Be secure and compliant.
Risk and Compliance and Security Operations share one data model, so every technical finding you fix is already compliance evidence. One place to look, one record to show.
Know where you stand, and what to do about it.
Nine capabilities that turn your profile into a ranked gap list, a risk register and evidence that is audit-ready on demand.
Built from your business, not a template.
What you provide, what you depend on to deliver it, and the systems and rules involved. Everything downstream is scoped from this.
Map a control once, comply many times.
NIS2, ISO 27001, DORA and GDPR mapped on one control set, so the same work counts everywhere it applies.
Compliance as a to-do list, not a binder.
The gaps ranked worst first, turned into a plan where every task has an owner, a deadline and a time estimate.
Risks with owners, treatments and deadlines.
Findings from Security Operations land in the register automatically, and overdue treatments chase you on the home screen.
Policies that stay up to date.
Templates mapped to your frameworks, with versions, approvers and staff acceptance tracking.
Your suppliers, assessed and on record.
Suppliers, their assessments and the security terms you agreed, where your auditor looks for them.
The audit file assembles itself.
Evidence per control, with every action leaving a dated record. Reports for management and auditor packs generate on demand.
What would hurt, and how much.
Your critical processes and the systems behind them, so every gap and risk is ranked by what it would cost you.
Awareness that leaves a record.
Security awareness for your staff, with a record of who completed it and when, ready as evidence.
Detection, exposure and resilience.
An extension of Risk and Compliance, switched on when you are ready. It runs continuously, triages every finding against your business context, and records it as evidence.
Threat detection
Logs analysed as they arrive. What escalates is what matters to your business.
Exposure management
Vulnerabilities, configuration and cloud posture, each with a recommended fix.
Resilience
Backups verified rather than assumed, with recovery plans and owners on record.
Bring the tools you trust.
Connected systems feed posture, vulnerabilities and logs automatically. Already running a SIEM, IAM, backup or training vendor you do not want to displace? We integrate it into the same gap list and the same evidence trail, so the work it already does counts.
From first call to a platform that runs itself.
-
Profile
A questionnaire about your business and IT sets the scope.
-
Connect
Read-only access to your cloud and SaaS, an agent on your servers.
-
First results
Ranked gaps, first findings, and a roadmap with owners.
-
Run continuously
Detection and scanning keep running. Evidence builds as you work.
Sovereign by design.
Hosted on EU-owned infrastructure with European data residency. The models we run are open source, on our own hardware or served by European providers. Your data is never used to train a model.
Common questions about the platform.
Is CloudSoul a SaaS platform or a managed service?
It is a complete SaaS platform. Continuous scanning, vulnerability and patch oversight, and evidence collection are platform features that run automatically.
What does Risk and Compliance do?
It is one of the two platform pillars: know where you stand, and what to do about it. It profiles your business and IT, runs the assessment, produces the gap list in priority order, holds the evidence and reports out. Risks, policies, controls, frameworks: all in one place.
Can I bring my existing tools (SIEM, IAM, etc.)?
Yes. If you have an incumbent SIEM, IAM, backup, or training vendor you want to keep, it feeds the same evidence engine and the same plan as everything else. Custom integrations are scoped per request.
Where does my data live?
In the EU. CloudSoul is hosted on EU-owned infrastructure, not an EU region of a US-owned provider, so there is no US Cloud Act exposure. Models are open source, on our own hardware or served by European providers, and your data is never used to train a model.
What frameworks does the platform support?
The mapping engine covers NIS2, ISO 27001, CIS, DORA, GDPR and TISAX. Once a control is mapped, it carries across frameworks, so adding ISO 27001 does not mean rebuilding your control library.
How is the platform priced?
Annual contracts with monthly billing, sized by employee band. You get the exact numbers on the first call, and a written offer within 24 hours.
Do you offer a one-off security assessment?
Yes, the Security Audit: an independent audit of your systems and posture. Automation does the collection, a vCISO validates, prioritises and writes the recommendations, and you get a ranked gap list you can use as your roadmap.
Does this still hold as we grow?
That is the point of modelling the business rather than writing it up once. Hire people, open a site, add a supplier or a new system, and you update the model instead of rewriting a folder of documents. What you show an auditor keeps describing the company you actually are.