Automation collects evidence, drafts policies and monitors controls. Security leads review in several rounds and sign every report. Fractional pricing, self-service from the first check.
Free, no sign-up. Public DNS queries run from your browser over 1.1.1.1; nothing is stored. Try or
Compliance systems built and localised for teams across Asia-Pacific
ISO 27001, ISO 9001 and sector audits
Stage 2 without a major nonconformity
Across the six markets below
AU · NZ · HK · SG · MY · VN
A human-augmented system: software carries the volume, accountable people make the calls.
Every control is assumed to fail until it passes machine checks, a peer reviewer, an internal bounty round and the security lead.
Automation drafts and checks. A security lead decides and signs.
named owner per engagementReviewers are paid for each gap they find before the certification body does.
paid per verified findingPersonal-data flows between your markets are checked against each market’s transfer rules.
APP 8 · IPP 12 · s. 26 · s. 129 · Decree 356International frameworks, plus one manager per market who knows the local conditions in your vertical.
AU · NZ · HK · SG · MY · VNSenior compliance and security expertise for a fraction of a full-time team.
fixed fee, no per-seat pricingCheck a domain, connect read-only, see your gaps and a quote. A sales call is optional.
first result in secondsMost companies arrive at one of three points. The work differs, so does the engagement.
20–80 people. Nobody owns compliance. A customer contract now asks for ISO 27001.
Certified once. Now a second market, a privacy law, SOC 2 for a US buyer and a stream of questionnaires.
Financial services, health or data at scale. A regulator’s rule sits on top of ISO 27001.
Every model call runs inside a harness that scopes it to one engagement, logs it and refuses anything outside scope. The harness runs under the same ISO 27001 controls we assess you against.
Five workstreams, each with something you can hand to an auditor or a customer. Examples below are sample outputs.
Read-only connectors pull configuration from your workspace, code and cloud every day. Each item is timestamped and filed against its control.
Drafted from how your systems are actually set up, then reviewed and signed by the security lead. Exceptions become tracked risks, not footnotes.
5. Authentication
5.1 Multi-factor authentication is required for every workforce account. Today 48 of 50 accounts comply; the 2 exceptions are tracked as RSK-014 with an owner and a due date.
5.2 Administrator accounts are separate from daily-use accounts.
Maps to A.5.17, A.8.5 · Evidence E-0213, E-0214
A personal-data inventory built from your systems, the impact assessments each market requires, and a transfer check for every cross-border flow.
| Customer profiles | VN → SG | Transfer assessment |
| Payroll | VN → VN | Impact assessment |
| Support tickets | AU → VN | APP 8 contract |
| Marketing leads | MY → SG | s. 129 checked |
Controls are checked daily. When one drifts, an owner gets a task with the evidence attached, and the lead sees it before the auditor does.
A public page with your scope, certificate and monitored controls, and answers to customer security questionnaires drawn from the same evidence.
Is customer data encrypted at rest?
Yes. Production databases on AWS RDS use encryption at rest with keys managed in AWS KMS.
evidence E-0412 · A.8.24approved by security lead
Built by a team that has localised compliance systems in Australia, New Zealand, Hong Kong, Singapore, Malaysia and Vietnam. One evidence base on ISO/IEC 27001:2022, mapped to each market’s privacy law.
| Market | Privacy law | Security | satna |
|---|---|---|---|
| Australia | Privacy Act 1988 | APP 11 | Mapped |
| New Zealand | Privacy Act 2020 | IPP 5 | Mapped |
| Hong Kong | PDPO | DPP 4 | Mapped |
| Singapore | PDPA 2012 | s. 24 | Mapped |
| Malaysia | PDPA 2010 | s. 9 | Mapped |
| Vietnam | Law 91/2025, Decree 356/2025 | Impact and transfer assessments | Mapped + dossiers |
Certification: ISO/IEC 27001:2022. Add-ons: ISO/IEC 27701, ISO/IEC 42001, SOC 2 through a licensed CPA firm.
| Market | Regulator | Rule |
|---|---|---|
| Australia | APRA | CPS 234 Information Security |
| New Zealand | RBNZ | Guidance on cyber resilience |
| Hong Kong | HKMA | Cyber Resilience Assessment Framework |
| Singapore | MAS | Technology Risk Management Guidelines |
| Malaysia | BNM | Risk Management in Technology (RMiT) |
| Vietnam | SBV | Circular 09/2020/TT-NHNN |
An ISO 27001 certificate is valid for three years with an annual surveillance audit. An accredited certification body audits and issues it.
Target share of work done by the platform on a 20–50 person engagement. A security lead owns every line that goes to an auditor or a customer.
| Workstream | Platform | Security lead | Target | |
|---|---|---|---|---|
| Technical evidence | Pulled by API: accounts, MFA, access, backups, encryption, repositories | Exceptions | 90% | |
| Security questionnaires | Answered from the evidence base | Approve before sending | 85% | |
| Policies, SoA, risk register | Drafted from live system configuration | Review, sign | 80% | |
| Privacy dossiers | Personal-data inventory, impact assessment templates | Legal review | 60% | |
| Vulnerability scan, pentest | Scans within the authorised scope | Validate findings, sign report | 60% | |
| Internal audit | Evidence sampling, draft report | Interviews, conclusions | 50% |
Fixed price by headcount and number of systems, quoted after the assessment. Certification body fees are paid to the certification body directly.
Compliance software gives you a tool. A traditional consultancy gives you documents. satna gives you the certificate and keeps it current.
| satna | Compliance platform | Traditional consultancy | |
|---|---|---|---|
| Who does the work | Platform plus a named security lead | Your team, using the software | Consultants, by hand |
| What you buy | Certificate-ready, audit coordinated | Annual software licence | Policies and a project |
| Local privacy law | Six markets mapped, Vietnam dossiers prepared | Depends on the framework library | Depends on the consultant |
| Pricing | Fixed fee, fractional | Per framework, usually in USD | Day rates |
| Sign-off | Security lead signs every report | Your team signs | Consultant signs |
| After the certificate | Daily monitoring, surveillance prep | Daily monitoring | New engagement each year |
| Your data | Stays in your tenant | Copied into the vendor’s platform | Shared by email and drives |
satna is taking a small number of design partners across the six markets before general availability.
Not answered here? Write to hello@byciti.dev.
An accredited certification body audits you and issues the certificate. satna prepares you, runs the internal audit and coordinates the certification audit. You choose the body from at least three quotes.
It depends on scope and on what is already in place. ISO 27001 requires the management system to run long enough to produce evidence, including one internal audit and one management review, before the Stage 2 audit. You get a dated plan after the free assessment.
A fixed fee by headcount and number of systems, quoted after the assessment. Certification body fees are separate and paid to the certification body directly.
Connectors are read-only. Evidence is filed in your own Google Drive, SharePoint or Lark. Model calls run inside a scoped, logged harness, and client data is not used for training.
Minor findings are fixed within the deadline the certification body sets. Remediation support is part of the Implement package.
Yes, as an add-on. A licensed CPA firm performs the SOC 2 examination; satna prepares the evidence and reuses your ISO 27001 controls.
Yes, in the Monitor package. Answers are drawn from your evidence base and approved by the security lead before they are sent.
Google Workspace, Microsoft 365, Lark, GitHub, AWS and Google Cloud today. Design partners decide which come next.
mission
Beyond systems of record: systems that reason over your evidence and surface the business risks that matter.
Book a full assessment. Reply within one business day.
Or email hello@byciti.dev