Start with the essentials so you don't lose credibility in front of the investor. Write to us and we'll figure out what you need, then only what you need now: no enterprise packages you don't need.
During due diligence (or the accelerator checklist) the question lands: "How do you handle data? Do you have a security policy? Are you certified?" You're juggling product, fundraising and everything else, you have no security person, and you fear two opposite things: looking amateur, or being sold a full €50K ISO you don't need and can't afford right now.
Almost always, at pre-seed/seed, you don't need full ISO 27001 to pass due diligence. Often what's enough: clear security policies, access and data in order, a first assessment, and a Trust Center showing the investor you "do things properly." Then, when the business calls for it (enterprise customers, regulated market), you step up to ISO 27001 or SOC 2.
Only what you need, when you need it.
When the enterprise customer arrives: the certification, built on the essentials already in place.
Go to serviceWe start with the essentials: write to us and we'll figure out what you need, then you pay only for what you actually need now. No enterprise packages. Startup-minded pricing, with clear ranges.
We tell you honestly when you reach out. Sometimes a little is enough to be credible in due diligence (policies + Trust Center). Sometimes more is needed. We don't sell fake urgency.
Almost always, for the round, starting with a Trust Center + security essentials is enough. Full ISO 27001 makes sense when enterprise customers arrive, and when that time comes, you already know the route.
Typically: how you handle personal data (GDPR), access and secrets, security policies, and a possible roadmap to ISO 27001/SOC 2. We give you a checklist and tell you what's already in place.
No: the essentials we set up now are the foundation for ISO 27001 or SOC 2. You grow without throwing away the work done.
From the little you need now, to growth when it makes sense.
What the investor asks, what you have, what's enough now.
Policies, access, starter Trust Center: often quick, because it's focused work.
When the enterprise customer arrives → ISO 27001 (typical prep 3-6 months + audit) or SOC 2, and light maintenance that grows with you.
When the customer who needs SOC 2 or ISO 27001 to sign comes along.
Learn moreWe'll reply honestly. You'll often find your round needs less than you fear.