We built ruledoc because firewall compliance is broken.

01The problem.

Every audit window looks the same. Someone hands the IT team a spreadsheet of controls. Someone else exports the firewall config. A junior engineer spends a week cross-referencing rule numbers against framework clauses. Half the answers are guesses. The auditor gets a PDF, signs it, and the file goes into a drawer until next year.

This was tolerable when NIS2 and SOC 2 were nice-to-haves. It is not tolerable now that NIS2 is law in the EU and customers refuse to sign without a SOC 2 report. The cost of the manual workflow now exceeds the cost of buying a tool that does it.

02What we built.

ruledoc reads the firewall config, parses it into a vendor-neutral model, and runs that model against six compliance frameworks at once. The output is an audit-grade report with line-level citations and plain-English remediation paragraphs. The kind of report an auditor signs off on.

We support ten firewall platforms. The same config that goes in for NIS2 gets you a SOC 2 view, a PCI-DSS view, an ISO 27001 view, a CIS Controls view, and a NIST CSF view. No extra work.

03Who it is for.

• IT managers facing an audit and tired of building the same spreadsheet by hand.
• MSPs running multiple client estates who need consistent reporting across vendors.
• Compliance teams who want evidence on demand, not once a year.
• Internal audit who want a reproducible second opinion on the network layer.

04How we work.

Single-tenant data isolation per customer. Configs encrypted at rest. Retention windows tied to your tier: 90 days on Single Report, 1 year on Pro. DPA available on request.

We are based in Sweden and operate under EU data protection law. Customer configs stay in EU regions. Sub-processors are listed at /legal/sub-processors.

The product is built on a small set of opinionated decisions: a single vendor-neutral format that every parser targets, per-framework risk engines that share the same evidence, and reproducible PDFs with a SHA-256 stamped at generation time. The deeper architecture is in the docs.