01
The security review is holding the contract
Procurement sent a 200 question spreadsheet and asked for a SOC 2 report you do not have yet. The deal is not lost, it is parked, and it stays parked until someone can show evidence rather than intent.
For startups
Your first SOC 2, and the AI questions that come right after it.
Enterprise buyers stopped asking whether you have a security programme. They ask for the report, the questionnaire, and now a straight answer about what your models do with their data. NorthIron gets a small team through all three without a security hire.
One control set behind every framework, so your second certification is not a second project.
Evidence pulled from your cloud accounts and repositories, not chased over Slack.
ISO 42001 and AI risk built into the same control model, not sold as a separate module.
Teams shipping to enterprise buyers
- 144
- Atomic controls, mapped from 966 source controls
- 93 of 93
- ISO 27001 Annex A controls covered
- 117
- Evidence artefacts mapped and templated
- 6
- Frameworks on one control model
01 /Frameworks
Six frameworks. One control set.
Most platforms count frameworks the way airlines count destinations. The number that matters is how much work carries over when you add the second one. NorthIron maps every framework down to the same atomic controls, so the evidence you collected for SOC 2 already satisfies most of ISO 27001, and the policy you approved once stays approved everywhere.
SOC 2
Type I and Type II
ISO 27001
Information security
ISO 42001
AI management systems
HIPAA
Health information safeguards
GDPR
EU personal data
DPDP
India digital personal data
02 /The problem
Three things that stall a startup's first enterprise deal.
02
Nobody on the team owns security
Your engineers can answer the technical questions. What they cannot do is write an access control policy, run an access review, keep the risk register current, and still ship the roadmap. Compliance work does not fail because it is hard. It fails because it is nobody's job.
03
You ship AI features, so the questionnaire got longer
Buyers now ask which models you use, what data reaches them, whether outputs are reviewed, and who is accountable when the model is wrong. Very few early teams have written any of that down. The ones who have are closing faster.
03 /How it works
From scoping call to audit ready.
01
Scope
We agree what is in scope: entities, environments, applications, and which framework the buyer actually asked for. Getting this wrong is the single most expensive mistake in a first audit, so we do it before you touch the platform.
02
Connect
Link your cloud accounts, identity provider, and code repositories. NorthIron reads configuration continuously across AWS, Azure and GCP, and checks your repositories for the supply chain gaps auditors ask about.
03
Implement
Start from the policy library and the pre-built risk register rather than a blank page. Every policy is already mapped to the controls it satisfies, so approving one closes work in several frameworks at once.
04
Prove it
The Evidence Vault holds what you collected, hashes and watermarks it, and gives your auditor a scoped, view-only link. Findings come back inside the platform, you respond in the same place, and nothing lives in a shared drive.
05
Audit
Your certification body or CPA firm is independent of NorthIron. We get you ready, coordinate the process, and stay out of the opinion. Anyone who offers to both prepare and certify you is selling you a document your buyer will discount.
04 /What you get
Everything your first compliance programme needs.
Every module feeds the same atomic-control model. Evidence, policies, risks, and technical checks move readiness forward without creating a second system for each framework.
01
One engine underneath every framework.
NorthIron pools weighted progress across every framework in scope. Partial control progress earns partial credit, while the exact missing evidence remains visible underneath the score.
- One live readiness number across enrolled frameworks
- Shared atomic controls show where work carries over
- Every score traces back to accepted evidence
02
Evidence collected once, reviewed before it counts.
Manual uploads, module references, and automatic checks meet in one evidence queue. AI flags gaps for review, but only a named person can accept evidence and change readiness.
- Manual, hybrid, and automatic collection
- Advisory AI gaps with a human acceptance gate
03
AWS and GitHub checks feed the same control set.
Connect cloud accounts and repositories, run checks, and work from the resulting findings. Passing checks and resolved gaps feed the same evidence and control model as manual work.
- Provider-aware connection and scan status
- Findings grouped by service, repository, and severity
04
Policy Management
Draft, review, publish, and version policies already mapped to controls. Send acknowledgements by magic link and keep the receipts beside the policy.
- Mapped controls
- Version history
- Acknowledgements
05
Risk Register
Work from a maintained risk library, assign owners and treatments, and track mitigation tasks through approval instead of leaving the register as a spreadsheet.
- Risk ownership
- Treatment plans
- Mitigation tasks
06
Vendor Risk
Assess vendors across attack surface, questionnaire responses, and supporting documents. The score rebalances when a pillar does not apply instead of treating missing data as failure.
- Attack surface
- Questionnaires
- Documents
05 /Proof
What early customers say.
Draft stories for layout review. Names, portraits and final customer quotes will be replaced after written approval.
Draft story
“NorthIron gives us one place to see which risks need attention, who owns the response and how each treatment connects back to our controls.”
Draft story
“Vendor assessments, documents and external findings sit together, so every review starts with context instead of another spreadsheet.”
Draft story
“The Evidence Vault makes the review path clear. Our team sees what is missing, while every acceptance still belongs to a named person.”
06 /FAQ
Questions before the first audit.
How long does a first SOC 2 take?
A Type I is typically achievable in 8 to 12 weeks from kickoff for a team of your size. Type II adds an observation period, usually three months at minimum, during which controls have to run and produce evidence. Anyone quoting you a two week SOC 2 is quoting you a readiness report, not an attestation.
Does NorthIron perform the audit?
No. The audit is performed by an independent CPA firm for SOC 2, or an accredited certification body for ISO. NorthIron prepares you, holds the evidence, and coordinates the process. That separation is what makes the report worth showing to a buyer.
Do we need to hire a security person first?
No. The platform assumes you do not have one. If you want a named person to run the programme with you, that is available as a service alongside the platform rather than bundled into it.
What does it cost?
The one-framework platform tier starts at $590 a month. Implementation, audit coordination, and the independent auditor's fees are quoted separately for your scope.
Where does our data live?
NorthIron is hosted in the AWS Mumbai region. Evidence and audit data stay in India, supporting teams that need a clear regional data-residency position for DPDP. Self-hosted deployment is on the roadmap for teams that cannot use a hosted platform.
We already use another compliance tool. Is migrating painful?
Bring your existing policies and evidence in and we map them to the control set rather than asking you to redo the work. Policies, risk registers and completed evidence transfer cleanly. Historical evidence for an observation period already underway does not, so plan a migration between audit cycles.
Next step
Find out whether we are the right fit.
Thirty minutes, a look at your actual scope, and a straight answer on timeline. If the framework your buyer asked for is not one we support well, we will tell you on the call.