Make confident security and compliance decisions—without enterprise overhead.

You may not feel ready for formal security and compliance requirements yet. But customers, investors, regulators, and enterprise procurement teams already expect clear answers about how you protect information, manage risk, handle personal data, and respond when something goes wrong.

Boxfish Labs helps growing companies get the clarity and senior support they need before they are ready for a full-time security or compliance hire. We assess your current practices, identify the regulations and customer expectations most relevant to your business, and turn them into practical priorities your team can act on.

For business leaders, we translate complex frameworks—including GDPR, ISO 27001, DORA, TISAX, the EU AI Act, and the Cyber Resilience Act—into a proportionate roadmap. The goal is not to create unnecessary bureaucracy. It is to build the policies, controls, evidence, and decision-making routines that help your company keep doing business with confidence.

• Founders and leadership teams who need clear answers to security, privacy, or compliance questions
• Startups, scaleups, and SMEs facing customer security questionnaires, procurement reviews, or investor due diligence
• Companies preparing for ISO 27001, a regulatory change, a new market, or a larger enterprise customer
• Teams that need practical security and compliance direction before hiring a full-time CISO, DPO, or compliance lead
• International businesses operating in, selling into, or expanding across Europe

Assessment

Understand your current maturity, likely obligations, critical risks, and the gaps that could affect your customers, operations, commercial plans, or regulatory exposure.

Prioritisation

Focus on the security and compliance gaps that matter most to your business. We help you avoid spending time on generic checklists or controls that do not fit your stage, product, or risk profile.

Roadmap

Agree realistic next steps, ownership, dependencies, and timelines. You leave with a clear plan your team can use to make progress without losing momentum.

Implementation support

Put practical governance, privacy, and security measures in place. This can include policies, risk-management practices, supplier oversight, data-protection documentation, audit evidence, and internal ways of working.

Ongoing oversight

Maintain progress with continued expert support, regular reviews, and informed leadership decisions as the business, product, customer base, and regulatory environment evolve.

01 — Understand the context

We start with your business model, technology, data, customers, contracts, growth plans, and immediate concerns. This lets us focus on the issues that genuinely affect your business.

02 — Assess maturity and exposure

We review relevant practices, documentation, responsibilities, technical and organisational measures, suppliers, and evidence. We identify the obligations, risks, and gaps that deserve attention.

03 — Set practical priorities

Together, we decide what to address first. Priorities are based on risk, business impact, customer expectations, implementation effort, and your available capacity—not on a one-size-fits-all checklist.

04 — Build what is needed

We support your team to implement proportionate controls, governance, policies, documentation, and operating routines. The emphasis is on measures people can understand, maintain, and use.

05 — Improve continuously

Security and compliance evolve with your business. We can provide continued oversight to review progress, prepare for audits or customer requests, and adapt the roadmap as your needs change.

GDPR

Clarify what personal data you collect, where it flows, which service providers process it, and how data flows, consent, retention, deletion, and accountability should work in practice.

ISO 27001

Design or improve an information security management system (ISMS) so policies, risk management, technical controls, and evidence form a coherent security programme that meets stakeholder expectations.

DORA

Support fintechs, regulated financial entities, and the cloud, SaaS, and technology vendors they rely on to embed incident response, supplier oversight, and operational resilience into systems and contracts.

TISAX

Align security practices and documentation with automotive and mobility-sector expectations so suppliers are better prepared for TISAX assessments.

EU AI Act

Classify AI features, identify high-risk use cases, and build governance, documentation, and transparency practices for AI products and AI-enabled services.

Cyber Resilience Act (CRA)

Help software and connected-product vendors embed secure-by-design development, vulnerability handling, and lifecycle security practices in preparation for EU cyber-resilience obligations.

• A clearer understanding of the security, privacy, and compliance expectations relevant to your business
• A proportionate, prioritised roadmap rather than a generic compliance checklist
• Practical policies, controls, responsibilities, and evidence that support customer due diligence and audit readiness
• Better leadership visibility over cyber risk, decisions, and progress
• A stronger and more credible security narrative for customers, investors, partners, and regulators
• Flexible access to senior expertise without committing to a full-time executive hire

On-demand advisory, shaped around your immediate priorities.

Start with a focused conversation about your current situation, urgent issue, or growth objective. We can then recommend a targeted assessment, a defined implementation engagement, or ongoing advisory support.

Most engagements begin with a paid 60-minute assessment call with a senior security and compliance expert. We use this session to understand your current situation, urgent issues, and what success should look like. You receive an action plan afterwards. If we move forward together, the assessment-call fee is credited towards your first invoice.

For ongoing work, we recommend an engagement plan, a starting hour allocation, and a six-month minimum term under a written retainer agreement. Support can scale as your needs grow and may include recurring working sessions, monthly reporting, and quarterly executive updates.