Your startup is probably failing GDPR and doesn't know it — so I built a free checker

The moment usually goes like this: a customer emails "can you sign our DPA and send your SOC 2 report?" — and everyone on the team goes quiet.

Big companies answer that email with a compliance department and a platform that costs more than your server bill. Small teams answer it with a spreadsheet, a Notion page, and hope.

I wanted a third option: a free tool that tells a small team, in plain terms, where they actually stand — and what to fix first.

What GDPR and SOC 2 actually ask for

Strip away the legal language and most of it is common sense written down:

Do you know what personal data you collect, and why? (GDPR: lawful basis, records of processing)
Do people get a clear privacy notice when you collect it?
Can you answer a "delete my data" request within a deadline?
Is data encrypted, access-controlled, and backed up?
If something leaks at 2 AM, do you know who does what in the first 72 hours? (GDPR breach rule)
SOC 2 adds the operations side: access reviews, change management, vendor checks, incident response.

None of this is exotic. The problem is that nobody hands a 5-person team the checklist.

The tool

I built AutoCompliance — an open-source CLI (MIT, pure Python, zero dependencies, runs 100% locally):

pip install autocompliance
autocompliance assess --company "Your Co"

It asks 40 yes/no questions — 22 GDPR, 18 SOC 2 — and then:

Grades you A–F, per framework and per control area, so you see exactly where you're weak.
Gives a prioritized fix list — not just what's wrong, but what to do first.
Generates 15 starter documents: privacy policy, data processing agreement (DPA), records of processing (RoPA), breach response plan, data retention policy, SOC 2 control checklist, risk register, and more — as Markdown, an HTML report, or a PDF (--pdf).

No account. No telemetry. Nothing leaves your machine. The whole assessment takes about five minutes.

Honest limits

This is a readiness self-check, not legal advice and not an audit. It will not make you "GDPR certified" (no such thing exists) or hand you a SOC 2 report an auditor would sign. What it does is replace the blank page: you get the map, the gaps in order, and the first drafts of the documents — the work consultants charge thousands for in week one.