What we do
- ISO 27001 readiness: gap analysis, control implementation, and the tooling that keeps evidence current, so the audit is a formality rather than a fire drill.
- GDPR engineering: data maps, retention enforcement, DPA-ready processing records, EU data residency by architecture rather than by policy.
- NIS2 and DORA readiness: risk registers, incident-reporting workflows with the statutory clocks built in, supplier oversight, and the DORA Register of Information.
- EU AI Act evidence: logging, technical documentation, and model monitoring generated by the systems we build, not written after the fact.
Why an engineering firm
Compliance consultancies write policies. We change the systems the policies describe. When the control is enforced in code, the evidence writes itself and the auditor finds what the document promised.
We run our own operations the same way: Dutch B.V., standard DPA with every engagement, NDA within 24 hours, EU data residency for anything we host.