Frequently Asked Questions

Vylint Shield is a compliance automation platform for startups and growing teams. It guides you through SOC 2, ISO 27001, HIPAA, NIST CSF, PCI DSS, GDPR, CMMC, NIST 800-53, and FedRAMP compliance with pre-built control libraries, automated evidence collection, and audit-ready documentation—so you can achieve certification faster without drowning in manual work.

Vylint Shield supports nine compliance frameworks: SOC 2, ISO 27001, HIPAA, NIST CSF 2.0, PCI DSS 4.0, GDPR, CMMC 2.0, NIST SP 800-53, and FedRAMP. All are included on every plan.

Yes. Vylint Shield is built to connect with your cloud providers (AWS, GCP, Azure), identity systems (Okta, Google Workspace, Microsoft Entra), and developer tools to pull audit evidence automatically. Integrations are being expanded continuously—contact us if a specific integration matters to your team.

Most compliance tools require you to manually screenshot dashboards, export CSVs, and track evidence in spreadsheets. Vylint Shield connects directly to your tech stack and pulls evidence automatically—access logs, configuration snapshots, training records, vulnerability scan results—organized by control. When audit week arrives, your evidence is already there.

Yes. All plans support PDF export of your compliance documentation package: policies, risk assessments, control evidence summaries, and audit-ready reports. On Standard and Pro you can also invite your auditor into the portal directly, using one of your user seats.

Basic plans include 1 user seat. Standard plans support up to 5 users. Pro plans are unlimited. User seats cover everyone who needs to contribute to compliance work—typically engineering, security, legal, and operations team members.

Every plan is billed annually, as one payment up front: $588/year for Basic (all 9 frameworks, 1 user), $1,788/year for Standard (team dashboard, up to 5 users), and $3,588/year for Pro (unlimited users). That works out to $49, $149, and $299 per month respectively, but there is no monthly plan — the full annual amount is charged the day you subscribe, and each plan renews automatically once a year until you cancel. See our pricing page for the full feature breakdown.

All subscriptions are billed through Stripe, our payment processor. Once you have paid your subscription and completed the compliance questionnaire in the platform, the service is considered fully delivered — no refunds will be issued from that point forward. If you cancel before your compliance documentation has been delivered, you may choose either to keep your access for the rest of the term you paid for, or to end your access and receive a pro-rata refund of your prepaid fee; to choose the refund, email support@vylintshield.com within 30 days after you cancel. If VylintShield's platform experiences a confirmed technical failure that prevents your completed questionnaire from generating documentation, contact support@vylintshield.com and we will re-generate your documents. If we are unable to re-generate them within a reasonable time because of a platform defect, we may issue a pro-rata refund for the affected subscription period. See our Terms of Service for full details.

SOC 2 Type I readiness documentation typically takes 6–12 months using manual approaches. Vylint Shield is designed to significantly compress that timeline by providing pre-built policy templates, guided assessment workflows, and streamlined evidence organization—so your team can focus on implementation rather than document creation.

ISO 27001 certification typically takes 6–12 months from kickoff to certificate. The certification body audit itself (Stage 1 + Stage 2) adds another 4–8 weeks depending on your chosen certification body's schedule. Vylint Shield is designed to help teams complete the documentation preparation phase faster by providing structured templates and guided workflows.

SOC 2 is a U.S.-centric framework where an independent CPA firm issues an audit report based on the AICPA Trust Services Criteria. ISO 27001 is an international certification standard with 93 Annex A controls issued by an accredited certification body. SOC 2 is most commonly required by U.S. enterprise buyers; ISO 27001 is required by European companies and government contracts. Vylint Shield maps the two frameworks together—controls you implement for one apply to the other.

Yes. Vylint Shield includes a HIPAA module covering the Security Rule's Administrative, Physical, and Technical Safeguards plus Privacy Rule requirements — 47 controls in total. If you handle Protected Health Information (PHI), Vylint Shield guides you through the required safeguards and helps you maintain the documentation needed for HIPAA compliance.

No. Vylint Shield creates compliance documentation and readiness tools — it does not certify your organization. Achieving formal certification under SOC 2, ISO 27001, HIPAA, or any other framework requires you to engage an independent, accredited third-party assessor or certification body at your own cost. Vylint Shield helps you prepare the documentation and evidence needed to pursue certification, but the certification process itself is your responsibility.

Vylint Shield prepares you for your audit — it does not replace your auditor. For SOC 2, you still need an independent CPA firm to issue your report. For ISO 27001, you need an accredited certification body. Vylint Shield reduces the time and cost of working with auditors by delivering organized, complete evidence and documentation.

Yes. Vylint Shield lets you import existing policies and control evidence. You can start from where you are rather than starting over. The gap analysis will show exactly what's missing and what's already covered.

SOC 2 has five Trust Services Categories: Security (required for all audits), Availability, Processing Integrity, Confidentiality, and Privacy. Most B2B SaaS startups pursue Security plus Availability. Vylint Shield supports all five categories and guides you through control selection based on which categories you are pursuing.

The Statement of Applicability is the master document that records which of the 93 ISO 27001 Annex A controls you have included or excluded, with justification for each decision. Auditors start with the SoA. Vylint Shield auto-generates your SoA from your control selections and keeps it synchronized as your ISMS evolves.

Yes. Both are included. Every Vylint Shield plan covers all 9 frameworks: SOC 2, ISO 27001, HIPAA, NIST CSF, PCI DSS, GDPR, CMMC, NIST 800-53, and FedRAMP — there is no add-on or upgrade for framework coverage.

You can sign up and complete the initial assessment in about 15 minutes. Vylint Shield's onboarding guides you through framework selection, scope definition, and your first gap analysis. Most teams have a clear compliance roadmap within the first hour.

No. Vylint Shield is designed for founders, engineering leads, and operations managers who are running compliance alongside other responsibilities. You don't need a compliance background—the platform guides you through each step with explanations written in plain language, not jargon.

Every plan includes email support. Basic plan users get a response within 2 business days. Standard and Pro plan users get priority email support with a response within 1 business day — the fastest response time we commit to on any plan. Pro's difference is capacity rather than a separate support channel: unlimited user seats.

Yes. A completed SOC 2 or ISO 27001 report answers the vast majority of vendor security questionnaire questions. Vylint Shield's documentation exports are designed to be shared directly with prospects and partners, significantly reducing the time spent on individual questionnaires.

Yes. Vylint Shield is built with security by default: all data is encrypted at rest and in transit. We are committed to maintaining strong security practices as our platform grows.

Your compliance documentation is yours. Export it as a PDF package from the portal before your paid term ends — portal access, including export, requires an in-term subscription. After your term ends we keep your compliance data so you can reactivate; you can request deletion at any time and we will delete it within 30 days. Billing records are kept longer for financial recordkeeping. Our Privacy Policy sets out the full retention schedule.

Yes — and you don't need to book anything. There's a product walkthrough video on our homepage that shows the assessment and document generation end to end, and you can start a free assessment to see your own results in minutes. Vylint Shield is self-serve, so we don't run scheduled sales demos.