Menu
Pre-enterprise compliance check — SOC2 / GDPR / HIPAA / CCPA gap analysis with prioritized remediation. Not a substitute for real audit.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Slice a goal into the smallest feature slices that can each be PROVEN — every slice ships with a named eval and an end-to-end test, and a slice you can't evaluate or test doesn't get selected. Use after the goal is set and before the spec, so only provable features make the build.
Guided, stateful provisioning of a product's production stack — deep-links, key-format validation, a secrets backend (fnox recommended, or user-touched .env.local), a resumable ledger, CLI automation after signup, and a blocking A1–A10 live gate. Hands off to /security-check → /ship. The walked version of SETUP.md.
Creates specs before coding. Use when starting a new project, feature, or significant change and no specification exists yet. Use when requirements are unclear, ambiguous, or only exist as a vague idea.
Launch the factory's control plane — scaffold and fill FACTORY-ORDERS (weekly mandate + hard budget), STANDING-ORDERS (autonomous-program authority), HEARTBEAT (weekly pulse), and write lifecycle gates for every registered product. A deliberate one-time ritual (re-run to audit); invoke as /factory-launch, not auto-triggered.
One-shot a new product — folders, Next.js starter, product.config.json, CLAUDE.md, scope.md, PRD skeleton, SETUP.md checklist. The Lovable-like ignition.
Breaks work into ordered tasks. Use when you have a spec or clear requirements and need to break work into implementable tasks. Use when a task feels too large to start, when you need to estimate scope, or when parallel work is possible.
| name | compliance-auditor |
| description | Pre-enterprise compliance check — SOC2 / GDPR / HIPAA / CCPA gap analysis with prioritized remediation. Not a substitute for real audit. |
| model_tier | opus |
Saved to products/<name>/scale/compliance-YYYY-MM.md:
## Compliance Gap Analysis — <product> — <date>
### Target frameworks
| Framework | Required by | Status |
|---|---|---|
| SOC 2 Type I | enterprise B2B | <gap | in-progress | passed> |
| GDPR | EU users | <status> |
| HIPAA | health data | <N/A | gap | covered> |
| CCPA | CA consumers | <status> |
### SOC 2 (if applicable)
**Trust Services Criteria gaps:**
- Security:
- [ ] Access reviews (quarterly): <status>
- [ ] MFA enforced for all employees: <status>
- [ ] Encryption at rest and in transit: <status>
- [ ] Vulnerability scanning + patch SLA: <status>
- Availability: uptime SLA, monitoring, incident response
- Confidentiality: data classification, NDA, vendor management
- Privacy: data subject access, deletion, consent
**Tooling:** Vanta / Drata / Secureframe / manual? <recommendation>
### GDPR (if EU users)
- [ ] Privacy policy mentions: legal basis, data subjects' rights, contact for DPO/equivalent
- [ ] Cookie banner / consent mechanism
- [ ] Data subject access request (DSAR) workflow
- [ ] Right to be forgotten implementation
- [ ] Data processing agreement (DPA) template
- [ ] Sub-processor list maintained
### HIPAA (if health data)
- [ ] BAA template
- [ ] PHI encryption end-to-end
- [ ] Audit logging on every PHI access
- [ ] Access control with least-privilege roles
### CCPA (if California)
- [ ] "Do Not Sell My Info" link in footer
- [ ] DSAR process
- [ ] Privacy policy section on CA rights
### Remediation sequence
1. <Critical — block enterprise sales until done>
2. <Important — needed within 30 days>
3. <Nice-to-have — backlog>
### Out of scope of this review (need human expert)
- Legal review of contracts
- Penetration test (annual SOC2 requirement)
- Insurance (cyber liability)
factory/playbooks/scale-stage/enterprise-readiness.md