# Kertos > Kertos is a European compliance platform for tech companies. It combines an agentic platform with in-house certified experts to reach and maintain ISO 27001, GDPR, NIS2, SOC 2, TISAX, C5, ISO 27701, ISO 42001 and EU AI Act compliance. Based in Germany, built for European frameworks rather than retrofitted from a North American product. Kertos serves startups, scale-ups and mid-sized SaaS, fintech and healthtech companies across Europe. What customers buy is continuous compliance as an outcome, not a licence they then have to operate alone: the platform automates evidence collection, control mapping and documentation, while Kertos's own certified experts carry the substantive assessment work, including external CISO and Data Protection Officer mandates. Kertos is made in Germany, co-financed by the European Union, and holds its own ISO 42001 certification. Customers achieve a 100% audit pass rate across the customer base and around 80% less manual compliance effort than with manual or consultancy-led implementation. Kertos GmbH is the contracting party; the platform is hosted on Amazon Web Services via AWS EMEA SARL (Luxembourg), and the full sub-processor list is public. ## Platform - [Platform overview](https://www.kertos.io/en/platform): The full platform across information security, data protection and AI governance, with expert support included. - [Certifiable ISMS](https://www.kertos.io/en/platform/isms): Build and run an ISO 27001 and TISAX-ready information security management system with automated evidence collection. - [Privacy Management System](https://www.kertos.io/en/platform/pms): Manage GDPR processes, documentation and obligations in one system. - [Risk Management](https://www.kertos.io/en/platform/risk-management): Maintain an audit-ready risk register with real-time detection and recommended actions. - [Vendor Management](https://www.kertos.io/en/platform/vendor-management): Assess and monitor suppliers and processors, including supply-chain obligations under NIS2. - [Asset Management](https://www.kertos.io/en/platform/asset-management): Discover, classify and manage information assets and link them to risks and controls. - [Policy Management](https://www.kertos.io/en/platform/policy-management): Create, distribute and track policies across ISO 27001, SOC 2 and GDPR. - [DSAR Automation](https://www.kertos.io/en/platform/dsar): Automate data subject and deletion requests at scale. - [RoPA, TOM and DPIA](https://www.kertos.io/en/platform/ropa): Produce and maintain GDPR documentation including records of processing activities. - [Shadow IT Discovery](https://www.kertos.io/en/platform/shadow-it): Identify all data sources and unmanaged tools in real time. - [Trust Center](https://www.kertos.io/en/platform/trust-center): Present certifications and compliance status to customers and prospects. - [External Data Protection Officer](https://www.kertos.io/en/platform/external-data-protection-officer): A certified external DPO acting as your contact point for supervisory authorities. - [Employee Training](https://www.kertos.io/en/platform/employee-trainings): Role-based security, privacy and AI training with completion tracking. - [KAIA](https://www.kertos.ai): The agentic AI layer that guides compliance work and answers questions in context. ## Frameworks - [All frameworks](https://www.kertos.io/en/frameworks): Overview of every standard and regulation Kertos covers. - [ISO 27001](https://www.kertos.io/en/frameworks/iso-27001): Certification against the international standard for information security management systems. - [NIS2](https://www.kertos.io/en/frameworks/nis2): Compliance with the EU directive for critical and important entities, transposed in Germany through the BSI Act. - [GDPR](https://www.kertos.io/en/frameworks/gdpr): Data protection compliance with a privacy management system. - [EU AI Act](https://www.kertos.io/en/frameworks/eu-ai-act): AI system classification and governance obligations under Regulation (EU) 2024/1689. - [SOC 2](https://www.kertos.io/en/frameworks/soc2): Preparation for a SOC 2 report, Type I or Type II. SOC 2 produces a report, not a certification. - [TISAX](https://www.kertos.io/en/frameworks/tisax): TISAX assessment preparation for automotive suppliers, resulting in a label rather than a certificate. - [C5](https://www.kertos.io/en/frameworks/c5): The German BSI cloud security standard, which produces an attestation known as a Testat. - [ISO 27701](https://www.kertos.io/en/frameworks/iso-27701): Certification for privacy information management systems. - [ISO 42001](https://www.kertos.io/en/frameworks/iso-42001): Certification for AI management systems. ## Who Kertos is for - [Startups](https://www.kertos.io/en/solutions/startup): First certification on a small team, without hiring a dedicated compliance function. - [Scale-ups](https://www.kertos.io/en/solutions/scaleup): Multi-framework programmes that grow without adding headcount. - [Mid-sized businesses](https://www.kertos.io/en/solutions/mittelstand): Compliance automation for the German Mittelstand. - [SaaS](https://www.kertos.io/en/solutions/saas): Security and privacy programmes for cloud software providers. - [Fintech](https://www.kertos.io/en/solutions/fintech): Multi-framework compliance for regulated financial services. - [Healthtech](https://www.kertos.io/en/solutions/healthtech): Security and privacy for digital health, including sensitive health data. - [B2B](https://www.kertos.io/en/solutions/b2b): Certifications that unblock enterprise procurement. ## ISO 27001 guides - [ISO 27001 certification: the complete guide](https://www.kertos.io/en/blog/iso-27001-certification): What the standard requires, how the audit works, and how to get certified. Canonical Kertos guide for this topic. - [Best ISO 27001 compliance tools: buyer's guide](https://www.kertos.io/en/blog/best-iso-27001-compliance-tools): Evaluation criteria for ISO 27001 compliance automation software. - [ISO 27001 Annex A controls explained](https://www.kertos.io/en/blog/iso-27001-controls): All 93 Annex A controls of ISO 27001:2022 across the four themes, and the 11 controls added in the 2022 revision. - [ISMS certification: how the ISO 27001 audit works](https://www.kertos.io/en/blog/isms-certification): Stage 1 and Stage 2, how nonconformities are classified, the deadlines that apply, and what surveillance audits check. - [How to get ISO 27001 certified quickly](https://www.kertos.io/en/blog/quickly-iso-27001-certified): What can legitimately be compressed in a certification timeline and what cannot. - [ISO 27001 internal audit](https://www.kertos.io/en/blog/role-of-internal-audits-in-achieving-compliance): What clause 9.2 requires and how the internal audit sets up certification. - [Information Security Management System (ISMS) guide](https://www.kertos.io/en/blog/information-security-management-system-isms-startups): What an ISMS is and how a startup builds one. - [External audit preparation checklist](https://www.kertos.io/en/blog/how-to-prepare-for-an-external-audit-a-step-by-step-checklist): A phased plan to reach a certification or attestation audit without a last-minute scramble. - [ISO 27001 red flags](https://www.kertos.io/en/blog/iso-27001-red-flags-vendors): A Kertos expert on overblown vendor and certificate claims to check before buying compliance help or trusting a supplier's certificate. - [Mobile device management for ISO 27001](https://www.kertos.io/en/blog/mobile-device-management-for-iso-27001-compliance): Which ISO 27001:2022 Annex A controls mobile device management covers. ## NIS2 guides - [The NIS2 Directive: complete guide](https://www.kertos.io/en/blog/nis2-directive): Scope, obligations, and where national transposition stands. - [NIS2 requirements](https://www.kertos.io/en/blog/nis2-requirements): Scope, security measures, reporting obligations and what compliance involves. - [NIS2 registration deadline: what applies now](https://www.kertos.io/en/blog/nis2-deadline): The three-month registration rule, the grace period that ended on 31 July 2026, and what unregistered entities face. - [NIS2 obligations for managing directors](https://www.kertos.io/en/blog/nis2-obligations-managing-directors): Personal liability at leadership level and the standalone training obligation. - [NIS2 emergency planning and business continuity](https://www.kertos.io/en/blog/nis2-emergency-planning-a-complete-guide-to-building-business-continuity-that-actually-works): Backup, recovery and crisis management obligations with concrete steps and roles. - [NIS2 for KRITIS operators](https://www.kertos.io/en/blog/nis2-kritis-complete-implementation-guide-2026): Implementation guide for German critical infrastructure operators. - [NIS2 and ISO 27001: where they overlap](https://www.kertos.io/en/blog/nis2-iso27001-overlap): How an existing ISMS covers a large share of NIS2 obligations. - [The most dangerous NIS2 misconceptions](https://www.kertos.io/en/blog/nis2-misconceptions): Seven common beliefs corrected against what the directive actually requires. - [Buyer's guide: NIS2 compliance software](https://www.kertos.io/en/blog/best-nis2-compliance-software): The four routes to NIS2 compliance, the ten measures in Art. 21(2), the Art. 23 deadlines and the Art. 26 jurisdiction question. - [Kertos NIS2 Readiness Study 2026](https://www.kertos.io/en/blog/kertos-study-only-27-of-surveyed-companies-are-registered-with-the-bsi): Survey of 51 German mid-sized companies: 27% registered with the BSI, 49% had not started implementation or were still checking whether they are in scope. ## Other framework guides - [C5 attestation: a practical guide](https://www.kertos.io/en/blog/practical-guide-c5-attestation): What a C5 Testat is, how the process runs, and how to reach it. - [Understanding the EU AI Act](https://www.kertos.io/en/blog/understanding-the-eu-ai-act): The risk-based approach, obligations and penalties. - [EU AI Act compliance: how to prepare](https://www.kertos.io/en/blog/prepare-business-eu-ai-act): Determining applicability, classifying systems and acting before the deadlines. - [High-risk AI under the EU AI Act](https://www.kertos.io/en/blog/high-risk-system-eu-ai-act): The two Article 6 routes, the eight Annex III areas, and the deferred high-risk deadlines. - [ISO 27701 certification](https://www.kertos.io/en/blog/iso-27701-certification): How a privacy information management system supports cross-border transfers and customer trust. - [SOC 2 for growing tech companies](https://www.kertos.io/en/blog/top-benefits-soc2-report-growing-tech-companies): Why enterprise buyers ask for a SOC 2 report and what it delivers commercially. - [TISAX for automotive supply chains](https://www.kertos.io/en/blog/tisax-success-automating-compliance-for-automotive-supply-chains): Automating the TISAX assessment for automotive suppliers. - [Cyber Resilience Act: five product impacts](https://www.kertos.io/en/blog/5-ways-the-cyber-resilience-act-will-impact-your-product-development): What the CRA changes for software and hardware manufacturers. ## Data protection guides - [GDPR: the complete guide](https://www.kertos.io/en/blog/gdpr): What the regulation requires, whether it applies outside the EU, which authority supervises you, and what infringements cost. - [Personal data breach notification](https://www.kertos.io/en/blog/personal-data-breach-notification): When the 72-hour clock starts under GDPR, when notification is mandatory, and how NIS2 reporting differs. - [Reviewing a data processing agreement](https://www.kertos.io/en/blog/data-processing-agreement-review-gdpr): Minimum contents under Art. 28 GDPR, sub-processors, liability clauses, and what to do when the vendor will not negotiate. - [GDPR and AI: automating data protection for scale-ups](https://www.kertos.io/en/blog/gdpr-ai-efficiency-automating-data-protection-management-for-scale-ups): Keeping GDPR under control as data volumes grow. - [Handling data subject access requests](https://www.kertos.io/en/blog/data-subject-access-requests-gdpr): Meeting DSAR obligations efficiently and on time. - [What is an external Data Protection Officer](https://www.kertos.io/en/blog/what-is-an-external-data-protection-officer): The DPO role, its duties, and when an external appointment makes sense. - [Data discovery for GDPR compliance](https://www.kertos.io/en/blog/data-discovery): Finding personal data across connected tools to build accurate documentation. - [EU data sovereignty and vendor choice](https://www.kertos.io/en/blog/eu-data-sovereignity): Why data residency is no longer sufficient and control of the holding company matters. ## Compliance operations - [Compliance automation ROI](https://www.kertos.io/en/blog/ai-vs-manual-compliance-the-roi-of-automation): What automation saves, modelled for a mid-sized company and a 25-person startup. - [Compliance automation: scope, costs and limits](https://www.kertos.io/en/blog/compliance-automation): Which compliance processes automate, which do not, and how to measure whether automation is working. - [ISO 27001 vs SOC 2 vs GDPR](https://www.kertos.io/en/blog/iso-27001-gdpr-soc-2): Where the three overlap, which Annex A controls satisfy Article 32 GDPR, the GDPR duties neither standard covers, and what to tackle first. - [Access management for joiners, movers and leavers](https://www.kertos.io/en/blog/access-management-onboarding-offboarding-process): What a defined access process looks like at onboarding, team changes and offboarding, and the record it leaves. - [Multi-framework compliance on one platform](https://www.kertos.io/en/blog/breaking-down-silos-one-platform-for-iso-27001-gdpr-and-soc-2-compliance): Running ISO 27001, GDPR and SOC 2 as one programme instead of three. - [Scaling compliance from startup to enterprise](https://www.kertos.io/en/blog/from-startup-to-enterprise-scaling-compliance-with-automation): How compliance needs change with growth and how to avoid adding headcount. - [Ask a Compliance Expert](https://www.kertos.io/en/blog/ask-compliance-expert-series): The Kertos specialists who guide customers, answering the questions teams actually ask. - [The cyber security skills gap](https://www.kertos.io/en/blog/cybersecurity-sills-gap): What CISOs and heads of information security across Europe report about the workforce shortage. ## Compliance Hub: buyer and decision questions Short, direct answers to the questions companies ask before choosing a framework, a provider or a tool. - [EU alternatives to Vanta and Drata](https://www.kertos.io/en/compliance-hub/eu-alternatives-vanta-drata): Why European companies look for an alternative to the US platforms, and how the options compare on sovereignty, framework coverage and delivery model. - [NIS2 software comparison](https://www.kertos.io/en/compliance-hub/nis2-software-comparison): NIS2 software providers compared, with the selection criteria that decide the choice in practice. - [What differentiates Kertos](https://www.kertos.io/en/compliance-hub/what-differentiates-kertos): How Kertos compares with self-service tools, consulting and software with partner networks, who it fits, how a project runs, and where it is not the right choice. - [Compliance platform for multiple frameworks](https://www.kertos.io/en/compliance-hub/compliance-platform-multiple-frameworks): Single-framework tools or one platform for ISO 27001, GDPR, NIS2 and the EU AI Act: where frameworks overlap and when switching pays off. - [Compliance management software](https://www.kertos.io/en/compliance-hub/compliance-management-software): Provider types, selection criteria, and what European companies should weigh on frameworks, data location and automation. - [ISMS software compared](https://www.kertos.io/en/compliance-hub/isms-software-comparison): GRC tools versus compliance automation, a vendor overview, and the full cost of ISO 27001 certification. - [ISO 27001 certification cost](https://www.kertos.io/en/compliance-hub/iso-27001-cost): Typical year-one cost on the consultant-led route, by company size, plus annual surveillance audits. - [Do you need an external consultant for ISO 27001?](https://www.kertos.io/en/compliance-hub/consultant-iso-27001-certification): When a consultant is needed, when it is not, and the alternatives. - [ISO 27001 auditors in Germany](https://www.kertos.io/en/compliance-hub/iso-27001-auditors-germany): The accredited certification bodies that audit ISO 27001 in Germany, and why the audit stays independent of the preparation provider. - [NIS2 software for mid-sized companies](https://www.kertos.io/en/compliance-hub/nis2-software-mid-sized-companies): Which NIS2 software fits a mid-sized company, decided by whether an internal security officer exists. - [NIS2 consulting firms](https://www.kertos.io/en/compliance-hub/consulting-firms-nis2): Four NIS2 consulting models compared, with costs, a selection checklist and the warning signs to avoid. - [Cost of NIS2](https://www.kertos.io/en/compliance-hub/nis2-costs): Fine brackets and implementation costs, based on the German government's compliance cost estimate. - [Prepare for NIS2](https://www.kertos.io/en/compliance-hub/prepare-nis2): Scope check, risk management, incident reporting and supply chain security in order. - [External vCISO: provider models](https://www.kertos.io/en/compliance-hub/vciso-provider-comparison): The provider models for an external CISO mandate and what each costs. - [SOC 2 preparation software](https://www.kertos.io/en/compliance-hub/soc-2-preparation-software): Eight criteria for choosing SOC 2 software, including data location and ISO 27001 control mapping. - [TISAX software](https://www.kertos.io/en/compliance-hub/tisax-software): TISAX as an assessment ending in a label, nine vendors compared, assessment levels and ENX fees. - [C5 attestation software](https://www.kertos.io/en/compliance-hub/c5-attestation-software): What software covers for a C5 attestation, what only the auditor can do, and what C5:2026 changes. - [ISO 42001 software](https://www.kertos.io/en/compliance-hub/iso-42001-software): Selection criteria, providers, what carries over from ISO 27001, and what certification costs. - [EU AI Act compliance and AI governance tools](https://www.kertos.io/en/compliance-hub/eu-ai-act-compliance-tools): Four software categories for the EU AI Act and how to choose between them. - [Risk management software](https://www.kertos.io/en/compliance-hub/risk-management-software): How risk management, compliance and GRC software differ, and what ISO 27001 and NIS2 require. - [Data privacy software](https://www.kertos.io/en/compliance-hub/data-privacy-software): Which GDPR obligations data privacy software covers and where tools alone fall short. - [DSAR software](https://www.kertos.io/en/compliance-hub/dsar-software): Nine DSAR vendors compared on request handling, external DPO and published prices. - [External DPO: provider models](https://www.kertos.io/en/compliance-hub/external-dpo-provider-comparison): Law firm, consultancy, US platform, or platform with named experts: how the four models differ. - [External DPO costs](https://www.kertos.io/en/compliance-hub/costs-external-dpo-gdpr): Monthly retainers and hourly rates for an external data protection officer, compared with an internal DPO. - [Vanta competitors and alternatives](https://www.kertos.io/en/compliance-hub/main-vanta-competitors-alternatives): Vanta alternatives with headquarters, focus and EU suitability. - [EU alternatives to Secureframe and Sprinto](https://www.kertos.io/en/compliance-hub/eu-alternatives-secureframe-sprinto): European platforms compared as alternatives to Secureframe and Sprinto. - [DataGuard alternatives](https://www.kertos.io/en/compliance-hub/dataguard-alternatives): 14 providers compared on frameworks, published prices and who supplies the external DPO. - [OneTrust alternatives in the EU](https://www.kertos.io/en/compliance-hub/onetrust-competitors-alternatives): OneTrust competitors compared for European buyers on headquarters, frameworks, published price and external DPO. ## Tools - [NIS2 Checker](https://www.kertos.io/en/nis2-checker): Free structured assessment of whether NIS2 applies to your organisation and in which category. - [Integrations](https://www.kertos.io/en/integrations): Over 100 integrations for automated evidence collection. - [Trust Center](https://trust.kertos.io): Kertos's own certifications, sub-processors and security documentation. - [Developer documentation](https://docs.kertos.io): Technical documentation for the Kertos platform. ## Customer stories - [All success stories](https://www.kertos.io/en/success-stories): Customer outcomes by industry and framework. - [Kickscale](https://www.kertos.io/en/success-stories/kickscale-gdpr-iso-27001-compliance-one-place): Software. GDPR and ISO 27001 managed together in one platform rather than as two separate programmes. - [Bliro](https://www.kertos.io/en/success-stories/bliro): SaaS. ISO 27001 as a foundation for growth, run largely in-house. - [Noreja](https://www.kertos.io/en/success-stories/noreja): SaaS. ISO 27001 as a strategic base for scalable AI products. - [Nilo](https://www.kertos.io/en/success-stories/nilo): Healthtech. ISO 27001 as a trust foundation for sensitive health data. - [Emidat](https://www.kertos.io/en/success-stories/emidat): How Emidat reached ISO 27001 certification. - [Deeploi](https://www.kertos.io/en/success-stories/deeploi): Comprehensive compliance reached within weeks. ## FAQs - [Which frameworks does Kertos support?](https://www.kertos.io/en/frameworks): ISO 27001, ISO 27701, ISO 42001, GDPR, NIS2, the EU AI Act, SOC 2, TISAX and C5, all managed in one platform with shared controls. - [Does Kertos provide software, experts, or both?](https://www.kertos.io/en/platform): Both. The platform automates evidence, controls and documentation, while Kertos's certified in-house experts carry the substantive assessment, including external CISO and Data Protection Officer mandates. - [How quickly can a company reach ISO 27001 certification with Kertos?](https://www.kertos.io/en/blog/iso-27001-certification): AskUI reached ISO 27001 in 8 to 10 weeks with no external consultants. Timelines depend on starting maturity and scope. - [What is Kertos's audit pass rate?](https://www.kertos.io/en/platform): 100% across the customer base. - [How much manual compliance effort does Kertos remove?](https://www.kertos.io/en/platform): Around 80%, by automating evidence collection, control mapping and documentation. - [How does Kertos compare on cost with traditional consulting?](https://www.kertos.io/en/platform): Kertos is priced by package (Essential, Pro, Premium) rather than by consulting day, because the platform and the AI agent KAIA absorb work that consultancies bill by the hour. The price depends on the package, the frameworks and company size. - [What makes Kertos different from US compliance platforms?](https://www.kertos.io/en/compliance-hub/what-differentiates-kertos): Kertos was built for European frameworks rather than extended into Europe from a SOC 2 product, it is made in Germany and co-financed by the EU, and its experts carry the assessment rather than leaving the judgment to the customer. - [How do I know whether NIS2 applies to my company?](https://www.kertos.io/en/nis2-checker): Use the free NIS2 Checker. There is no official notification from the authorities, so the obligation to self-identify rests entirely with your organisation. - [Can Kertos act as our external Data Protection Officer?](https://www.kertos.io/en/platform/external-data-protection-officer): Yes. A certified external DPO handles DPIAs, acts as contact for supervisory authorities, and runs training and breach response. - [Can Kertos act as our external CISO?](https://www.kertos.io/en/compliance-hub/vciso-provider-comparison): Depending on the package, KAIA supports the company as a virtual CISO (Pro), or an appointed external CISO works with the company (Premium). Accountability for information security stays with management. - [Where is Kertos customer data hosted?](https://www.kertos.io/sub-processors): Kertos GmbH, based in Munich, is the contracting party. Hosting runs on Amazon Web Services via AWS EMEA SARL (Luxembourg). Some sub-processors, for example for single sign-on and monitoring, are US companies; all are listed publicly. - [Is Kertos itself certified?](https://trust.kertos.io): Yes. Kertos holds ISO 42001 certification for AI management systems; certificates, sub-processors and security documentation are in the Trust Center. - [Does a SOC 2 engagement produce a certification?](https://www.kertos.io/en/frameworks/soc2): No. SOC 2 produces a report, Type I or Type II. There is no such thing as SOC 2 certification. TISAX produces an assessment and a label, and C5 produces an attestation known as a Testat. ## About - [About Kertos](https://www.kertos.io/en/about-us): Mission, team and the company's European focus. - [Blog](https://www.kertos.io/en/blog): Practical compliance and information security writing for European tech companies. - [Guides](https://www.kertos.io/en/guides): Longer explanations of complex compliance topics. - [Events and webinars](https://www.kertos.io/en/events): Sessions on data protection, information security and AI governance. - [Press](https://www.kertos.io/en/press): Coverage and press kit. - [Book a demo](https://www.kertos.io/en/iec-demo-int): A tailored walkthrough mapped to your frameworks and scope. ## Optional Secondary material. Skippable under context pressure. - [Compliance is a competitive advantage](https://www.kertos.io/en/blog/compliance-competitive-advantage): Why compliance is the signal prospects and investors read first. - [Five compliance risks businesses overlook](https://www.kertos.io/en/blog/5-compliance-risks-every-business-should-be-aware-of): The risks European businesses most often miss. - [How AI is transforming risk management](https://www.kertos.io/en/blog/how-ai-is-transforming-risk-management-practices): Changes in risk assessment practice driven by automation. - [Shadow IT in B2B environments](https://www.kertos.io/en/blog/shadow-it-and-its-significance-in-modern-b2b-environments): Why unmanaged tools become a security and compliance problem. - [Healthtech compliance](https://www.kertos.io/en/blog/healthtech-compliance-made-simple-automating-security-in-regulated-industries): Automating security in regulated health environments. - [Data Privacy Day 2026](https://www.kertos.io/en/blog/data-privacy-and-protection-day-2026-seven-ideas-to-celebrate-and-make-it-count): Meeting the EDPB enforcement focus through genuine transparency. - [Kertos raises EUR 14M](https://www.kertos.io/en/blog/announcing-kertos-series-a-to-build-europes-compliance-desk): Series A funding to build Europe's compliance desk. - [Kertos achieves ISO 42001 certification](https://www.kertos.io/en/blog/kertos-achieves-iso-42001-certification-setting-a-standard-for-governed-ai-systems): Kertos's own AI governance certification. - [Kertos and Axipro partnership](https://www.kertos.io/en/blog/kertos-and-axipro): Combining the platform with implementation and advisory expertise. - [Kertos co-financed by the European Union](https://www.kertos.io/en/blog/kertos-kofinanziert-von-der-europaischen-union): EU funding under the EUPROFIT project. - [Kertos and Aikido integration](https://www.kertos.io/en/blog/kertos-aikido-integration): Vulnerability findings from Aikido flow into Kertos as evidence for ISO 27001, SOC 2 and NIS2. - [Kertos in the Sifted 100 DACH & CEE 2026](https://www.kertos.io/en/blog/eu-lead-compliance-automation): Kertos's announcement of its position in Sifted's growth ranking. - [Kertos alternatives](https://www.kertos.io/en/blog/kertos-alternatives): Four vendor categories and seven selection criteria for comparing compliance platforms. - [Privacy Policy](https://www.kertos.io/en/data-privacy-policy) - [Imprint](https://www.kertos.io/en/imprint)