You are buying from one person. This is him.
My name is Joel Justin. I run Native Group LLC and I built Policywright myself, in Colorado Springs.
There is no team. When you email hello@policy-wright.com, I am the person who answers. When a provision in your plan cites 16 CFR 314.4(c)(5), it is there because I read 314.4(c)(5).
I am telling you this on the first screen because the alternative is what a lot of this category does: a plural pronoun, a stock photo, and a badge implying a credential. You should know exactly who is behind the thing you are about to pay for, and then decide.
What one person means for you.
Both directions, because you would find out either way.
What you get
A straight answer inside one business day, from the person who wrote the document you are asking about. Nothing is escalated to a tier two. Nothing is outsourced. If a provision is wrong, I fix it that day rather than filing it.
What you do not get
A support line at 2am. A sales engineer. An account manager. If you need a vendor with a 24/7 SOC and a procurement portal, I am not it, and you should buy from someone who is.
The question you should actually be asking.
Which is: what happens to my compliance documents if this guy stops answering email?
The answer is that nothing happens to them, by design. What you buy is delivered to you as PDF and DOCX files that you download and keep. There is no license key, no seat, and no platform you have to stay logged into for your WISP to remain a valid document. If Policywright vanished tomorrow, the plan on your hard drive would be exactly as good as it was the day before, and you could hand it to an examiner without calling anyone.
The Compliance Year subscription adds a dashboard and a record of what you have done, and you can export that record as a PDF binder at any time, including on the day you cancel. Your evidence is yours. It is not leverage.
Why I built it.
Under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, tax preparers, bookkeepers and small financial firms must maintain a written information security program. 16 CFR 314.3(a) requires it at any size, with no exemption for being small. Every paid preparer signs Form W-12 Line 11 each year acknowledging exactly that.
The available options are a free government template you have to interpret and tailor yourself, or a consultant engagement that runs many hundreds of dollars and takes weeks. Most small firms end up with a document too generic to hold up, or with nothing at all. I built the middle path: tailored to your firm, cited to the actual rule, and finished in an evening instead of a quarter.
How the documents are built.
Every clause traces to a primary source: the FTC Safeguards Rule at 16 CFR Part 314, IRS guidance such as Publications 5708 and 4557, or a real cyber-insurance underwriting requirement. Each obligation is written in plain language, carries the pinpoint citation it comes from, and is paired with a proof-of-implementation line telling you what evidence an examiner or carrier will ask for. Your answers decide which sections appear, so the result describes your firm rather than a generic one.
It also tells you what you do not owe. 16 CFR 314.6 lifts four specific duties for firms holding information on fewer than 5,000 consumers, which is most of the firms reading this. Your plan names those four, cites the exemption, and then explains why an incident response plan is still worth having. Selling you four obligations you do not have would be easier. It would also be the thing that makes you distrust everything else in the document.
Honest about what is in place.
The most dangerous thing a compliance document can do is claim a control exists when it does not. So where a safeguard is not yet in place, whether that is MFA, tested backups, training or a vendor review, your plan says so plainly and records a dated remediation step with an owner, instead of an overstated claim. That is what an examiner or a carrier actually wants to see, and it is far safer for your firm than a document that reads well and is false.
What Policywright is not.
Policywright is a documentation product, not a law firm. The documents are a configurable template, not legal advice, and buying them does not create an attorney–client relationship. I do not guarantee that any regulator, examiner or insurer will accept them. Review your plan, confirm it fits your firm, and put the controls it describes actually into place before you rely on it.
Policywright is a product of Native Group LLC, a Colorado limited liability company in good standing, entity ID 20261433373. You can verify that yourself at coloradosos.gov rather than taking my word for it.