Company
What Nankai Means, and Why It Is In Our Name
Nankai is the Tianjin school founded in 1904, and we took the name for what it stood for: Gong – public spirit. Neng – ability.
September 2, 2026
NANK.AI BLOG
Blog
Practical writing on SOC 2, ISO 27001 and the privacy law Canadian companies actually have to follow. We are a Toronto compliance firm, and this is where we explain the work: what a report costs, how long an audit really takes, and what an auditor asks for. Start with our Compliance as a Service overview, or go straight to the compliance library.
Company
The Story Behind Nank.ai: When Frustration Becomes a Blueprint
How one compliance practitioner’s breaking point with GRC software became the foundation for a different kind of compliance company.
September 1, 2026
Framework
ISO 27001 vs SOC 2
One is a certificate. The other is a report on controls you wrote. Why the overlap runs one way, and which your buyers ask for.
September 1, 2026
SOC2
What Does a SOC 2 Type 2 Report Cost?
USD 25,000 to 80,000 in year one for most small and mid-sized companies. What drives the number, and which parts you can actually control.
August 26, 2026
SOC2
How Long Does It Take to Prepare for a SOC 2 Type 2 Audit?
Six to nine months from a standing start for a first SOC 2 Type 2 report. What happens in each phase, and where teams lose time.
August 25, 2026
consulting-services
Penetration Testing Methodologies: A Complete Guide to OWASP, PTES, NIST, OSSTMM, and More
OWASP, PTES, NIST and OSSTMM compared. Which methodology fits your scope, and what an auditor expects to see in the report.
May 23, 2026
ISO 27001
ISO27001 vs ISO27002
ISO 27001 is the standard you certify against. ISO 27002 explains how the controls work. Why that difference matters for your project.
May 16, 2026
ISO 27001
How to develop an ISMS for ISO 27001 certification?
Designing an ISO 27001 ISMS doesn’t have to be overwhelming. Explore our definitive 10-step guide to navigating mandatory clauses, mastering risk assessments, and accelerating your path
October 26, 2025
ISO 27001
A Complete Guide to ISO 27001 Certification
Information security is no longer optional, but achieving ISO 27001 certification can feel like a daunting task. We’ve broken down the complexities of ISMS design into
October 26, 2025
Where we work
SOC 2 and ISO 27001 across Toronto, Ontario and Canada
Most of what we write here comes out of engagements with Canadian companies. Buyers ask for the same two reports again and again. Our SOC2 service Canada engagements answer the first. Our ISO 27001 certification Toronto engagements answer the second. Alongside them sit obligations that United States vendors gloss over: PIPEDA federally, PHIPA for health information in Ontario, Law 25 in Quebec, and OSFI expectations for federally regulated financial institutions.
Our compliance services Canada engagements account for all of that from the first conversation. One control library covers the framework you are certifying against and the privacy law you already follow.
Canadian data residency compliance
Canadian data residency compliance is a standing condition in public sector and healthcare contracts, and a growing one in enterprise procurement. Your evidence, policies and control records stay in Canada, so the answer to that questionnaire question is short and provable.
SOC 2 compliance service
Readiness, control design, evidence and auditor coordination for the Trust Services Criteria. Buyers write it SOC2 or SOC 2. Same report.
ISO 27001 certification service
Scoping, Statement of Applicability, risk assessment and internal audit, through Stage 1 and Stage 2 with an accredited certification body.
Privacy and security advisory
PIPEDA, PHIPA and GDPR advice, security program design and penetration testing coordination for teams without a CISO.
New here? The compliance platform shows how the controls, evidence and audits fit together, and about Nank.ai explains why we built it the way we did.
Reading up before an audit?
Tell us which framework your buyers are asking for and what you have in place today. We will tell you what the program looks like and how long it takes. A real compliance manager on the call, no obligation.