Questions and answers

A security and compliance workspace for companies that must meet NIS2 and similar rules, and for suppliers whose customers ask about security. Risks, controls, incidents, evidence, policies, suppliers and reports live in one place, with a readiness score per measure.

The free NIS2 check answers that in about a minute, without an account. It follows the size thresholds and sectors of the directive; national laws can add more, so check with your national authority when in doubt.

NIS2 (Article 21 measures and Regulation 2024/2690), ISO 27001 Annex A with the Statement of Applicability, DORA, the Cyber Resilience Act, ISO 22301, TISAX, SOC 2 and Spain's ENS, plus registers for the EU AI Act and GDPR.

No. Every control is explained in plain words, the setup wizard picks the controls that fit your company, and each screen has its own help next to it.

Yes. Import the customer's Excel questionnaire: questions are matched to your approved answer library, you review the result and write the answers back into the customer's file.

Sign-in with a password, passkey, two-step code or your company login. Organization owners can require two-step sign-in, company login only and allowed networks. Secrets are stored sealed, every change is recorded in the audit log, and full backups of the database are kept.

Only the members of your organization, with the rights of their role. Owners decide who joins and what each role may do.

No. Visitor statistics and error reports run on our own system, without outside analytics or advertising services. Measurement cookies are only set after you accept them.

In the European Union. Today the application and its database run on servers in Spain; with our planned move to Amazon Web Services they will run in the AWS region Frankfurt, Germany (eu-central-1), with encrypted backup copies in Ireland (eu-west-1). Files, email delivery and encrypted backup copies already use Amazon Web Services in the European Union.

No. We never use your data to train AI. AI features are optional and each organization can switch them off; when they are on, the text goes only to the AI provider chosen in CloudSignLab, to produce the reply.

Your organization's data is kept while the organization uses CloudSignLab and is deleted when the organization is deleted; your account data is removed when you delete your account. Security logs are kept for up to 365 days, encrypted backup copies are deleted after 35 days, and invoices are kept for six years as Spanish commercial law requires. All details are in our Privacy Policy.

Yes. One account can own or join several organizations, and consultancies see all their clients in one portfolio view. How many organizations you pay for depends on your package.

Owners and admins invite people by email from Members. The invitation is valid for 48 hours; people who join see only what their role allows.

Yes, with company login (single sign-on) using the OIDC or SAML standard, which identity providers such as Microsoft Entra ID, Okta and Google Workspace offer, for email domains you have verified. The packages that include it are shown on the pricing page.

Yes. The Free package has no time limit and needs no credit card, so you can see your readiness score before you decide.

Yes. On Pricing, click Build your package: start from the base at €49 a month (1 organization, 5 people, NIS2 and the registers) and add only the frameworks and modules you need. The price updates as you choose, and the builder says when a fixed package is cheaper.

Yes, on Supplier Ready, Professional and Business: in Billing, add for example BSI IT-Grundschutz or Supplier checks to your package. It is billed with your package for the rest of the period, and removing it keeps everything you saved.