Skip to content
Kardu

Your client is asking for security. Answer with evidence.

Turn compliance into a sales argument: From regulation to action, no in-house team needed.

Vendor Security CheckTalk to us
app.kardu.eu/dashboard
Panel
Marcos
Controles
Evidencias
Infraestructura
Confianza
Comentarios
Ajustes

Buenas tardes, Kardu

Resumen de cumplimiento

Compliance Score

57/100

Gestionado · faltan 3 puntos para Optimizado

+4 esta semana
Hace 12 semanasHoy

58/93

Controles implementados

44

Controles con evidencia

6

Tareas vencidas

Tu foco hoy

Revisión de permisos de accesoVencida
Identifica los clientes que te exigen seguridadVencida
Política de continuidad de negocioEn progreso
Configurar cifrado en reposoEn progreso
Registro de activos de informaciónLista
GoldfinchMistral AI · UE
¿Qué me falta para el cuestionario de Cliente A?
Revisado tu programa · 3 s

Te faltan 3 evidencias para cerrarlo. Ya tienes el resto cubierto por tu programa ISO 27001:

Copias de seguridad cifradasFalta
Plan de respuesta a incidentesFalta
Revisión de accesos del último trimestreFalta
Crear 3 tareas
@ para mencionar un control

Your clients must comply with NIS2, DORA, ENS, GDPR or Chile's Law 21.719 That is why they ask you for proof.

When your client is regulated, its obligations flow down to you. And without a system, proving you comply looks like this:

Spreadsheets nobody updates

Hundreds of requirements in spreadsheets that go stale overnight, and evidence lost in endless email threads.

Chasing proof

You end up playing cop, asking IT and HR for screenshots over chat and email, again and again, unsure what's missing.

Last-minute panic

Firefighting two weeks before the client's questionnaire, finding out what's missing when there's no time left.

Questionnaires on loop

Every client sends its own questionnaire and you answer the same old questions again, starting from scratch.

How much business does not being able to prove compliance cost you? Read the analysis with the figures →

Real questions from a security questionnaire
What sector does your company operate in?
How many employees do you have?
What personal data do you process?
Have you been asked to comply with NIS2?
Do you have a documented security policy?
How many vendors access your systems?
Have you experienced a security incident?
What critical assets do you need to protect?
How long have you been managing compliance in spreadsheets?
Who owns compliance in your company?
Do your customers require ISO 27001?
When is your next audit?
Where do you store control evidence?
Do you have an up-to-date risk register?
Do you need ENS to contract with public sector?
How many regulatory frameworks apply to you?
What sector does your company operate in?
How many employees do you have?
What personal data do you process?
Have you been asked to comply with NIS2?
Do you have a documented security policy?
How many vendors access your systems?
Have you experienced a security incident?
What critical assets do you need to protect?
How long have you been managing compliance in spreadsheets?
Who owns compliance in your company?
Do your customers require ISO 27001?
When is your next audit?
Where do you store control evidence?
Do you have an up-to-date risk register?
Do you need ENS to contract with public sector?
How many regulatory frameworks apply to you?
Security Essentials

Frictionless compliance, from day one.

Leave the manual chaos behind. From ISO 27001 controls to your day-to-day tasks, Kardu organises your security so you reach every audit with everything ready.

Learn more about Kardu →

The backbone of your security

ISO 27001 as the core. All your programme's controls, evidence and risks in one system. No spreadsheets, no duplication.

Read more →
ISO 27001INT

ISO/IEC 27001:2022 · Information security management

74%

coverage

11/15

areas done

68/93 controls

Security policies and governance3/4
External engagement and threat intelligence2/4
Asset and information management6/6
Identity and access management4/4
Supplier and cloud security3/5
Incident management4/5
Business continuity2/2
Compliance and records management5/7
People security6/8

Identity and access management

4/4 controls · evidence linked

ISO 27001

This evidence also covers

NIS2 · coveredENS · coveredDORA · covered

1 piece of evidence · 4 frameworks

Evidence vault

Every control has its evidence attached. Automatic expiries, proactive reminders and full lifecycle traceability for any audit.

Read more →

Evidence vault

The proof that your security controls are actually in place.

FilesPoliciesQuestionnaires

6 files · 5 linked to controls

Search evidence…
PDFRisk_Assessment_2026.pdfA.8.212 mar2.4 MB
DOCAccess_Control_Policy_v3.docxA.9.108 mar340 KB
PDFFirewall_Config_Audit.pdfA.13.128 feb1.1 MB
XLSSecurity_Training_Records.xlsxA.7.220 feb890 KB
PDFIncident_Response_Plan_v2.pdfA.16.114 feb1.8 MB
PDFSupplier_NDA_Acme_SL.pdfA.15.130 ene220 KB
PDF

Incident_Response_Plan_v2.pdf

SHA-256 fingerprint9f2c…a7e41b
Uploaded14 Feb 2026 · 10:42:07
Linked to3 controls · ISO 27001, NIS2
IntactExpires in 12 days

Focus Mode

Your personal dashboard of pending tasks. Kardu prioritises what needs attention today so you never lose track of your Compliance Score.

Read more →
Focus queue8 controls pending
× Clear all
Security policyISO 27001Today
Security roles and responsibilitiesISO 27001Today
Access control reviewNIS2Tomorrow
Separation of dutiesISO 27001Apr 30
Supplier risk assessmentISO 27001May 2
Business continuity plan updateISO 27001May 5
Incident response drillNIS2May 8
Management commitmentISO 27001May 12
TodayPrioritised by Kardu
Security policyISO 27001Today
Security roles and responsibilitiesISO 27001Today
Access control reviewNIS2Tomorrow
Frameworks

All your frameworks, coordinated in one system

Mandatory

NIS2

Mandatory European cybersecurity directive.

NIS2 guide →View official documentation →

Certifiable

ISO 27001

International information security standard.

ISO 27001 guide →View official documentation →

Spain

ENS

Spain's National Security Scheme. Public sector.

ENS guide →View official documentation →

Financial

DORA

Digital operational resilience for the financial sector.

DORA guide →View official documentation →

Privacy

GDPR

Regulation on the protection of personal data.

GDPR guide →View official documentation →

Is your company directly subject to NIS2? Take the NIS2 assessment →

How it works

In 4 weeks, up and running.

For SMEs and scale-ups in Europe and Chile that need to meet a regulation without a compliance team. In four weeks we lay the foundations with you, and from there you keep it going, with Kardu.

We define the scope with you

The Kardu founding team reviews your organisation, your risks and what your clients require of you, together with you.

We lay the foundations

We assess your risks and get your core policies started, with a weekly session to fit them to your team.

Your Trust Center, in about 12 weeks

With the foundations in place, you carry on with Kardu until you publish your Trust Center and answer your first questionnaire.

Book a 30-minute call and find out how Kardu Foundation fits your company.

Talk to us

FAQ

Frequently asked questions.

Kardu is a compliance platform built for European companies that need to demonstrate security to clients and investors. It does not replace a certification audit, a security consultant, or legal advice — nor does it claim to. It is software that guides you step by step so that compliance becomes a visible commercial asset, not an administrative burden.

For European companies with 10 to 250 employees — fintech, healthtech, B2B SaaS, public administration suppliers — that have received a compliance requirement (NIS2, ISO 27001, DORA, ENS) from a client, investor or auditor and do not know where to start.

In 4 weeks we lay the foundations with you: we review your company and what your clients are asking for, assess your risks and start your main policies. After that you carry on with Kardu until your Trust Center is published and your first questionnaire answered, in about 12 weeks.

Your data is stored on servers in the European Union (Frankfurt). The few exceptions, such as malware scanning of files, are documented in our sub-processor list, together with each provider's safeguards.

No. Kardu is designed precisely for companies without an internal security team. The Goldfinch AI assistant, included in the Business plan, explains each control in plain language, suggests what evidence to attach and alerts you when something needs attention. If you have any questions at any point, it is there to answer them.

Kardu Foundation is the only entry point today: a 4-week done-with-you onboarding program, not a self-serve signup. Book a conversation with the founding team and we'll figure out together if it's the right fit for your company.

Kardu reflects what your company actually implements and documents — not what you make up. The Trust Center shows your real score based on controls you have completed with attached evidence: a document, a policy, a log. If someone uploads false evidence, the problem is not Kardu — it is document fraud, with the same legal consequences as falsifying a contract. That said, Kardu does not replace an external auditor. For formal certifications (ISO 27001, ENS), an independent certification body always steps in to physically verify what you declare. The Trust Center is an honest progress signal, not an official stamp.See Kardu's Trust Center →

Kardu Foundation

Let your security boost your sales.

A 30-minute call with the founding team to see whether Kardu Foundation fits your company.

Talk to usSee pricing