Security & Compliance
Answer Security Questions With Confidence
The security basics your MVP needs before real users arrive, evidence for the questionnaires larger customers send, and a plan for what to do when something goes wrong, sized for a small team and the stage you are at.
What you get at each stage
Sized to where your product is now, and built so the next stage adds to it rather than starting again.
Idea & validation
Get the basics right before you have much to lose
- Multi-factor authentication on email, cloud and admin accounts
- A password manager, and no shared logins in chat or spreadsheets
- Backups you have actually restored from
- A privacy notice and a simple record of the personal data you hold
MVP & launch
Show early customers you take security seriously
- Cyber Essentials readiness and gap fixes
- Answers and evidence for enterprise security questionnaires
- A penetration test of your web app and APIs
- An incident response plan with named roles
Growth & scale
Build towards the frameworks larger buyers expect
- Readiness work towards ISO 27001 or SOC 2
- Supplier and SaaS risk reviews
- Security monitoring and regular access reviews
- Tabletop exercises for the leadership team
What is included
Cyber Essentials readiness
Gap analysis against the five controls and the fixes, ready for assessment by an independent certification body.
Security questionnaires
Honest, consistent answers to enterprise customers’ questionnaires, backed by policies and evidence you hold.
Framework readiness
Scoping, gap analysis and a plan towards ISO 27001 or SOC 2, ahead of the audit by an independent auditor.
Penetration testing
Authorised, scoped testing of your web app, APIs and cloud set-up, with a retest after fixes.
UK GDPR basics
Security measures for personal data, a breach procedure and policies that match how you actually work.
Incident response plan
Who decides what in the first hour, who to notify, and how to report a breach on time.
Everything in Security & Compliance
11 services. Take one or combine several: we size each to your stage and agree the scope and a fixed price before work starts.
Security services
- Security assessmentA review of your product and accounts, and where you are exposed.
- Penetration testingYour web app, APIs and cloud set-up tested by simulating real attacks.
- Security implementationProtections put in place for your systems and data.
- Data protection complianceHelp meeting UK GDPR and the Data Protection Act 2018.
- Security trainingYour team trained to spot and stop common threats.
- Incident response planningA tested plan for what to do if something goes wrong.
- Security monitoringOngoing watch for threats to your systems.
- Risk managementSecurity risks identified, assessed and reduced.
Security strategy
- Cyber Essentials readinessGap analysis and fixes ahead of assessment by an independent certification body.
- Security questionnairesHonest, consistent answers to the questionnaires enterprise customers send.
- Security roadmapA staged plan towards the standards your customers expect.
Scope it free, then build it
Your MVP brief is the brief
The brief you write in the free MVP builder is what we quote from. It tells us who the product is for, the Must-have features, the main journeys and the budget, so work on Security & Compliance starts from your brief, not a blank page. It fits these stages:
In your brief
The sections it builds on
- Build approach
- Launch plan
For established companies
New products and ventures, scoped first
Established companies use the same service to meet a new customer or contract requirement for Cyber Essentials, review the suppliers and SaaS tools that can reach their data, test their defences with a penetration test, or rehearse an incident with the leadership team before a real one happens.
Tell us about your projectQuestions founders ask
Do we need Cyber Essentials?
If you sell to the public sector or to larger companies, you may be asked for it. Even if nobody asks, its five controls are the NCSC’s baseline against the most common internet attacks. We prepare you and fix the gaps; the assessment itself is carried out by an independent certification body.
Can you get us ISO 27001 or SOC 2?
We do the readiness work: scoping, gap analysis, policies, controls and the evidence an auditor will ask for. The certificate or report itself comes from an independent auditor, and which framework is worth pursuing depends on what your customers ask for.
What should we do in the first hour of an incident?
Contain it by disconnecting affected devices and resetting compromised accounts, keep evidence rather than wiping machines, and call whoever leads your response. If personal data is involved, start your breach assessment straight away: a notifiable breach must be reported to the regulator within 72 hours.
Who does the security work?
Our own team. We scope the work with you, keep it tied to your launch, sales and fundraising plans, and work alongside the people building your product: one brief and one point of contact.