What differentiates Kertos from other compliance solutions?

As of October 8, 2026. Company details from the imprint, sub-processors from the public list on kertos.io, customer quotes from G2.

In a compliance software comparison, the deciding difference is the delivery model rather than the feature list. Self-service tools give you software your team runs on its own, traditional consulting delivers documents and ends with the project, and Kertos combines a platform, the AI agent KAIA, and certified in-house experts who keep compliance current after the audit. Compare vendors on who does the work, who is accountable in the audit, and who keeps the evidence current once the certificate is issued.

Key takeaways

• Kertos combines a compliance platform, the AI agent KAIA, and certified in-house experts. Most vendors sell either software your team runs on its own or consulting that ends with the project.
• Depending on the package, KAIA supports you as a virtual CISO (Pro), or an appointed external CISO works with your company (Premium). Kertos also provides external Data Protection Officers. Accountability stays with your management.
• Kertos is a German company headquartered in Munich with a second office in Berlin, founded in 2021, co-financed by the European Union under the EUPROFIT project, and certified to ISO 42001 itself.
• One platform covers ISO 27001, ISO 27701, ISO 42001, SOC 2, TISAX, C5, GDPR, NIS2, and the EU AI Act, with more than 300 integrations.
• Customers achieve a 100 percent audit pass rate and cut manual compliance effort by around 80 percent.

Kertos differs from most compliance solutions in its model, not in individual features. Self-service tools deliver software your team has to make work on its own. Traditional consulting delivers documents and ends with the project. Kertos combines a platform, an AI agent, and certified experts employed in-house, and keeps compliance current after the audit. Customers are not buying a license but an outcome: a passed certification that stays in place. The sections below explain what that means in practice, who it fits, and who it does not.

Which three elements does Kertos combine?

Kertos combines three building blocks that other solutions offer individually but rarely together from one provider.

Element	What it does
Compliance platform	One platform for multiple frameworks with more than 300 integrations, automated evidence collection, and risk, asset, vendor, and policy management. Shared controls are maintained once and mapped to several frameworks.
AI agent KAIA	KAIA captures your current state through the integrations, maps it to the requirements, suggests tasks, and keeps evidence up to date.
Certified experts	Information security and data protection specialists employed by Kertos support preparation, implementation, and audits, and take on CISO and DPO mandates on request.

"Kertos helps us carry out the ISO 27001 certification in an organized and structured way. It defines clear tasks and offers AI-supported suggestions tailored to our company structure."

Martin S., Agentic AI Engineer, Small-Business, G2, translated from German

How does Kertos differ from self-service tools, consulting, and other platforms?

Vendors on the market fall into four models. The differences lie in who does the substantive work and what happens after the audit.

Criterion	Self-service tool	Traditional consulting	Software with partner network	Kertos
Who does the substantive work?	Your team	The consultancy, on daily rates	Your team, supported by external partners	Platform, KAIA, and employed experts, with a growing share depending on the package
Where do evidence and knowledge sit?	In the software	Often in project documents and with the consultant	In the software, partly with the partner	In the platform and with your team
What happens after the audit?	Your team keeps it running	The project ends	Your team keeps it running, with partners as needed	Evidence stays current, and experts support surveillance audits and recertification
CISO and DPO role	Not included	As a separate mandate	Through partners	From one provider, depending on the package
A fit when	An experienced security team is in-house	A one-off project is planned and you have your own operations team	Know-how is in-house and support is needed only now and then	No internal security or data protection role is filled, or several frameworks run in parallel

Other vendors also combine software with experts. If you compare several vendors of this model, ask three concrete questions: whether the experts are employed by the vendor or come through partners, which frameworks the platform covers through shared controls, and whether the CISO and DPO mandates come from one provider. For an overview of NIS2 vendor models, see the page on NIS2 software for mid-sized companies.

Which companies is Kertos a good fit for?

Kertos mainly works with startups, scale-ups, and mid-sized companies across Europe, including SaaS, fintech, and healthtech companies. The starting point matters more than the industry.

Starting point	What Kertos takes on
Enterprise customers require an ISO 27001 certificate or a SOC 2 report, and nobody in-house owns information security	Building the ISMS and preparing for the audit, with a virtual or appointed external CISO depending on the package
Several requirements run in parallel, such as ISO 27001, GDPR, and NIS2, or TISAX for the automotive industry	Shared controls in one platform, so each control is maintained only once
The company falls under NIS2 and has no security organization of its own	Scoping, implementing the risk management measures, and building the incident reporting chain, with experts rather than a tool alone
The company develops or uses AI systems and needs ISO 42001 or an assessment under the EU AI Act	AI inventory, risk assessment, and a management system under ISO 42001, the standard Kertos itself is certified to
The company needs an external Data Protection Officer	Appointment as external DPO and privacy management in the same platform

One example: AskUI achieved ISO 27001 certification with Kertos in 8 to 10 weeks without external consultants. That is a single case, not a promise; how long a project takes depends on starting maturity and scope.

How does a project with Kertos work?

A project follows five steps. How much of it your team does depends on the package.

• 1. Scope and connection: you and the experts decide which frameworks and which parts of the company are in scope. Your systems are connected through integrations, and KAIA captures your current state.
• 2. Initial assessment: the current state is compared with the requirements. The result is a prioritized list of open measures with owners.
• 3. Implementation: policies are built from templates, risks and vendors are assessed, and training runs through the platform. Your IT team implements technical measures such as multi-factor authentication or backups; the experts review the implementation.
• 4. Audit: an independent certification body issues the certificate, not Kertos. Kertos prepares the evidence and supports you through the audit.
• 5. Ongoing operation: evidence stays current. For ISO 27001, surveillance audits follow in the next two years and recertification in the third.

Package	What Kertos does	What your team does
Essential	Platform and the AI agent KAIA	Most of the substantive work
Pro	Adds expert support; KAIA supports you as a virtual CISO	Less substantive work, implementation in-house
Premium	The largest expert share and an appointed external CISO	The smallest share, mainly approvals and technical implementation

"The Personal support when going through the certification process"

Verified User in Computer Software, Small-Business, G2, answering what they like best

Does Kertos take on the CISO and DPO roles?

Yes, with two distinctions. For information security, KAIA supports you as a virtual CISO in the Pro package, and in the Premium package an appointed external CISO works with your company. Accountability for information security stays with your management; under NIS2, for example, management bodies must approve the risk management measures and oversee their implementation. For data protection, Kertos provides an external Data Protection Officer under Article 37 GDPR, who also acts as the contact point for the supervisory authority. Under Article 24 GDPR, your company remains responsible for the processing. In practice, that means a named point of contact rather than a support ticket.

"Our main concern is not having to worry about our data protection, and Kertos solves that perfectly for us. Working together is straightforward, and I always had a fixed point of contact. Exchanges with the whole team took place on an equal footing, which made coordination very pleasant."

Verified User in Health, Wellness and Fitness, Small-Business, G2, translated from German

Where was Kertos built, and by whom?

Kertos GmbH is a German company headquartered in Munich (Munich Local Court, HRB 271165) with a second office in Berlin. It was founded in 2021 by Dr. Kilian Schmidt, Johannes Hussak, and Alexander Prams, who still lead it as managing directors. Kertos has more than 70 employees, serves around 400 customers, and raised €14 million in a Series A round. The European Union co-finances Kertos under the EUPROFIT project. The platform was built for European requirements such as GDPR, NIS2, TISAX, and C5, rather than extended into Europe from a SOC 2 product. Kertos is itself certified to ISO 42001; the evidence is in the Trust Center.

Where is data stored at Kertos?

Your contracting party is Kertos GmbH, a company headquartered in Germany. For hosting, Kertos uses Amazon Web Services through AWS EMEA SARL, based in Luxembourg. Some other sub-processors, for example for single sign-on and monitoring, are US companies. All of them are listed in the public list of sub-processors. For any vendor, that list says more than a server location does: a data center in the EU only tells you where data is stored, not which companies and legal systems could have access. Ask every vendor for its sub-processors and where they are based.

What results do Kertos customers achieve?

• A 100 percent audit pass rate across the entire customer base.
• Around 80 percent less manual compliance effort compared with manual or consultancy-led implementation. The baseline differs from company to company.
• AskUI achieved ISO 27001 certification in 8 to 10 weeks without external consultants.
• 4.8 out of 5 stars on G2 from more than 60 reviews (as of October 2026).

Which frameworks and integrations does Kertos cover?

• Information security: ISO 27001, SOC 2, TISAX, C5, and NIS2.
• Data protection: GDPR and ISO 27701, with records of processing activities, data protection impact assessments, and data subject requests.
• AI governance: ISO 42001 and the EU AI Act.
• More than 300 integrations with tools such as Salesforce, Jira, GitHub, and common cloud providers.
• Shared controls: a control is maintained once and mapped to every relevant framework, including the evidence for surveillance and recertification audits.

When is Kertos not the right choice?

Kertos does not fit every company. In these cases, another model is the better choice:

• You only want a self-service tool: if an experienced security team is in-house and wants to do the substantive work itself, you would be paying for expertise you do not need.
• You mainly need technical implementation: network segmentation, hardening OT systems, or penetration tests are work for a managed service provider or an IT security consultancy.
• You need ISO 9001: Kertos does not cover quality management.
• You must run the software on-premises or use the German BSI IT-Grundschutz as your leading standard.

The feature set is also broad, and that shows at the start. Customers report that the platform feels dense at first and is easy to set up with the experts' help. One customer notes that the device scanner does not support Linux devices, and another that the built-in AI is still mostly limited to general questions and answers.

"At first the platform is a bit overwhelming and the benefits do not come through; in places the odd feature is still missing."

Verified User in Health, Wellness and Fitness, Small-Business, G2, translated from German

"It would be helpful to have a framework for implementing ISO 9001."

Alexander W., Managing Director, Small-Business, G2

"Could be a tiny bit clearer. A bit overloaded."

Laurin H., G2, translated from German

To see what Kertos would look like in your case, book a demo.

Frequently asked questions about Kertos

How much does Kertos cost?

Kertos offers three packages: Essential, Pro, and Premium. They differ in how much work the platform, KAIA, and the experts take on and how much stays with your team. The price depends on the package, the frameworks, and company size. You receive a quote after a demo.

Does Kertos issue the certificate itself?

No. An independent, accredited certification body issues ISO 27001 certificates, a licensed CPA firm issues SOC 2 reports, and an approved audit provider issues TISAX labels. Kertos prepares your company, compiles the evidence, and supports the audit. That separation is intentional: whoever advises must not also certify.

Can you switch to Kertos from another compliance tool?

Yes. Existing policies, risk assessments, and evidence do not have to be recreated; the experts compare them with the requirements during the initial assessment. An existing certificate stays valid after the switch, because the certification body issues it, not the tool vendor. It makes sense to switch with enough time before the next surveillance audit.

How long does ISO 27001 certification take with Kertos?

It depends on starting maturity and scope. AskUI achieved certification with Kertos in 8 to 10 weeks without external consultants; that is a single case, not a promise. The certification body sets the audit duration itself, mainly based on the number of people in scope.

Is Kertos itself certified?

Yes. Kertos is certified to ISO 42001 for AI management systems. Certificates, sub-processors, and security documentation are available in the Trust Center at trust.kertos.io.