Kardu

Everything you needfor your compliance.

ISO 27001 as the backbone. NIS2, DORA, ENS and GDPR mapped on top. One piece of evidence satisfies multiple frameworks simultaneously.

The backbone of your security:

ISO 27001 as the core

Trying to manage security with scattered spreadsheets and disjointed tools is a recipe for failure. Your security program needs a single source of truth. At Kardu, we place ISO 27001 at the very heart of your operations, serving as the universal framework that unifies your entire security posture.

Stop juggling multiple files for different standards. Whether you are targeting NIS2, DORA, or GDPR, we map them all to the ISO 27001 core. Every control, every piece of evidence, and every risk sits in a single, unified system. No more switching contexts or hunting for data across different platforms.

The biggest waste in compliance is doing the same work twice. Our "Map Once, Comply Everywhere" engine ensures that a single piece of evidence satisfies multiple frameworks simultaneously. Zero spreadsheets, zero redundancy. You implement a control once, and it automatically counts towards all your regulatory obligations.

Security isn't a static document; it's a dynamic ecosystem. By centralizing your risks and controls in one place, you gain a real-time view of your security health. This isn't just about passing an audit; it's about building a resilient, scalable foundation that grows with your business without becoming unmanageable.

ISO 27001INT
ISO/IEC 27001:2022 Information Security Management
74%
coverage
11/15
areas done
68/93 controls
Information security policies and governance
3/4
External engagement and threat intelligence
2/4
Asset and information management
6/6
Identity and access management
4/4
Supplier and cloud security
3/5
Incident management
4/5
Business continuity
2/2
Compliance and records management
5/7
People security
6/8

Evidence Vault:

Your shield against audit chaos

The audit moment shouldn't be a race against the clock to find lost documents. In most companies, evidence is fragmented across emails, local folders, and outdated versions, creating a massive risk of non-compliance. With the Evidence Vault, you transform audit preparation from a traumatic event into an automatic demonstration of maturity and control.

Forget manual spreadsheets. Every NIS2, DORA, or ISO 27001 control has its evidence linked automatically. If a control changes, its evidence updates. If proof is missing, the system knows instantly. Nothing gets lost, nothing is left orphaned.

Evidence expires (SSL certificates, access reviews, annual policies). Our vault doesn't just store; it monitors. It detects expirations before they happen and sends proactive reminders to the exact owners, ensuring your compliance status never drops due to an administrative oversight.

For any auditor, the key question is: when was this done and who approved it? The Vault records every upload, modification, and approval with immutable timestamps. It generates a complete lifecycle history that proves not only that you have the evidence, but that you manage it with rigor.

Evidence Vault
The proof that your security controls are actually in place.
Files
Policies
Questionnaires
6 files · 5 linked to controls
Search evidence...
PDF
ISO27001_Risk_Assessment_2024.pdfA.8.2Mar 122.4 MB
DOC
Access_Control_Policy_v3.docxA.9.1Mar 08340 KB
PDF
Firewall_Config_Audit.pdfA.13.1Feb 281.1 MB
IMG
Employee_Security_Training.pngA.7.2Feb 20890 KB
PDF
Incident_Response_Plan_v2.pdfA.16.1Feb 141.8 MB
PDF
Supplier_NDA_Acme_SL.pdfA.15.1Jan 30220 KB

Focus Mode:

Your Daily Compass Against Compliance Burnout

The biggest enemy of compliance isn't a lack of resources; it's fatigue and lack of clarity. Industry studies indicate that over 60% of GRC initiatives fail not due to technology gaps, but because teams feel overwhelmed by endless task lists and lose motivation within the first few months. At Kardu, we don't want you to throw in the towel.

Focus Mode is your personal operational intelligence dashboard, designed to combat abandonment and keep your team moving forward.

Forget staring at 200 controls without knowing where to start. Our algorithm analyzes your current state and tells you exactly what to do today. It filters out the noise, presenting only the 3-5 critical actions that will directly impact your Compliance Score within the next 24 hours.

Lack of immediate feedback is the primary reason teams drop compliance efforts. Focus Mode turns boring tasks into visible milestones. As you complete a critical action, watch your score rise in real-time, creating a motivation loop that keeps your team engaged for the long haul.

Focus queue8 controls pending
Security policyISO27001Today
Security roles and responsibilitiesISO27001Today
Separation of dutiesISO27001Tomorrow
Management commitment to securityISO27001Tomorrow
Access control policy reviewNIS2Apr 30
Supplier risk assessmentISO27001May 2
Business continuity plan updateISO27001May 5
Incident response drill documentationNIS2May 8

Your Dedicated GRC Agent:

Compliance Expert, 100% European

At Kardu, we know that complying with NIS2, DORA, or ISO 27001 shouldn't require an in-house security department. That's why we've integrated a Dedicated AI Agent that acts as your 24/7 expert consultant, specifically designed to guide non-specialists through the complexities of cybersecurity. The result: You aren't just buying software — you are hiring a GRC expert who works alongside you.

Not sure where to start? The Agent doesn't just list requirements; it drafts policies tailored to your business, explains controls in plain language, and tells you exactly which evidence to gather. It turns legal jargon into a clear, executable roadmap.

Stop assembling reports manually. The Agent analyzes your inputs and automatically generates the technical documentation, risk management logs, and operational procedures that auditors demand. Reduce preparation time from weeks to hours, ensuring everything is structured, traceable, and error-free.

Artificial intelligence shouldn't compromise your privacy. Our Agent is powered exclusively by Mistral AI, Europe's leading large language model.

Zero data leakage: Unlike US-based models, we guarantee that no sensitive data, policy, or evidence ever leaves the European Economic Area (EEA).

Native compliance: By using European infrastructure and models, we align your compliance tool with the very regulations you are trying to meet (GDPR, NIS2).

Goldfinch
Goldfinch
Dashboard
What should I focus on first?

Which controls are missing evidence?

Ask anything about your compliance...
User
Design principles

The decisions that make us different

We build Kardu following the Security by Design principles defined by ENISA. This is not marketing — it is architecture.

View ENISA guidelines
1

Security by design

Every architecture decision prioritises security from the start. It is not an additional layer — it is the foundation everything is built on.

2

Proof before process

Controls are not marked complete with just a checkbox. They require at least one linked piece of evidence.

3

Auditability at every level

Every action with consequences on compliance status generates an immutable record. The system cannot forget.

4

Designed for EU sovereignty

The architecture allows migration to fully sovereign EU infrastructure without rewriting the product.