Run the stack
Managed Compliance
We operate the platforms that hold your audit trail — ISMS, e-signature, sovereign cloud — and the individual systems your team relies on day-to-day. Service desk included. Live compliance through ProcesOS.
- 01
ISMS & Compliance Tooling
Day-2 operations of the platforms that hold your audit trail — Hyperproof, Vanta, Drata, or a custom ISMS stack. We map your controls, collect evidence, and prepare reviews.
- Control mapping (ISO 27001, SOC 2, BSI Grundschutz, TISAX, NIS2)
- Evidence collection workflows + reviewer assignment
- Audit preparation and external auditor liaison
- Risk register lifecycle and quarterly board reporting
- 02
E-signature & Document Workflow
We run your Docusign tenancy — and the surrounding ecosystem. Templates that survive legal review, connectors that hold under load, and lifecycle governance that ages well.
- Tenant administration and user lifecycle
- Template + workflow engineering, multi-party signing flows
- API/connector integrations (Salesforce, M365, custom systems)
- Quarterly compliance audits and retention policy enforcement
- 03
Sovereign Cloud Operations
Managed operations for sovereign cloud (Open Telekom, STACKIT, Plus Server) and standard hyperscalers under data-residency constraints. Infrastructure-as-code throughout.
- Landing-zone design with sovereignty constraints baked in
- IaC with Terraform/Bicep, GitOps pipelines
- Patch, backup, and disaster-recovery management
- Cost monitoring and FinOps reporting
- 04
Integration & Service Desk
We also run individual systems end-to-end — integrations, service desk, second-level support. From Microsoft 365 to Salesforce to that one legacy tool that nobody else understands.
- System integration design and operation (APIs, iPaaS, custom middleware)
- Service desk with named owners and EU-time-zone coverage
- Second- and third-level support with vendor escalation handling
- Single point of contact across heterogeneous tool landscapes
Process-Based Compliance
One process. Hundreds of perspectives.
Traditional GRC tools sit next to the work and ask for evidence after the fact. Process-based compliance turns it inside out: every compliance framework becomes a scoring perspective on the same process model. GDPR, ISO 27001, NIS2 — they are not separate systems. They are lenses on the BPMN diagram you already have. Switch the perspective, see the score, optimise toward the target.
Live Compliance
Compliance that lives in the process — not next to it
GDPR, NIS2, DORA and ISO 27001 are not a second system. They are a view of the process model you already have. Every validation recomputes the score. Every change is visible.
One process, many perspectives
Auditor, owner, contributor — same diagram, different lens
Lane-based role governance: Responsible decides, Contributor proposes, Viewer observes. The auditor sees the same BPMN as the team that runs the process. No more reconciliation between BPM tool and ISMS tool.
Map once, improve forever
One BPMN feeds compliance, audit, training, automation
Every validated AS-IS version is frozen. Every SHOULD-BE fork is simulated with cost and compliance deltas before it ships. Stakeholders vote. The decision trail is immutable. Audit-ready by default.
Compliance Perspectives
Optimise toward any target
Every process in ProcesOS can be scored against any compliance or policy framework. The score is not self-assessed — it is computed from process data: task annotations, lane assignments, IT dependencies, stakeholder coverage. Switch the perspective, see where you stand, simulate the changes that close the gap.
- 01
GDPR / DSGVO
Data processing flows, controller/processor mapping, consent management, retention policies — scored per process path.
- 02
ISO 27001
Control mapping to process tasks, risk treatment per lane, asset classification via CMDB integration, evidence auto-collection.
- 03
NIS2
Critical infrastructure dependencies, incident response readiness, supply chain governance across pools.
- 04
DORA
ICT risk management, third-party dependencies, operational resilience testing mapped to process simulations.
- 05
BSI Grundschutz
Bausteine mapped to tasks, Schutzbedarfsfeststellung per lane, cross-reference with IT system catalogue.
- 06
ESG / SDG
Environmental footprint per system, social inclusion through stakeholder participation, governance completeness scores.
New frameworks are added as scoring templates — not as new tools. The process model stays the same. Only the lens changes.
End-to-end. Data-driven. For the first time.
ISMS + Governance + Audit + Iteration — in one model
Traditional approaches treat these as separate disciplines with separate tools, separate teams, and separate timelines. Process-based compliance unifies them: the BPMN model is simultaneously the ISMS documentation, the governance structure, the audit basis, and the iteration driver.
This is not integration between tools. This is one model that serves all four functions — because all four are perspectives on the same reality: how work actually happens, who is responsible, and what it costs.
-
ISMS
The Information Security Management System is not a separate tool — it is the security perspective on the same process model. Controls map to tasks. Risk maps to lanes. Evidence is generated by normal governance operations.
-
Governance
Stakeholder roles, voting protocols, and decision trails are not governance theatre — they are the mechanism that makes compliance verifiable. Every policy decision has a name, a vote, and a quantified impact.
-
Audit Basis
The audit trail is not assembled before the audit. It exists continuously: immutable decision records, frozen process versions, timestamped stakeholder validations. Audits become a query, not a project.
-
Iteration Driver
Compliance is not a checkbox — it is an optimisation target. Every SHOULD-BE simulation shows the compliance delta alongside cost and time. You can literally simulate your way to certification readiness.
What makes this different: Every compliance score, every audit artefact, every governance decision is computed from process data — not from manually maintained documentation. When the process changes, the compliance posture updates. When the compliance target changes, the gap analysis runs against real data. This is the first time compliance is completely data-driven and end-to-end.
How we engage
Onboarding: We start with a discovery workshop. Current state, ownership, escalation paths, and SLA definition per track — documented, signed, in your hands. The process gets mapped in BPMN. The compliance view follows automatically.
Run-phase: Tickets, incidents, and service requests flow through our service desk. Reporting through ProcesOS. You see what we do, when we do it, and how it affects your compliance posture — in your timezone.
Continuous improvement: Every change becomes a SHOULD-BE fork with simulated cost, risk, and compliance deltas. Quarterly service reviews with backlog prioritisation. We surface improvements — you vote on what ships.
Talk to us about a managed engagement
Tell us which platforms you operate today. We come back with a proposal for a discovery call.