Every framework you adopt, run from one system.

No. The 14-day trial starts without payment details, and there is no auto-charge when it ends. A subscription begins only when you go through checkout yourself. We email you three days before the trial ends so the date is never a surprise. If you do nothing, the workspace becomes read-only when the trial ends: nothing is deleted, and you can still sign in, read everything and export it all.

It is software rather than consulting: the management system itself, with drafts generated for you to confirm. That does not mean you are on your own with it. Every screen explains what the clause behind it actually asks for, in plain language, and support is email, answered within one business day by the people who build the product. There is no sales team, and nobody will call you.

It depends where your customers are, and it is worth checking rather than assuming. In EU public procurement it is not close: over the last 365 days ISO 27001 appears in 3,405 tender notices on TED, the EU's own procurement portal, against 104 for SOC 2, about 32.7 times more often. Counting every spelling of both, on 12 September 2026, and TED's search API is public so you can run it yourself. Those are mentions rather than requirements, and the ratio compares like with like. If you sell mainly to US companies the argument runs the other way: SOC 2 is the shape their procurement expects, and we do not do SOC 2.

Our €249/mo, plus an accredited certification body's audit fee, which is a separate company you pay directly. Nobody in this market publishes that fee, but it is auditor days × day rate and the days are fixed by ISO/IEC 27006, so you can work it out in advance. For a 25-person company it is roughly €8,000–€13,000 for initial certification and about a third of that annually after.

Email us, and a person who built the product answers within one business day. That is included in the price, not an add-on. Every screen also explains what the clause behind it actually asks for, in plain language, so most questions answer themselves before they reach us.

Four to seven months is realistic for a small software company. About three months is the floor no tool can beat: your internal audit and management review have to have actually happened before Stage 2, because the auditor samples those records. What software removes is the two-to-six months of building the system beforehand.

No, and the reason is not a missing feature. All 93 Annex A controls get a Statement of Applicability entry with a justification, and every one of the 26 management-system clauses in 4 to 10 has a place in the product. What no software can do is be the evidence: clause 5.1 is leadership demonstrating commitment, and every record still has to be something you actually wrote and meant. We print the clause-by-clause list before you pay, which most tools in this market do not.

ISO/IEC 27001:2022 and ISO/IEC 42001:2023, the AI management system standard, with all 38 of its Annex A controls. Clauses 4 to 10 are the identical harmonised structure in every modern ISO standard: the same documents, risks, audits, reviews and corrective actions. So the machinery that runs one runs the other, and a record you keep for one counts towards both. We publish the clause-by-clause coverage for both before you pay.

You write to us and we look at it with you, within one business day. The product shows you what an auditor will sample before they arrive: overdue reviews, expired evidence, controls with nothing behind them. If the record is wrong, you fix the record; if the product is wrong, we fix the product. What we cannot do is sit in the audit for you or promise its outcome: certification is the auditor's judgment of how you actually operate.

In the European Union (Ireland), whichever country you are in. StandardOS is operated by a Danish company under the GDPR, so EU privacy law protects your records by default rather than by contract, wherever you are. Our Article 28 data processing agreement is published in full at /legal/dpa for every customer, with no signature and no sales call, and the Trust page lists every subprocessor and where each one processes data.

Yes. ISO/IEC 27001 and ISO/IEC 42001 are international standards, audited to the same requirements by accredited bodies in every country, and the management system StandardOS builds is the standard's own, not a regional interpretation of it. The EU material you will see around this site is included on top: GDPR Article 30 processing records, Cyber Resilience Act Article 14 incident reporting, NIS2, and the EU AI Act position in the ISO 42001 templates. If those reach you, they are already there; if they do not, you can ignore them and nothing about the certification changes. Your certification body is local to you, and subscriptions are billed in euros.

Export everything, in open formats, with one click, during the trial, while subscribed, and for 90 days after cancelling. Cancellation itself is one click in Billing, effective end of the period.

No tool can. Certification is an accredited auditor's judgment of how your organization actually operates. What StandardOS does is make the system you'll be audited on: complete, consistent, and backed by records your auditor can verify.