A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →Every engagement starts the same way and runs in a workspace you keep. The middle depends on the service.
Thirty minutes to understand what you need, who is asking, and whether we are the right fit.
Scope and price in writing. Testing adds an authorization to test, signed before anything is touched.
A kickoff call, then a short intake in your workspace: what we need, the access, and who we work with.
Tracked in your workspace, so you always see what is done and what is waiting on whom.
Your report, walked through on a call, with letters for buyers or auditors where you need them.
We suggest the natural next step, and you decide. You keep everything either way.
Every framework runs the same three phases, on one record per framework.
Fixed price. One request list for the documents and access we need, walked through on the onboarding call. Every control assessed, findings ranked, and a gap report you keep whether or not you continue.
Fixed price, scoped from the gap, with findings carried over and nothing re-entered: policies, controls and evidence, then auditor selection, handoff and support through to your report or certificate.
Continuous compliance between audits: evidence, monitoring, policy and access reviews, vendor reviews, and readiness each audit cycle.
Already on Drata, Vanta or a similar platform? We work inside it. If not, the free workspace does the job. See all compliance services.
You give us access the agreed way. We prefer staging; production is your call.
Anything critical reaches your contact within 24 hours, and we pause if your environment is at risk.
Findings with severity, evidence and steps to fix, tracked in your workspace until closed.
A letter confirming the engagement before the report, then an attestation letter you can share.
We retest your fixes, then you remove our access.
What is in and out, agreed in writing.
A short checklist in your workspace.
Interviews with your team and a review of the evidence.
A formal report with a risk-ranked roadmap, walked through on a call.
Your environment, registers and open risks reviewed, and a plan agreed.
The recurring work on a set rhythm, with the time spent visible in your workspace.
What was done, what changed and what is next, drawn from your workspace.
On a single target or across a portfolio, before you sign or while you hold. How it works
Deliver compliance and testing to your own clients through us. The client relationship stays yours. How it works
It depends on what the gap analysis finds, not on a fixed track. SOC 2 Type I commonly takes a few months from start to report. Type II adds an observation window of 3, 6 or 12 months. ISO 27001 certification commonly takes several months, including the Stage 1 and Stage 2 audits. The drivers are the gaps, the observation period and the auditor's schedule. We give you a realistic plan after Phase 1.
One person who can make decisions about scope, named owners for the controls, and the items on your request list. The kickoff call walks through that list with you, so you only work on what applies.
Yes. Give us a seat and we work where your evidence already lives. If you do not use one, your free TrazTech workspace does the same job.
Yes. We issue a letter confirming the engagement before testing starts, and an attestation letter once the report is out.
Yes. Questions about how we tested, what we reviewed or how a finding was closed come to us, and we answer them directly.
You keep the deliverables and the workspace. We suggest the natural next step, such as Phase 2, a retest or ongoing upkeep, and you decide.