What is Kardu?

In 30 seconds

• Kardu organises your company's security around ISO 27001 and reuses each piece of evidence in NIS2, ENS, DORA and any other framework that applies to you.
• It's built for European SMEs without an in-house security team.
• It turns your compliance into something you can show your clients: a Compliance Score from 0 to 100 and a public Trust Center.

Is your company ready to prove its security today?

Not in six months, when the audit arrives. Not when a client demands it. Today, with real evidence, active measures and a report ready to share.

For most European SMEs, the honest answer is no. Not because they lack security measures, but because they lack a system that organises them, backs them with evidence and keeps them up to date.

Kardu is that system.

What does Kardu actually do?

Kardu is a governance, risk and compliance (GRC) platform for European companies with 10 to 250 people that need to manage their security without a dedicated team.

In practice, it does four things:

• Organises your security measures around the structure of ISO 27001 and maps them to NIS2, ENS, DORA and any other framework that applies to you.
• Links each piece of evidence to the measure it proves. Every policy, record or document is stored with its digital fingerprint, its date and its expiry.
• Makes your security visible. Your public Trust Center shows your Compliance Score to clients, prospects and auditors.
• Handles the repetitive work. Reminders, assignments and alerts so no measure goes without evidence and no deadline catches you off guard.

The underlying idea is that you don't repeat work: the same piece of evidence counts in every framework that requires it.

Does ISO 27001 cover the other frameworks?

It's the question we hear most. ISO 27001 is the base: many of its measures help with the other frameworks, including the two Chilean laws we work with, on cybersecurity and on data protection, for companies that also operate in Chile.

Each framework also adds what its law specifically requires, so ISO 27001 doesn't replace any of them. But if its measures are already active and backed by evidence, you don't start from zero with NIS2, DORA or ENS.

Who is Kardu for?

For whoever runs operations or IT at a European SME and:

• has just received a security questionnaire from a large client;
• knows NIS2 applies to them, but not where to start;
• has ISO 27001 on the horizon and isn't sure how to get there.

Why does Kardu exist?

The GRC tools on the market were built for large companies with compliance teams and six-figure budgets. They're expensive, complex and need consultants to get going.

Meanwhile, European regulation keeps growing: NIS2, DORA, ENS, the AI Act. SMEs face the same underlying obligations as large companies, with far fewer resources to manage them.

The geopolitical context adds urgency. In February 2026, Reuters reported that the US government had ordered its diplomats to push back against European data sovereignty initiatives. For a European company, choosing where its data lives is no longer just a technical decision: it's a strategic one.

Kardu exists to close that gap: a modern GRC system designed from scratch for European regulation, with data in Frankfurt and AI in Paris (Mistral).

How do you get started with Kardu?

So that the system is set up properly from day one, you start with Kardu Foundation: 4 weeks in which the founding team configures it with you. After that, your team runs it on its own, without a consultant.

Book a 30-minute call with the founding team and we'll see whether Kardu Foundation fits your company: talk to us.

Frequently asked questions

01What is Kardu?

Kardu is a GRC (governance, risk and compliance) platform for European SMEs with 10 to 250 people. It organises your security measures around ISO 27001 and reuses each piece of evidence in NIS2, ENS, DORA and any other framework that applies to you, without needing an in-house security team.

02Who is Kardu for?

For whoever runs operations, IT or the company at a European SME that has received a security questionnaire from a client, needs to comply with NIS2 or has ISO 27001 on the horizon.

03What is Kardu's Compliance Score?

It's a number from 0 to 100 that reflects the real state of your compliance in each framework. It updates as you add evidence, and boards, investors and clients understand it without technical context.

04Is my data stored in Europe?

Yes. Data is hosted in Frankfurt, Germany. The few exceptions, such as malware scanning of files, are documented in our sub-processor list.