// the take
Comply is a Go CLI that turns a folder of markdown files into the policy documents, tickets, and PDFs you need for a SOC2 (or HIPAA/ISO27001/GDPR-flavored) audit. It ships with a full set of example SOC2 policies, procedures, and narratives mapped to the TSC-2017 standard, plus integrations to turn procedures into recurring Jira/GitHub/GitLab tickets. Built for a founder or eng lead doing their first SOC2 who wants policy docs in git instead of a shared Google Drive.
Treating compliance docs as markdown in a git repo is the right call — real diffs, real review, real version history instead of a Word doc nobody can track changes on. The bundled example policies, narratives, and TSC-2017 mapping are a genuinely usable starting point, not just empty folders with TODOs. Tying `comply scheduler` to procedure definitions means onboarding/offboarding/patch tasks actually turn into tickets on a cadence instead of living in someone's memory until the audit window opens.
No commits since mid-2022, so you're inheriting whatever auditor expectations and control language were current three-plus years ago, and dependency CVEs (there's a sizeable vendored tree) go unpatched indefinitely. PDF generation runs through pandoc plus a LaTeX install, and the README itself admits the Docker path is painful on Apple Silicon — a brittle, heavyweight toolchain for what's otherwise a simple CLI. It only produces the paperwork and the reminder tickets; there's no evidence collection, access-review automation, or control testing, so you still need separate tooling to actually satisfy an auditor's evidence requests. It's effectively a single-vendor (strongdm) project with no visible community contribution since its freeze, so there's no one to turn to if something breaks.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →