Free Compliance GapAssessment

Yes. The assessment and your on-screen score are free with no signup. The detailed gap report is also free, and asks for your email so we can send it to you. There is no credit card and no sales call.

Your answers are stored so your score and report can be generated, and so you can resume an unfinished assessment. We do not sell your data. If you give us your email for the report, we may send you occasional compliance insights, and you can unsubscribe at any time.

Not to take the assessment or to see your score and domain heatmap. Only the detailed gap report is sent by email.

Shubham Raut, an ISO 27001:2022 and ISO 42001:2023 Lead Auditor certified by BSI, who has implemented these frameworks for international clients. The question set is the same assessment used in the first week of a consulting engagement.

No. Certification against ISO 27001 requires an accredited certification body, and a SOC 2 report requires a licensed CPA firm. This assessment does not certify you and does not replace either. It tells you where you stand before you start that process.

It is as accurate as your answers. We ask what you have implemented and documented, and you tell us. We never see your systems, your policies, or your evidence, so nothing here is verified. That is the difference between a self-assessment and an audit, and it is why the report shows you what to fix rather than certifying that you fixed it.

You can share it as what it is: a self-assessed maturity score, not a certification or an audit result. Presenting it as anything more will cause you problems the first time someone asks for the evidence behind it.

It is built for startups and scaling B2B SaaS teams, especially AI companies, that do not yet have a dedicated compliance function. If you already run a GRC team on a compliance platform, or what you need is a certificate rather than a diagnosis, this will not tell you much you do not already know.

It depends on how many frameworks you select. Each framework shows its own estimate on the selection screen before you start.

Yes. Select as many as you want. These frameworks overlap heavily, so where two of them ask for the same thing, we ask you once and apply your answer to each framework's score.

No. Your progress is saved as you go, and you can close the tab and resume from where you stopped.

Every question has an "I don't know" option. It scores as zero, and the report flags it separately as something nobody in the company could answer, which is itself useful to know.

Mark it "Not applicable" and it is excluded from your score entirely rather than counted against you. The assessment also skips questions that your company profile shows are not relevant to you.

Start with whichever one someone is actually asking you for. If a customer sent a security questionnaire, start with ISO 27001 or SOC 2. If you build with AI and sell in Europe, start with the EU AI Act. If nobody has asked yet and you want a baseline, ISO 27001 is the most widely recognised starting point.

ISO 27001 is an international certification standard for how you run security as a management system, awarded by a certification body. SOC 2 is an attestation report written by a CPA firm about whether your controls operated over a period of time. Buyers in Europe and Asia tend to ask for ISO 27001, buyers in North America tend to ask for SOC 2, and they overlap heavily.

It can. The obligations follow where your AI system is used and who it affects, not only where your company is registered. If you have users or customers in the EU, it is worth checking rather than assuming.

Almost certainly not. Most companies need one or two, driven by what their customers and regulators ask for. Selecting more frameworks gives you a wider picture, not a better score.

Your score by framework, a domain heatmap of strong and weak areas, a control by control gap list naming the specific control or article each gap breaks, the cross framework overlap analysis, and a prioritised remediation roadmap.

The free report tells you what to fix. The Remediation Kit gives you the material to fix it: a step by step playbook, pre-populated policy templates, an evidence collection checklist, and an implementation timeline. The Implementation Sprint is hands on work with you over several weeks. See the pricing section above for what is currently available.

You will get your report, and occasional compliance insights if you consented. You can unsubscribe from any of it. There is no automated sales sequence that starts the moment you download a report.

Yes, and it is worth doing once you have closed some gaps, so you can see what moved.