Skip to content
Kardu

Everything you need for your compliance.

ISO 27001 as the backbone. NIS2, DORA, ENS and GDPR mapped on top. One piece of evidence satisfies multiple frameworks simultaneously.

The backbone of your security:

ISO 27001 as the core

Trying to manage security with scattered spreadsheets and disjointed tools is a recipe for failure. Your security program needs a single source of truth. At Kardu, we place ISO 27001 at the very heart of your operations, serving as the universal framework that unifies your entire security posture.

Stop juggling multiple files for different standards. Whether you are targeting NIS2, DORA, or GDPR, we map them all to the ISO 27001 core. Every control, every piece of evidence, and every risk sits in a single, unified system. No more switching contexts or hunting for data across different platforms.

The biggest waste in compliance is doing the same work twice. Our "Map Once, Comply Everywhere" engine ensures that a single piece of evidence satisfies multiple frameworks simultaneously. Zero spreadsheets, zero redundancy. You implement a control once, and it automatically counts towards all your regulatory obligations.

Security isn't a static document; it's a dynamic ecosystem. By centralizing your risks and controls in one place, you gain a real-time view of your security health. This isn't just about passing an audit; it's about building a resilient, scalable foundation that grows with your business without becoming unmanageable.

ISO 27001INT

ISO/IEC 27001:2022 · Information security management

74%

coverage

11/15

areas done

68/93 controls

Security policies and governance3/4
External engagement and threat intelligence2/4
Asset and information management6/6
Identity and access management4/4
Supplier and cloud security3/5
Incident management4/5
Business continuity2/2
Compliance and records management5/7
People security6/8

Identity and access management

4/4 controls · evidence linked

ISO 27001

This evidence also covers

NIS2 · coveredENS · coveredDORA · covered

1 piece of evidence · 4 frameworks

Evidence Vault:

Your shield against audit chaos

The audit moment shouldn't be a race against the clock to find lost documents. In most companies, evidence is fragmented across emails, local folders, and outdated versions, creating a massive risk of non-compliance. With the Evidence Vault, you transform audit preparation from a traumatic event into an automatic demonstration of maturity and control.

Forget manual spreadsheets. Every NIS2, DORA, or ISO 27001 control has its evidence linked automatically. If a control changes, its evidence updates. If proof is missing, the system knows instantly. Nothing gets lost, nothing is left orphaned.

Evidence expires (SSL certificates, access reviews, annual policies). Our vault doesn't just store; it monitors. It detects expirations before they happen and sends proactive reminders to the exact owners, ensuring your compliance status never drops due to an administrative oversight.

For any auditor, the key question is: when was this done and who approved it? The Vault records every upload, modification, and approval with immutable timestamps. It generates a complete lifecycle history that proves not only that you have the evidence, but that you manage it with rigor.

Evidence vault

The proof that your security controls are actually in place.

FilesPoliciesQuestionnaires

6 files · 5 linked to controls

Search evidence…
PDFRisk_Assessment_2026.pdfA.8.212 mar2.4 MB
DOCAccess_Control_Policy_v3.docxA.9.108 mar340 KB
PDFFirewall_Config_Audit.pdfA.13.128 feb1.1 MB
XLSSecurity_Training_Records.xlsxA.7.220 feb890 KB
PDFIncident_Response_Plan_v2.pdfA.16.114 feb1.8 MB
PDFSupplier_NDA_Acme_SL.pdfA.15.130 ene220 KB
PDF

Incident_Response_Plan_v2.pdf

SHA-256 fingerprint9f2c…a7e41b
Uploaded14 Feb 2026 · 10:42:07
Linked to3 controls · ISO 27001, NIS2
IntactExpires in 12 days

Focus Mode:

Your Daily Compass Against Compliance Burnout

The biggest enemy of compliance isn't a lack of resources; it's fatigue and lack of clarity. Industry studies indicate that over 60% of GRC initiatives fail not due to technology gaps, but because teams feel overwhelmed by endless task lists and lose motivation within the first few months. At Kardu, we don't want you to throw in the towel.

Focus Mode is your personal operational intelligence dashboard, designed to combat abandonment and keep your team moving forward.

Forget staring at 200 controls without knowing where to start. Our algorithm analyzes your current state and tells you exactly what to do today. It filters out the noise, presenting only the 3-5 critical actions that will directly impact your Compliance Score within the next 24 hours.

Lack of immediate feedback is the primary reason teams drop compliance efforts. Focus Mode turns boring tasks into visible milestones. As you complete a critical action, watch your score rise in real-time, creating a motivation loop that keeps your team engaged for the long haul.

Focus queue8 controls pending
× Clear all
Security policyISO 27001Today
Security roles and responsibilitiesISO 27001Today
Access control reviewNIS2Tomorrow
Separation of dutiesISO 27001Apr 30
Supplier risk assessmentISO 27001May 2
Business continuity plan updateISO 27001May 5
Incident response drillNIS2May 8
Management commitmentISO 27001May 12
TodayPrioritised by Kardu
Security policyISO 27001Today
Security roles and responsibilitiesISO 27001Today
Access control reviewNIS2Tomorrow

Your Dedicated GRC Agent:

Compliance Expert, with European AI (Mistral, Paris)

At Kardu, we know that complying with NIS2, DORA, or ISO 27001 shouldn't require an in-house security department. That's why we've integrated a Dedicated AI Agent that acts as your 24/7 expert consultant, specifically designed to guide non-specialists through the complexities of cybersecurity. The result: You aren't just buying software — you are hiring a GRC expert who works alongside you.

Not sure where to start? The Agent doesn't just list requirements; it drafts policies tailored to your business, explains controls in plain language, and tells you exactly which evidence to gather. It turns legal jargon into a clear, executable roadmap.

Stop assembling reports manually. The Agent analyzes your inputs and automatically generates the technical documentation, risk management logs, and operational procedures that auditors demand. Reduce preparation time from weeks to hours, ensuring everything is structured, traceable, and error-free.

Artificial intelligence shouldn't compromise your privacy. Our Agent is powered exclusively by Mistral AI, Europe's leading large language model.

Zero data leakage: Unlike US-based models, we guarantee that no sensitive data, policy, or evidence ever leaves the European Economic Area (EEA).

Native compliance: By using European infrastructure and models, we align your compliance tool with the very regulations you are trying to meet (GDPR, NIS2).

Goldfinch
Goldfinch
Dashboard
What should I focus on first?

Which controls are missing evidence?

Ask anything about your compliance...
User
Design principles

The decisions that make us different

We build Kardu following the Security by Design principles defined by ENISA. This is not marketing — it is architecture.

View ENISA guidelines
1

Security by design

Every architecture decision prioritises security from the start. It is not an additional layer — it is the foundation everything is built on.

2

Proof before process

Controls are not marked complete with just a checkbox. They require at least one linked piece of evidence.

3

Auditability at every level

Every action with consequences on compliance status generates an immutable record. The system cannot forget.

4

Designed for EU sovereignty

The architecture allows migration to fully sovereign EU infrastructure without rewriting the product.

Kardu Foundation

Let your security boost your sales.

A 30-minute call with the founding team to see whether Kardu Foundation fits your company.

Talk to usSee pricing