Stage
Compliance for startups, without a compliance department
A security questionnaire is holding up your first enterprise deal, and nobody on the team owns this. Tidal gives you the structure of a compliance department: mapped controls, ready-made policies and evidence pulled from your own stack, without hiring for it.
The plan that fits this stage
Starting with ISO 9001, the GDPR or NIS2? Essential fits. Customers asking for ISO 27001 or SOC 2? Choose Professional.
Essential
Get audit-ready for your first certification such as ISO 9001, GDPR, or NIS2
€249/monthBilled annually
- 1 Essential framework
- Essential policy documents
- Monitor your compliance in Tidal
- 1:1 Onboarding
- Consultancy discount included
Professional
Prove security to enterprise customers with ISO 27001 or SOC 2
€499/monthBilled annually
- 2 frameworks (1x Pro, 1x Essential)
- All 30+ policy documents
- 350+ automated IT tests
- 1:1 Onboarding
- Consultancy discount included
These companies run their compliance on Tidal Control
Why Tidal fits this stage
You have no compliance team, but you do have a deal waiting on security questions. This is what bridges that gap.
Start with one framework, not all of them
If ISO 27001 is still a step too far, you start with ISO 9001, the GDPR or NIS2. The standard already comes translated into concrete tasks with an owner, so you never start from a blank page, and you expand later without starting over.
Policies that already exist, instead of an empty document
Ready-made, editable policies that already cover what the standard asks for. You adapt them to how you actually work, rather than writing them from scratch or copying another company's.
Evidence from the tools you already use
Connect Entra ID, Google Workspace, AWS or GitHub and Tidal pulls the evidence out itself. For a team that wants to spend every hour on the product, that is the difference between keeping this up between audits and not.
Show prospects how your security is organised
Every enterprise deal comes with security questions. Your trust center shares your policies, controls and certificates with prospects, so your founder or tech lead does not start from scratch for every questionnaire.
Where startups usually begin
Three routes, depending on what your customers ask for.
- ISO 9001
- Quality management, often the first standard a client asks about
- More about ISO 9001
- GDPR
- If you process personal data this is an obligation, not a choice
- More about GDPR
- ISO 27001
- The standard enterprise customers and tenders require
- More about ISO 27001
- All frameworks
- See which standards Tidal supports
- View all frameworks
Frequently asked questions
Yes, and that is exactly what this stage is set up for. The standard arrives translated into tasks, the policies are ready and the evidence comes from your integrations. What is left is deciding how you work, and the 1:1 onboarding helps with that. If you get stuck, you bring in a consultant for the part where you need one.
Sometimes it is. If your customers are not asking for it yet, start with ISO 9001, the GDPR or NIS2 and build the management system you will reuse for ISO 27001 later. Evidence you assign once counts for every standard the same control appears in.
A substantiated overview of your controls and a trust center to share are there during the journey. The certificate itself comes at the end: across our customers the median is 13 weeks from kickoff to certificate. You do not have to wait for it to move a deal forward.
The Essential licence is the starting point: one framework of your choice, the essential policies and 1:1 onboarding. The pricing page sets out what is included and when it makes sense to move up.