Compliance and data residency

Regulators and auditors ask engineering questions: who can access production, where data lives, whether backups restore, how changes are reviewed. We implement the technical controls that answer them, as code, and produce the evidence.

Book a scoping call Read the Trust Center

Not legal advice, not a certification. These pages describe technical implementation. Your legal and compliance advisers decide what applies to you.

Frameworks we implement controls for

GDPR and EU data residency

We implement the platform-level technical controls that GDPR expects in your AWS, Azure or Kubernetes environment: EU region guardrails written as code, encryption with managed keys, access and audit logging, backup retention and deletion tooling, and evidence you can hand to your DPO and auditors. We do not give legal advice or certify compliance.

NIS2

NIS2 (Directive (EU) 2022/2555) requires in-scope entities to take cybersecurity risk-management measures, listed in Article 21. We implement the technical parts in your AWS, Azure or Kubernetes environment (access, logging, backup, supply chain, encryption, MFA) and produce evidence. Your advisers decide scope and compliance.

DORA

DORA (Regulation (EU) 2022/2554) sets ICT risk, resilience testing, incident reporting and third-party rules for EU financial entities. We implement the engineering controls inside your AWS, Azure or Kubernetes environment and produce evidence. You and your advisers own compliance; we do not certify anything.

SOC 2 and ISO 27001

SOC 2 and ISO 27001 readiness means making your cloud, pipelines and access practices produce reliable evidence for an auditor. We implement and document the technical controls (access, change management, logging, backups, vulnerability management). Your auditor decides whether they meet the criteria.

What we do

✓Assess your cloud and Kubernetes environment against the technical expectations of the framework
✓Implement controls as code: access, encryption, logging, backup, change management, region restrictions
✓Produce evidence from pipelines, cloud logs and configuration, ready for your auditor or regulator
✓Document the controls and hand them over so your team can run them

What we do not do

–Give legal advice or interpret how a law applies to your organisation
–Act as your data protection officer or compliance officer
–Notify regulators or make decisions on your behalf
–Issue certifications or attestations. Auditors and certification bodies do that

Common questions

Does working with you make us compliant?

No. Compliance is your organisation's responsibility, supported by your legal and compliance advisers. We implement the technical controls inside your environment and produce evidence, which makes audits and assessments much easier.

Do you hold SOC 2 or ISO 27001 certification yourselves?

We do not claim a company-level attestation. Our Trust Center lists the credentials we hold and how we work inside your accounts.

Can you work with our auditor or compliance platform?

Yes. We typically work alongside your auditor, consultants and any compliance automation platform, supplying technical implementation and evidence.

Where is our data processed?

In the cloud regions you choose, in your own accounts. We can enforce region restrictions as code so data stays where you decide.