Toronto based · 12 frameworks · data held in your own country
Compliance services in Canada for any size, any industry, any framework
One control library. One named compliance manager. Twelve frameworks. Nank.ai runs your SOC 2, ISO 27001 or ISO 42001 program from Toronto, and your data stays in your own country.
- ISO 27001
- SOC 2
- ISO 42001
- ISO 27701
- HIPAA
- GDPR
- PCI DSS
- NIST CSF
- NIST 800-53
- CSA CCM
- CMMC
- FedRAMP
12
Frameworks from one control library
5
Lifecycle phases covered end to end
3 mo
Typical time to audit-ready
Canada
Data held in your own country
The model
What Compliance as a Service means
Most compliance vendors sell software and leave the work to you. Nank.ai operates the program instead. You are not buying a dashboard to fill in. You are buying a program that runs.
A first SOC 2 report or ISO 27001 certificate forces one of two expensive choices. Hire a compliance lead your deal flow does not yet pay for. Or pull engineers off the roadmap for months of policy writing and screenshot chasing. Meanwhile the deal that triggered the requirement sits and waits.
1
A named compliance manager
One expert owns your program. That person scopes the work, builds the plan, manages the auditor and answers the questions your team cannot. Not a support queue.
2
AI agents that carry the repetitive work
Mapping controls to framework requirements, drafting policies from your own context, running risk assessments, and gathering and checking evidence on a schedule.
3
A platform that holds it together
One control library, plus policy management, evidence collection, continuous monitoring, asset registers, audit workspaces, integrations and reporting. Nothing lives in a spreadsheet only one person understands.
What we do not do
We prepare and run your program. We do not issue your report or your certificate. A licensed CPA firm issues a SOC 2 report. An accredited certification body issues an ISO 27001 certificate. Nank.ai gets you ready for both, runs the audit workspace and manages the relationship. Any provider claiming to hand you the certificate itself is describing something that does not exist.
Solutions by company size
The framework does not change with headcount. The cost driver does.
Each of these pages makes a different argument, because the problem is different at each stage.
Startups
Your scope is small, so do not overspend. Get the first certificate without buying an enterprise program you will not use.
Small and medium businesses
You do not overpay for compliance. You pay three times for the same control. Map it once and the second framework costs a fraction of the first.
Enterprise
Governance and evidence at scale. Several business units, group certificates, scope carve-outs, board reporting and vendor risk across hundreds of suppliers.
Solutions by industry
Your industry decides which framework your buyers ask for
It also decides which regulator sits behind the request. Six patterns cover most of what we see in Canada.
SaaS and technology
SOC 2 Type 2 and ISO 27001. The driver is enterprise deals and the security questionnaire that arrives with them.
Healthcare and digital health
PHIPA, HIPAA, SOC 2 and ISO 27701. The driver is the hospital vendor security review, and it always reaches the residency question.
Financial services and fintech
SOC 2, ISO 27001 and PCI DSS. OSFI Guideline B-13 and Guideline B-10 push requirements down the supply chain to vendors of every size.
AI and machine learning
ISO 42001 and the NIST AI Risk Management Framework. Canada has no AI statute in force, so buyers cannot point at a law. They ask for the assurance that does exist.
Public sector and GovTech
ISO 27001, Protected B handling and data residency. The driver is the Canadian RFP.
Professional and managed services
SOC 2, ISO 27001 and sometimes SOC 1. Your clients' auditors become your auditors.
Solutions by framework
One control library covers twelve frameworks
Write a control once and it answers every framework that asks for it. That is why your second framework costs a fraction of your first. Duplicated effort is the reason multi-framework programs stall.
SOC 2 Type 1 and Type 2
The report North American enterprise buyers ask for. Buyers write it SOC2 or SOC 2. Same report. Readiness, evidence at criteria level, and a scoped workspace for your CPA firm.
ISO 27001
The international certificate for an information security management system. Scope, risk assessment, Annex A, Statement of Applicability and the internal audit.
ISO 42001
The first certifiable AI management system standard. The answer for AI vendors whose buyers have no statute to point at.
Privacy: ISO 27701, GDPR, PIPEDA
Privacy information management on top of your ISMS, mapped to the law that applies to you rather than all of them at once.
Health: HIPAA and PHIPA
United States and Ontario health information rules, run as controls with evidence rather than as a policy binder nobody reads.
And the rest
PCI DSS, NIST CSF, NIST 800-53, CSA CCM, CMMC and FedRAMP, from the same library, with mappings kept current as the standards change.
The whole lifecycle
Across all five phases, with one owner
Platforms cover evidence collection. Consultancies cover readiness. Auditors cover the audit. Nank.ai covers all five phases with one owner across them, so nothing falls between vendors.
1
Design controls
Objectives, owners and evidence rules set up front, mapped across every framework in scope.
2
Implement controls
Rollout tasks assigned across teams, with the supporting policies drafted alongside them.
3
Operate controls
Access reviews, approvals, scans and training scheduled, tracked and recorded as they happen.
4
Verify effectiveness
Testing with documented sampling, findings routed to an owner, retesting tracked to closure.
5
Audit controls
A scoped workspace for your auditor with evidence already attached, and every request tracked to a close.
See how the platform runs each phase
Control library, policy management, evidence collection, continuous monitoring and the audit workspace.
Canadian coverage
SOC 2 and ISO 27001 across Toronto, Ontario and Canada
Nank.ai works from Toronto. That matters for three reasons beyond the time zone.
A Canadian CPA firm can issue your SOC 2 report, and it carries the same weight with United States buyers. For ISO 27001, the Standards Council of Canada accredits the bodies that issue certificates here. A body has to meet ISO/IEC 17021-1 first. SCC also signs the IAF Multilateral Recognition Arrangement. That is what makes a Canadian certificate count abroad.
Canadian privacy law is also not one law. PIPEDA applies federally. PHIPA covers Ontario health data. Quebec Law 25 and the PIPA statutes in Alberta and British Columbia each apply on their own terms. We map the ones that reach your business rather than all of them.
Canadian data residency compliance
The part most vendors leave out
SOC 2 has no data residency criterion. Nothing in the Trust Services Criteria asks where your data sits. ISO 27001 sets no residency rule either. So a clean report or a valid certificate tells a Canadian buyer nothing about whether their records stayed in Canada. Buyers in Canadian health, finance and government ask anyway, in the security review that runs alongside the certificate. Residency is a separate commitment you make on top of the framework. Nank.ai holds client data in the client’s own country.
Getting started
How an engagement starts
1
A scoping call
Which framework, which buyers asked for it, what you already run and what your deadline is.
2
A gap assessment
What your existing controls already answer, and the shortlist of what they do not. Not a list of everything the framework wants.
3
A plan and a start date
Owners, dates and the evidence each control needs, with your compliance manager named.
Questions
Frequently asked questions
A subscription that covers the compliance program rather than the software alone. You get a named compliance manager who owns the outcome. You also get AI agents that carry the repetitive work, and a platform that holds the controls, policies, evidence and audit workspace. The distinction that matters is ownership. A platform hands you the work. Compliance as a Service does the work with you.
Twelve, from one control library. ISO 27001, ISO 27701, ISO 42001, SOC 2, HIPAA, GDPR, PCI DSS, NIST CSF, NIST 800-53, CSA CCM, CMMC and FedRAMP. Write a control once and it answers every framework that asks for it. Mappings stay current as the standards change.
Most clients reach audit-ready in about three months. A company that already runs a certified management system can move faster. Readiness is not the report or the certificate. A SOC 2 Type 2 adds an observation window after readiness, and ISO 27001 adds a Stage 1 review and a Stage 2 audit. Ask any provider which part of a quoted timeline is readiness and which part is the audit.
No, and nobody who prepares you can. A licensed CPA firm issues a SOC 2 report. An accredited certification body issues an ISO 27001 certificate. Those roles have to stay independent of the party that built your controls. Nank.ai gets you ready, runs the audit workspace and manages the relationship with whichever firm you appoint.
In your own country. For Canadian clients that means Canada. This is a commitment we make on top of the framework, because neither SOC 2 nor ISO 27001 contains a data residency requirement. If your buyers in health, finance or government ask where records sit, the certificate alone will not answer them.
Most of the time, no. That is the point of the model. Your team adjusts processes it already owns and supplies the evidence no integration can reach. The plan, the control design, the verification and the auditor relationship sit with your compliance manager. Some companies should still hire, and we will say so on the scoping call when the volume of work justifies a full-time role.
More detail in the compliance library and on the Nank.ai blog, including what a SOC 2 Type 2 report costs and how long SOC 2 preparation takes.
Let us scope your compliance program
A scoping call, then a gap assessment, then a plan with a start date. Toronto based, twelve frameworks, and your data held in your own country.