04 / ComplianceSOC 2 · ISO 27001 · HIPAA · GDPR

Your deal is
stuck in a
security review.

100+ · Compliance programmes delivered, last 12 months
4 markets · US · EU · Singapore · Japan
4 frameworks · SOC 2 · ISO 27001 · HIPAA · GDPR
What we take you through

Four frameworks. One programme.

Most companies need more than one. The underlying control work overlaps heavily, so we scope them together — you implement a control once and it counts everywhere it applies.

Attestation report

SOC 2

The report North American enterprise buyers ask for before they sign. Type I proves your controls are designed right; Type II proves they actually ran.

SaaS and B2B software selling into US enterprise
SOC 2 in detailCertification

ISO 27001

The international standard for running an information security management system. The certificate European and global enterprise buyers recognise on sight.

Companies selling internationally, especially into Europe
ISO 27001 in detailUS regulation

HIPAA

US law governing protected health information. There is no official HIPAA certificate — there is a compliance programme, and independent validation of it.

Health tech, and any vendor touching US patient data
HIPAA in detailEU regulation

GDPR

The EU's data protection regulation. It applies by where your users are, not where your company is — which catches more companies than expect it.

Anyone with users, customers or staff in the EU or UK
GDPR in detail
Read this before you hire anyone

Nobody can sell you a SOC 2.

A SOC 2 report can only be issued by a licensed CPA firm. An ISO 27001 certificate can only be issued by an accredited certification body — and one that consulted on your system is barred from certifying it. HIPAA and GDPR have no official certification at all.

That independence is the whole reason the result is worth anything to your buyer. Any firm offering to certify you themselves is either misunderstanding the market or counting on you to. We tell you this on the first call, not the last.

So what do we actually do
  • Everything up to the auditor's line — readiness, policies, controls, evidence
  • Bring the right auditor from our partner panel and negotiate their fee
  • Sit in the audit and answer the auditor's questions on your behalf
  • Triage and close findings until the report or certificate is clean
  • Keep it alive afterwards, through surveillance audits and renewals
When companies call us

Usually at the worst moment.

Almost nobody starts a compliance programme because they woke up wanting one. They start because revenue is blocked, a regulator is interested, or a customer sent a questionnaire nobody can answer. All of those are workable — they are just easier with a few weeks of warning.

  • Procurement has parked your contract pending a security review
  • A customer sent a 300-question security questionnaire
  • You are moving upmarket and enterprise buyers expect it as table stakes
  • An investor or acquirer raised it in diligence
  • You handle health data, EU personal data, or both, and never formalised how
  • You are certified already and drowning in maintaining it
How the engagement runs

Scope, build, audit, keep.

01 · Scope
Decide what is in
Which framework, which criteria, which systems and entities. Scope is the single biggest cost driver and the easiest thing to get wrong.
02 · Gap
Find out where you stand
Every applicable control assessed against what you do today. You get a plan with owners, dates and an honest cost to close.
03 · Build
Close it, with your team
Policies written for how you actually work. Controls implemented with your engineers. Evidence pipelines that run themselves.
04 · Audit
We run the auditor
Auditor appointed, fieldwork coordinated, questions answered by us, findings closed. You get a report, not a to-do list.
Packages

Three ways in.

Most companies start at Readiness to find out what they are dealing with, then move to Certification once the scope is real. Managed is for after.

Readiness
Scoped on the call
one-off

You need to know exactly how far you are, and what it will cost to close the gap.

  • Scoping workshop — systems, people and data in scope
  • Gap assessment against every applicable control
  • Written policy pack, tailored, not templated
  • Evidence map: what to collect, from where, how often
  • Remediation plan with owners and dates
  • Readout with your leadership team
Talk it through
Certification
Most chosen
Scoped on the call
to report

You have a deal, a customer or a board deadline and you need the report in hand.

  • Everything in Readiness
  • Hands-on control implementation with your engineers
  • Evidence collection run by us, not homework for your team
  • Auditor selection from our partner panel, plus fee negotiation
  • We sit in the audit and answer the auditor's questions
  • Findings triaged and closed through to clean report
Start here
Managed
$3,000
from · per month

You are certified and you want to stay that way without hiring a compliance team.

  • Everything in Certification
  • Continuous control monitoring and evidence capture
  • Annual surveillance audits and re-certification managed end to end
  • Vendor and sub-processor risk reviews
  • Security questionnaires and customer due-diligence answered for you
  • Named compliance lead on your Slack
Talk it through

Every engagement is quoted as two separate numbers: our fee, and the external auditor's fee. We negotiate theirs on your behalf and never bundle the two into one price.

Where we work

Four markets. One team.

We run engagements across the United States, the European Union, Singapore and Japan, and appoint auditors accredited in the jurisdictions your buyers care about. A European certification body for ISO 27001. A US CPA firm for SOC 2. The right validator for HIPAA and GDPR programmes.

The frameworks themselves travel: ISO 27001 and SOC 2 are recognised in every major market, GDPR reaches any company with European users regardless of where it is incorporated, and HIPAA binds any vendor touching US patient data wherever they are based.

Questions buyers actually ask us

Straight answers.

Do you issue the certification yourselves?
No, and no legitimate consultancy does. SOC 2 reports are issued by licensed CPA firms and ISO 27001 certificates by accredited certification bodies — their independence from your consultant is what gives the result value. We take you from wherever you are to audit-ready, bring the right auditor from our partner panel, and manage the audit through to a clean result. HIPAA and GDPR have no official certification at all; there we build the compliance programme and arrange independent validation.
Which framework do we actually need?
Usually whichever one your customers are asking for. North American enterprise buyers ask for SOC 2. European and international buyers, and most public tenders, ask for ISO 27001. HIPAA applies by law if you touch US patient data, and GDPR applies by law if you process the data of people in Europe — neither is optional based on customer demand. If two or more apply, we sequence them so the control work is done once.
Can we do more than one at the same time?
Yes, and it is usually cheaper than doing them in series. SOC 2 and ISO 27001 share a large amount of underlying control work, and a HIPAA or GDPR programme built properly reuses most of the same evidence. We scope a combined programme so your team implements a control once and it counts everywhere it applies.
How much of this lands on our engineering team?
Less than if you did it yourselves, but not zero — anyone promising zero is either doing it badly or doing it for you in a way that will not survive an auditor. Engineers are needed for control implementation and access to systems. Policy writing, evidence collection, auditor liaison and audit fieldwork are ours. We budget the engineering time explicitly at scoping so it is not a surprise.
Do you work with companies outside your own country?
Yes. Most of our work is in the United States, the European Union, Singapore and Japan, and the frameworks themselves are international — ISO 27001 and SOC 2 are recognised worldwide, GDPR reaches any company with European users, and HIPAA binds any vendor touching US patient data wherever they are based. We work across time zones and appoint auditors accredited in the jurisdictions that matter to your buyers.
What does it cost?
Two separate numbers: our fee, and the external auditor's fee. We quote ours after a scoping call, because scope genuinely drives it — headcount, systems in scope, chosen criteria and your target date. We negotiate the auditor's fee on your behalf and always show you both figures separately rather than bundling them into one opaque price.
We have a deal blocked right now. How fast can you move?
Tell us on the call. When revenue is blocked on a security review we will usually aim at the fastest defensible artefact — often a SOC 2 Type I, sometimes a completed questionnaire plus a credible remediation plan your buyer's security team will accept in the interim. What we will not do is help you claim a status you do not have.

Bring us the questionnaire.

Send the security review that is blocking you, or just tell us which framework your customer named. We will come back with scope, sequence and a realistic date.

Book a scoping callcontact@binaryvlue.com