GDPR
2018
50controls
EU regulation on data protection and privacy for individuals within the European Union and EEA.
- 50 article-mapped controls
- DPIA & RoPA workflows
- DSR management
- Breach notification (72h)
Launch offer — 10% off every plan · use
RAIZE_LAUNCH_10 at checkout · ends 13 Jun 2026Multi-framework GRC platform · Compliance automation for SaaS
Raize OrionCompliance
Compliance that keeps up with your roadmap.
The GRC platform for teams clearing security questionnaires every quarter, building toward a Type II audit, or running one evidence base across ISO 27001, SOC 2, GDPR, HIPAA, PCI DSS, NIS2 and four more frameworks. Compliance automation that satisfies multiple frameworks from a single control — with an auditor portal that doesn't fight you.
ICO-registered controller ZC151322 · EU data residency (eu-west-2) · SOC 2 Type II in progress · ISO 27001 self-attested · MSA + DPA on request
For
First-time founders
SOC 2 Type I in 6 months, Type II surveillance the year after.
For
UK SaaS
ISO 27001 + UK GDPR running off one evidence base.
For
EU-regulated
NIS2 Art. 21 measures + Art. 23 24h / 72h / 1-month reporting.
For
Payment processors
PCI DSS v4.0.1 Req 1–12 with the CDE-perimeter walkthrough.
Product walkthrough
Multi-framework compliance, cross-mapped
Ten framework modules sharing one evidence base, one policy library, one risk register — the only multi-framework GRC software where satisfying ISO 27001 5.17 automatically covers SOC 2 CC6.5, PCI DSS 8.4.1, and HIPAA §164.312(d). Stop duplicating work across audits.
ISO 27001
2022
93controls
International standard for information security management systems (ISMS).
- 93 controls, 4 domains
- ISMS governance
- Risk treatment plans
- Audit ready evidence
SOC 2
2017
201controls
Service Organization Control 2 — Trust Services Criteria
- 201 Trust Criteria controls
- CC, Availability, Privacy
- Vendor assurance
- Type II readiness
NIST 800-53
Revision 5
1,061controls
Security and Privacy Controls for Information Systems and Organizations.
- 1,061+ controls, 20 families
- FedRAMP baseline
- Access & audit controls
- Supply chain risk
HIPAA
2013 Omnibus Rule
52controls
US federal law for safeguarding Protected Health Information (PHI). Covers Security, Privacy, and Breach Notification Rules.
- 52 §164 specifications
- BAA workflow + PHI map
- Security + Privacy + Breach Rules
- 6-year audit log retention
PCI DSS
4.0.1
52controls
Mandatory standard for any organisation that stores, processes, or transmits cardholder data. 12 requirements covering network security, encryption, access control, monitoring, and policy.
- 52 controls across 12 requirements
- PCI DSS v4.0.1 — current spec
- CDE-perimeter + tokenisation
- Quarterly ASV scan workflow
ISO 22301
2019
37controls
International standard for Business Continuity Management Systems (BCMS) — clauses 4–10.
- 37 requirements, clauses 4–10
- Business Impact Analysis
- RTO / RPO / MTPD
- Exercise & testing programme
NIS2
2022
32controls
EU Directive (EU) 2022/2555 on a high common level of cybersecurity across the Union.
- 32 requirements
- Art 21 ten measures
- 24h / 72h / 1-month reporting
- Supply-chain security
Cyber Essentials
Montpellier
40controls
UK government-backed scheme — five technical controls, with Cyber Essentials Plus independent verification.
- Five technical controls
- MFA + 14-day patching
- Self-assessment ready
- CE Plus verification
IASME Cyber Assurance
v6
61controls
UK risk-based standard incorporating Cyber Essentials plus governance, GDPR and business continuity.
- 61 requirements, 13 themes
- Includes Cyber Essentials
- GDPR & data protection
- Risk-based assurance
From recent work
A live consultancy engagement and two reference audits we publish in full to show the methodology. Anonymised to industry and team scale by agreement.
UK digital-health platform
35-engineer team · ISO 27001 + GDPR
57 compliance gaps catalogued and prioritised in a two-week consultancy engagement; trajectory tracker now baselined.
Logistics & operations SaaS
4-framework programme · ISO 27001 · SOC 2 · GDPR · HIPAA
Readiness score 7.5/10 at engagement start; modelled path to 9.2/10 with 12 prioritised remediations across policy, evidence, and incident response.
Payments / fintech
4-framework programme · PCI DSS · ISO 27001 · SOC 2 · GDPR
Readiness score 9.85/10 at full maturity, with the CDE-perimeter walkthrough, tokenisation map, and ASV-scan cadence end-to-end on the platform.
Full write-ups of the reference audits live in our blog. Live engagements are published only with the customer's written sign-off.
A structured path to certification
The toolkit follows the ISO 27001 PDCA cycle and NIST RMF phases, guiding you from initial scoping to ongoing continuous improvement.
Phase 01
Plan
Scope & Context
Define ISMS scope, business context, and stakeholder requirements.
Phase 02
Policy
Governance & Docs
Draft policies, procedures, and assign roles (DPO, CISO, Data Owners).
Phase 03
Implement
Controls & Risks
Deploy controls, log risks, track tasks, and collect evidence.
Phase 04
Audit
Internal Review
Run AOC audits, log findings, remediate gaps before external audit.
Phase 05
Improve
Monitor & Report
Track compliance score trends, automate evidence, optimise controls.
Everything an ISMS needs
From initial gap analysis to certification audit, every phase of your information security management programme is covered.
Live Compliance Dashboard
Real-time compliance score, control status heatmap, and risk exposure across every framework in a single pane — the compliance dashboard your CISO actually checks.
Risk Register & Treatment
Risk management software with a CVSS-aligned likelihood-impact matrix. Log, score, and treat information security risks; overdue items surface automatically.
Internal Audit & AOC
Internal audit software with per-control findings (Conform / Minor / Major / OFI). Run Attestation of Compliance audits and export audit-ready evidence packs.
Policy Template Library
Policy management software with 28 pre-built templates: ISMS, access control, incident response, GDPR data protection, BCP/DR, and more — fully editable, version-tracked.
Context Adaptation Engine
Input your industry, size, data types, and regulatory scope. Get a phased compliance roadmap with FTE and cost estimates — built for SaaS startups and scale-ups.
AI-Powered Automation
AI compliance tool guidance: SIEM, GRC integrations, CSPM, IAM, vulnerability scanners — matched to your framework and context. AI policy gap analysis included.
Stakeholder & RACI Matrix
Assign control owners, document roles (DPO, CISO, Data Owner, Processor), and track accountability across the organisation. Vendor risk management built in.
International Transfer Tools
GDPR compliance software for Chapter V: manage SCCs, TIAs, BCRs, adequacy decisions, and third-country transfer inventories. UK GDPR + EU GDPR covered.
Built for trust, not just compliance
We hold ourselves to the same standards we help you implement. Every architectural decision below is verifiable in our public infrastructure.
EU data residency
All tenant data stored in Supabase eu-west-2 (London). No US replication, no cross-region failover. Matches Article 44 transfer-restriction posture out of the box.
Row-Level Security on every table
Every tenant-scoped table enforces RLS at the database layer — not the application. Cross-tenant access is impossible by construction, smoke-tested in CI against 12 hot tables.
Secrets in vault, never in columns
API keys, webhook signing secrets, and OAuth tokens live in Supabase Vault behind SECURITY DEFINER RPCs. Never readable by anon or authenticated roles — only the service role can decrypt.
Append-only audit trail
Every mutation across 70+ tables writes to a partitioned audit log with changed_at timestamps, actor identity, and a JSONB diff. Six-year retention by default; HIPAA-compliant out of the box.
Transparent sub-processor list
Every third party that touches your data (Supabase, Resend, Anthropic, Voyage, Vercel) is named on our public privacy page with a purpose statement. GDPR Article 28 DPA available on request.
SOC 2 Type I in progress
We run our own Continuous Monitoring product on ourselves. 50 automated control checks run daily; gap-list is shareable with prospects via a scope-bounded auditor link before we finish certification.
Built-in feature
Stand up your own Trust Center in 10 minutes
Publish a public trust page at trust.yourdomain.com — live compliance score, current frameworks, sub-processor list, security contact, and an SLA snapshot. Pulled directly from your live programme, not a static brochure that goes stale.
- Live compliance score + per-framework status (updated when your evidence changes)
- Sub-processor list with purpose-of-use and data-residency for each
- Quarterly status snapshot — no manual updates, no copy-paste drift
- Scope-bounded auditor link generation for procurement conversations
trust.example.comlive
Compliance score
94%
Frameworks
3
Sub-processors
7
Last updated
2 hours ago
Live preview · auto-refreshes when evidence changes
What you get on day one
Numbers a programme lead can take to a budget conversation.
10 min
First evidence pulled
Connect AWS, GitHub, Okta, Google Workspace or any of 19 evidence connectors and the first auto-mapped evidence row lands against your controls in under ten minutes.
Day one
Cross-framework mapping
ISO 27001 5.17 already mapped to SOC 2 CC6.5, PCI DSS 8.4.1, HIPAA §164.312(d). Satisfy one control, satisfy the others — the crosswalk ships with the platform.
90 days
First audit-ready pack
Typical SOC 2 Type I or ISO 27001 Stage 1 timeline on the platform — policies adopted, evidence collected, internal audit run, gaps closed, auditor portal provisioned.
Plans for every team size
One platform. Three plans.
Each plan is sized for a different team shape. Talk to sales for a tailored quote, a guided demo, and answers on framework scope, data residency, and rollout timing.
Starter
Pick 3 frameworks, small team.
- 3 frameworks (your choice)
- 5 users
- 1 evidence connector
- Auditor portal + Trust Center
- Custom controls
Pricing varies by team size, framework scope, and connector mix. Email sales@raizehq.dev for a same-day quote.
Recent writing
Field notes from the work.
Compliance2026-06-03· 7 min read
When a customer ticket starts your reporting clock
Anchoring the NIS2 Art. 23 / GDPR Art. 33 clock on the upstream signal time is the right call — but only if you can defend what "awareness was reasonably expected" looks like for that source. Here is how Raize Orion handles the customer-ticket edge case.
Read post
Founder2026-05-20· 4 min read
Why we built Raize Orion
Most GRC platforms are priced for the auditor, not the team that has to use them every day. Raize Orion is built for the founding engineer running compliance alongside a product roadmap.
Read post
Compliance2026-05-19· 7 min read
A 6-month SOC 2 roadmap for first-time founders
What to actually do, week by week, to go from no compliance program to a Type I report in six months. Budget £30-40k year one, including the auditor.
Read post
Start your compliance programme
today.
Tell us about your organisation and our team will get you set up — no configuration required.
ISO 27001 · SOC 2 · NIST 800-53 · GDPR · HIPAA · PCI DSS · ISO 22301 · NIS2 · Cyber Essentials · IASME