generate → download → paid)

Non-Functional Requirements

📚 Epics & User Stories

Epic 1: Authentication & Company Setup (Foundation)

Est. time: ~3h

Epic 2: Questionnaire Wizard (Core UX)

Est. time: ~4h

Epic 3: AI Policy Generation (Core Engine)

Est. time: ~5h

Epic 4: Dashboard & Policy Management

Est. time: ~4h

Epic 5: PDF Export & Branding

Est. time: ~3h

Epic 6: Billing & Subscriptions (Revenue)

Est. time: ~3h

💰 Pricing Model

Free tier rationale: 3 basic policies (Employee Handbook, Code of Conduct, Data Privacy) give enough value to demonstrate quality. PDF download locked to drive conversions. Polices are viewable as markdown preview so free users still get value.

📢 Go-to-Market Strategy

Channels

1. Product Hunt — launch with a strong demo GIF showing "15 policies in 5 minutes"
2. Hacker News — "Show HN: I built an AI that writes your startup's compliance policies in 5 minutes" — founders love compliance hacks
3. Indie Hackers — audience of solo founders who need cost-effective compliance
4. Twitter/X — thread showing the pain: "Investors asked me for 12 policy docs. I couldn't afford a lawyer. So I built this."
5. YC Startup School / communities — post in founder forums where compliance comes up weekly

Positioning

• Tagline: "Your startup's compliance docs in 5 minutes. No lawyer required."
• Angle: Time + money savings. Frame it as "the $5K compliance docs you can generate for $19/mo"
• Social proof: Offer free lifetime Pro to 10 YC/well-known founders for testimonials

Growth Loops

• Referral: Each generated policy has a "Share with a founder friend" link → referrer gets 1 month free
• Content marketing: Blog posts like "The 12 Policies Every Pre-Seed Startup Needs Before Fundraising" with PolicyCraft as the solution

Launch Sequence

📊 Success Metrics

⚠️ Risks & Mitigations

🏢 Competitors

Key Differentiator: PolicyCraft is the only tool that combines jurisdiction-aware generation, compliance framework tagging, and a one-questionnaire-to-all-policies flow specifically designed for pre-seed to Series A startups. Competitors are either too expensive (lawyers), too generic (templates), or too enterprise (Ironclad).

🔮 Future Enhancements (Post-MVP)

• Policy version diffing — see what changed between v1 and v2
• Collaborative review — share policy with co-founder for comments before finalizing
• API access — generate policies programmatically (for platforms that need compliance docs)
• Multi-language policies — generate in Spanish, French, German for international teams
• Compliance calendar — automated renewal reminders with policy expiration dates
• Bulk generation — generate all 12+ policies in one click with parallel Gemini calls
• Lawyer marketplace — optional human review by vetted employment attorneys for $99/policy

🧠 Brainstorm Review (2026-07-19)

Score: 6/15 — Feasibility 1 · Market Fit 4 · Complexity 1 → ⏸️ Deferred (full-SaaS over-scope) Strong market fit (4/5) — compliance docs are a real, expensive pain (lawyers $5–15K; investors demand 15+ docs) with clear target users and a defensible jurisdiction-aware / framework-tagged wedge. But as written it trips multiple hard rules: (1) full billing + multi-tenant + customer-portal (LemonSqueezy Free/Pro/Business + webhook), (2) 3+ OAuth/integration flows (GitHub + Google OAuth, LemonSqueezy webhook, Resend email, Vercel Blob), and the epic estimates (~22h P0) badly understate the real 5–7 day effort once auth/billing/webhooks/PDF+Blob are in. Rescue: "PolicyCraft Lite" — single-user (sandbox NextAuth or no-auth), no billing / multi-tenant, 60-sec questionnaire → one batched Gemini call → jurisdiction-aware policy markdown + print-to-PDF + a compliance-readiness score, localStorage or single-user Postgres. ~16–20h. Same Lite-rescue pattern as ClauseGuard (023) / TicketWise (031) — re-promote on rescope.