ISO 27001 for teams of 10–150 · EU-first
ISO 27001, minus the consultancy.
The management system behind certification — scoped in minutes, run as software, proven with records your auditor can verify. Flat-priced, self-serve, no sales call anywhere in the building.
€249/mo flat, excl. VAT · no card to start · cancel in-app anytime
Don't take our word for it — scope yourself
This is the product's actual scoping engine, running in your browser. Your answers stay on this page — nothing is sent anywhere.
How many people are in the organization?
Question 1 of 7
A system of record, not a pile of templates
Everything an auditor will ask about lives in one place, versioned and connected — and the product always knows what your next step is. These are real screens from a demo organization.
Today: your path to certification
Readiness at a glance, the road to certification as an ordered checklist, and the operational numbers that slip — overdue tasks, expiring evidence, open corrective actions — before they become audit findings.
The SoA as a living document
All 93 controls with applicability, implementation status, and drafted justifications — reviewed control by control, exported as a hash-stamped PDF the moment your auditor asks.
Three steps to audit-ready
Scope in minutes
Answer seven questions. Watch your Statement of Applicability build itself across all 93 controls.
Run the ISMS
Generated policies, a starter risk register, and a compliance calendar — editable, versioned, approved.
Prove it
Hash-stamped, tamper-evident PDFs and a one-click export your auditor understands instantly.
Why auditors relax when they see it
Records nobody can quietly rewrite. Including us.
Every material change in StandardOS is appended to a hash chain — each record sealed with the fingerprint of the one before it, the chain head anchored daily to write-once storage. Backdate or edit history and the chain breaks, visibly. Your exports carry the hashes, so your auditor can verify integrity independently. No other tool in this market offers that.
append-only · sha-256 chained · anchored daily · verifiable in your exports
One price. No sales call.
€249/mo · excl. VAT
Flat, per organization. Every feature. Unlimited people.
- All 93 ISO 27001:2022 controls + SoA
- Policy pack, risk register, compliance calendar
- Tamper-evident records & one-click export
- Month-to-month · cancel in-app anytime
No card required to start · reminder email before any charge · cancellation policy
Sold to businesses and organizations only.
Questions a careful buyer asks
Do I need a card to start?
No. The 14-day trial starts without payment details and simply expires if you do nothing. If you do subscribe, we email you a reminder 7 days before your trial converts, with a one-click way to cancel.
Is this consulting? Will someone call me?
No and no. StandardOS is software: the management system itself, with drafts generated for you to confirm. There is no sales team to call you — support is email, answered by a founder within one business day.
Where is our data stored?
In the European Union (Frankfurt). StandardOS is operated by a Danish company under the GDPR, with a DPA available to every customer — details on the Trust page.
What if we want to leave?
Export everything, in open formats, with one click — during the trial, while subscribed, and for 90 days after cancelling. Cancellation itself is one click in Billing, effective end of the period.
Does StandardOS guarantee certification?
No tool can — certification is an accredited auditor's judgment of how your organization actually operates. What StandardOS does is make the system you'll be audited on: complete, consistent, and backed by records your auditor can verify.
Which standards are supported?
ISO/IEC 27001:2022 today, end to end. The spine — documents, risks, audits, reviews, corrective actions — is shared by every Annex SL ISO standard, and further standard packs are on the roadmap.
Your auditor's first question is "show me your SoA."
Have a defensible draft before your coffee is cold — and the system to keep it true after.