mvdmio · Compliance
ISO 27001, SOC 2 and GDPR compliance software
Your frameworks overlap. Your work doesn't have to. Compliance links related requirements across your frameworks, so one piece of evidence, one finding or one register record can meet requirements in several of them. One access control record, for example, meets ISO 27001 A.5.15, SOC 2 CC6.1 and GDPR Art. 32.
ISO 27001, ISO 9001, ISO 14001, ISO 42001, SOC 2, BIO2, Dutch Arbo, Cyber Essentials, EU GDPR, UK GDPR and the EU AI Act run from the same registers. Each framework has its own price per year, and users are unlimited.
Try Compliance for 30 days without a credit card. The AI assistant is not part of the trial unless you buy AI credits.
Used at Jewel Software, where Michiel van der Meer is Tech Lead. He built Compliance after taking over an ISMS there and seeing how much hand-work it took.
ISO 27001, ISO 9001, SOC 2 and BIO2 are €999 per framework per year, excl. VAT. See pricing
Every register in one place
Compliance keeps your management system in registers. Policies, risks and suppliers each have one, and so do findings and incidents.
- Compliance has registers for policies, risks, assets, people, suppliers, findings, vulnerabilities, incidents, continuity plans and training courses, among others. You attach evidence to the task it proves.
- Compliance scores each risk on a 5×5 likelihood and impact matrix. Treatment actions lower the residual risk score.
- Policies, procedures, risks and objectives link to the requirements they meet. Each requirement shows whether it is satisfied or still open.
Frameworks that share requirements
Frameworks often ask for related things in their own words. Compliance links those requirements to each other. You keep one access control policy and one set of evidence, and ISO 27001, SOC 2 and GDPR each show it against their own requirement.
- Compliance has catalogs for ISO 27001:2022, ISO 9001 in the 2015 and 2026 editions, ISO 14001 in the 2015 and 2026 editions, ISO 42001:2023, SOC 2, BIO2 2026, Dutch Arbo 1998, Cyber Essentials, EU GDPR, UK GDPR and the EU AI Act.
- Crosswalk mappings link related requirements across every catalog you've adopted
- Each framework shows what is satisfied and what is still open.
- If you're weighing ISO 27001 against SOC 2, read ISO 27001 vs SOC 2 for how they differ and which one to start with.
- If the EU AI Act applies to you and you're looking at ISO 42001, read ISO 42001 vs EU AI Act for how the law and the standard differ and how to run both.
- If the GDPR applies to you and you're looking at ISO 27001, read ISO 27001 vs GDPR for how the standard and the law differ and how to run both.
- Dutch municipalities that track BIO2 and the GDPR can read BIO2 en AVG voor gemeenten, a page in Dutch.
An AI assistant on every page
The assistant reads your registers and answers questions about your own records.
- Ask it anything about your ISMS; it reads your actual registers, not a generic script
- It drafts policies, files risks and updates records. It asks you to confirm before it completes a task, cancels one or deletes a record.
- Import your existing documentation and let it map what you already have onto your registers
Recurring work with an owner and a due date
Compliance turns each recurring obligation into a task. Every task has an owner and a due date, and every open task appears in one inbox.
- Compliance creates recurring reviews for policies, risks, assets and requirements on a schedule.
- Templates for the ad-hoc work you repeat every cycle, on your own cadence
Plain pricing
Questions buyers ask
Which frameworks does Compliance support?
Compliance supports ISO 27001, ISO 9001, ISO 14001, ISO 42001, SOC 2, BIO2, Dutch Arbo, EU GDPR, UK GDPR, the EU AI Act and Cyber Essentials. You adopt the ones you need and run them side by side from one set of records.
What does Compliance cost?
Compliance is billed per framework, per year, excluding VAT. ISO 27001, ISO 9001, SOC 2 and BIO2 cost €999 each. ISO 14001 and ISO 42001 cost €749 each. EU GDPR, UK GDPR, the EU AI Act, Cyber Essentials and Dutch Arbo cost €199 each. Users are unlimited. Each framework includes AI credit every year, $10 or $5, billed in USD.
How does the free trial work?
Try Compliance for 30 days without a credit card. The trial gives you full access to every framework. The AI assistant is not part of the trial unless you buy AI credits. When the trial ends, access closes. Nothing is charged unless you subscribe. Your data stays for 365 days, so you can subscribe later and carry on.
How does billing work if I adopt several frameworks?
You are billed per year for each framework you adopt, and you can adopt any framework. Each framework is billed on its own, at the price listed for it.
Is there a limit on users?
No. Compliance has unlimited users in your organisation.
Who is Compliance for?
Compliance is for organisations that run ISO 27001, SOC 2, GDPR or other frameworks side by side. Pricing is per framework, and users are unlimited.
How is Compliance different from Vanta and Drata?
Vanta and Drata are trust platforms with a wider scope. Next to compliance automation and continuous control monitoring, both offer a Trust Center, AI help with security questionnaires and third-party risk management. Compliance focuses on running the management system itself. It keeps your policies, risks, assets, suppliers, findings, incidents and more in registers, and turns recurring reviews into tasks with an owner and a due date. Compliance doesn't connect to cloud, identity or HR systems to collect evidence. You attach evidence to tasks yourself, or build your own sync with the REST API, the MCP server or the CLI. Crosswalk mappings link related requirements across the frameworks you adopt, so one piece of evidence, one finding or one register record can meet requirements in several of them. An audit still covers one standard.
Can one record meet requirements in several frameworks?
Yes. Crosswalk mappings link related requirements across the frameworks you adopt. One access control record, for example, satisfies ISO 27001 A.5.15, SOC 2 CC6.1 and GDPR Art. 32. One piece of evidence, one finding or one register record can meet requirements in several frameworks. An audit still covers one standard, and a supplier review covers one supplier. Each framework shows what is satisfied and what is still open.
Start with a 30-day trial
Try Compliance for 30 days without a credit card. The trial gives you full access to every framework. The AI assistant is not part of the trial unless you buy AI credits.