Compliance

Phase 1, Phase 2, then keep it running

A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.

All compliance →
Certifications and reports
SOC 2
Type I or Type II, any criteria
ISO 27001
ISMS, done properly
ISO 42001 (AI)
AI management system
CyberSecure Canada
CAN/DGSI 104 and CPCSC Level 1
PCI DSS
Card data, any SAQ or ROC
Privacy
Quebec Law 25
The privacy law with teeth
PIPEDA
Federal privacy baseline
GDPR
EU data protection
HIPAA
For digital health
Outsourced Privacy Officer
Your named privacy officer
Audit support
Auditor Management
We manage the auditor for you
Internal Audit
Independent clause 9.2 audits
Continuous Compliance
Upkeep between audits
Trust Center
Self-managed, or managed by us
Cloud Cost Audit
AWS, Azure and GCP spend, ranked savings
Security

Testing, review and leadership

Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.

All security →
Testing
Penetration Testing
Web, API, network and cloud
AI / LLM Security
Including LLM red teaming
Vibe-Coded App QA
Security and QA for AI-built apps
Cloud Security Review
AWS, Azure and GCP configuration
Vulnerability Assessment
Verified scanning, risk-ranked report
Assessments
Enterprise Security Review
Your whole programme, one roadmap
Threat & Risk Assessment
Formal TRA for procurement
Vulnerability Management
Ongoing scans, tracked fixes
Cyber Insurance Readiness
Close the gaps underwriters price on
Leadership and response
vCISO
Monthly block or flexible hours
Incident Response Retainer
Help on call when it matters
Security Questionnaires
We answer them for you
Who we help

Prove you are secure

To the people you sell to, raise from or answer to.

All industries →
Companies
Startups and SaaS
Your first SOC 2 or pentest
Small and mid-sized businesses
CyberSecure Canada and privacy
Selling to government
TRAs and public-sector requirements
Partners
Investors
Technical due diligence
MSPs and IT firms
White-label compliance and testing
Case studies
Real engagements
Resources

Learn the space

Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.

Read the blog →
Learn
The Compliance Brief
Weekly security news, with our take
Research & CVEs
Our published vulnerability research
2026 Security Report
The state of startup security
Glossary
Security & compliance terms, explained
Library
Templates, checklists, and downloads
Tools & guides
Tools & Calculators
Free readiness and cost tools
Guides
Deep how-to walkthroughs
Comparisons
traztech vs the platforms
Blog
Buyer-focused security writing
FAQ
Common questions, answered
Company
Partners
Our offensive-security partner
Referrals
Refer a company, get rewarded
Case studies
Real engagements and the numbers behind them
How it works
Every engagement, step by step
Services & offers

Productized security & compliance services

Fixed-scope engagements and readiness sprints across compliance frameworks, cloud security, security leadership, and AI governance. Every one is a door-opener into a longer advisory relationship, start small, scale when it works.

Book a discovery call
Security & compliance services

Security & compliance services

Audit Recovery

Your SOC 2 or ISO 27001 audit stalled, came back qualified, or hit a major nonconformity. We rebuild the evidence position and get you back into fieldwork.

AWS Security Review

A security-focused review of your AWS environment (IAM, public exposure, misconfiguration, logging), not a cost audit. Findings prioritized by real risk.

CISO-as-a-Service

An outsourced CISO function on retainer (security strategy, compliance, and buyer trust), led by a published security researcher.

Cloud Security Assessment

A cloud posture assessment across AWS, GCP, and Azure (identity, network exposure, data protection, and misconfiguration), with risk-ranked findings.

Compliance Penetration Testing

A penetration test scoped and reported for SOC 2 or ISO 27001 audit evidence, delivered with our global and Canadian testing partners.

Enterprise Security Review

A point-in-time review of your whole security programme across people, process and technology, delivered as a risk-ranked roadmap of what to fix first.

Incident Response Tabletop

A half-day facilitated incident response exercise for exec, engineering, legal and comms, with an after-action report your board and insurer can both read.

Security Questionnaire Completion

Deal stuck on a buyer security questionnaire? We complete SIG, SIG Lite, CAIQ, VSA and custom questionnaires for you so the review clears fast.

SOC 2 Evidence Collection

Evidence gathering, control mapping, and audit prep for your SOC 2 examination, so you walk into the audit organized instead of scrambling for screenshots.

Third-Party Risk Management

We build or run your vendor risk programme: vendor inventory, risk tiering, vendor security reviews and a vendor risk register your auditors and buyers can see.

Trust Center (self-managed or managed)

A trust center that answers buyer security reviews. Self-managed and free for clients, or managed by TrazTech: security questions, NDA document requests and upkeep, quoted per organization.

Vibe-Coding QA & Security Review

A security and quality review of AI-generated code, against the failure modes coding assistants reliably produce. Findings with file references and fixes.

Vulnerability Assessment

Authenticated and unauthenticated vulnerability scanning of your apps, APIs and networks, with every result verified by a person and a risk-ranked report.
Framework readiness

Framework readiness

CyberSecure Canada Readiness

Get ready for CyberSecure Canada certification against CAN/DGSI 104, Level 1 or Level 2, and for CPCSC Level 1. Gap analysis, remediation, accredited audit.

GDPR Readiness

EU GDPR readiness: lawful basis, data mapping, data processing agreements, DSAR handling, and breach procedures for companies serving EU residents.

HIPAA Readiness

HIPAA readiness for health-data companies: administrative, physical, and technical safeguards, risk analysis, BAAs, and policies to protect PHI.

ISO 27001 Readiness

Done-for-you ISO 27001 readiness: ISMS scoping, Statement of Applicability, control build-out, internal audit, and Stage 1/2 coordination.

NIST CSF Assessment

Assessment against the NIST Cybersecurity Framework (CSF 2.0) across its six Functions: Govern, Identify, Protect, Detect, Respond, and Recover.

PCI DSS Readiness

PCI DSS v4.0.1 readiness: cardholder-data environment scoping, gap assessment, SAQ guidance, and remediation for anyone handling payment card data.

PIPEDA Readiness

PIPEDA readiness for Canadian private-sector organizations: consent, safeguards, breach reporting, and access rights under Canada’s federal privacy law.
Deadline-driven readiness

Deadline-driven readiness

Cloud Cost Audit

A review of your AWS, Azure or GCP spend: idle and oversized resources, missing savings plans, storage and transfer waste, untagged spend, with estimated savings.

Continuity & DR Testing

Impact analysis, a continuity and recovery plan somebody can follow under pressure, and a tested exercise with the evidence an auditor accepts.

Cyber Insurance Readiness

Meet the security controls cyber insurers now require (MFA, EDR, tested backups, an IR plan) so you can get covered or bring your premium down.

EU AI Act Readiness

Conformity readiness for the EU AI Act. We map your high-risk (Annex III) AI systems to the Act’s obligations and close the gaps before enforcement lands.

Technical Due Diligence

Technical due diligence for VCs, funds and acquirers, and for the startups being reviewed: architecture, code, security, compliance gaps, and the cost to fix.

Threat & Risk Assessment

A formal TRA in the shape procurement and public-sector buyers ask for: assets, threats, likelihood and impact, existing controls, and residual risk after treatment.
Security leadership

Security leadership

Fractional CISO to Unblock an Enterprise Deal

A named CISO plus questionnaire and SOC 2 support to unstick a deal that’s blocked on the buyer’s security review.

Fractional Head of Security

Build and run your security function part-time (program, hiring, and roadmap) without paying for a full-time executive before you need one.

Interim CISO

A drop-in interim CISO to cover a departure, a crunch, or a gap between hires, keeping your security program moving without missing a beat.

Security Leadership for Fundraising

Security and technical due-diligence leadership to get you through investor or acquirer diligence: vCISO plus hands-on technical DD support.

vCISO for MSPs

White-label and overflow virtual-CISO capacity for MSPs and consulting firms: offer senior security leadership to your clients under your own brand.
AI security & governance

AI security & governance

AI Acceptable Use Policy

A ready-to-adopt AI acceptable use policy for your company: approved AI tools, data rules, review and approval, employee duties, rollout and acknowledgements.

AI Governance Program

Stand up AI governance (an AI use policy, risk register, model inventory, and human-oversight controls) so your AI adoption is deliberate, not accidental.

AI Penetration Testing

A structured penetration test for AI-powered products, mapped against the OWASP LLM Top 10, from prompt injection to sensitive-data disclosure.

AI Vendor Risk Assessment

Assess the security and privacy risk of the AI tools and vendors your company adopts, before their data handling becomes your problem.

LLM Red Teaming

Adversarial testing of your LLM or agent app (prompt injection, jailbreaks, tool abuse, and data exfiltration).

Shadow AI Audit

Discover the unsanctioned AI and LLM tools in use across your organization and bring them under governance before they leak data.
Get started

Not sure which fits?

Check our pricing, talk to a fractional CISO about ongoing leadership, or book a call and we'll point you to the right starting engagement.

Book a call