The tools we operate ourselves.
Advising a company on security without giving it the means to act leaves it with the hardest part. These five platforms are built and operated by Luxgap, hosted in the European Union, and used by our own teams before our clients get them.
Sovereign managed SOC, 24/7
Your whole perimeter watched continuously: cloud, servers, endpoints, dark web, IoT and industrial systems. Detection targets the first hour, and every qualified incident comes with the regulatory notification that goes with it.
- Continuous monitoring of cloud, servers, endpoints and the dark web.
- Covers IoT and industrial environments, too often left out.
- Detection targeted within the first hour, then analyst qualification.
- Notifications ready for NIS 2, DORA and the CNPD. The regulatory clock is short, the file cannot be built afterwards.
Business mail, hosted and encrypted in Luxembourg
Mail hosted, encrypted and operated in Luxembourg, with as many addresses as you need, with no per-user licence. And, for sensitive roles, mailboxes that not even your administrator can open.
- As many addresses and aliases as needed, with no per-seat billing.
- Hosted and operated in Luxembourg: data never leaves the EU.
- End-to-end encrypted mailboxes for management, HR and legal: the administrator has no access either.
- A concrete alternative when hyperscaler dependency raises a sovereignty or per-seat cost problem.
Continuous code monitoring, from €0.01 per line
Code written fast, by your teams or by an AI, still has to be held to a standard. The platform continuously monitors what gets written: code security, automated testing, penetration testing, and the evidence a regulator will ask for.
- Framed vibe coding: what an AI writes is reviewed and tested like the rest.
- Continuous code security analysis and penetration testing, not once a year.
- Automated tests maintained over time, not only at delivery.
- Usable evidence for NIS 2, GDPR and the AI Act.
- Priced per line of code, from €0.01 per line per month.
A continuity plan that holds up on the day it is needed
A business continuity management system compliant with ISO 22301, aligned with NIS 2 and DORA, maintained continuously. Hosted outside your own information system, the plan stays available on the day your own servers go down.
- Service-by-service impact analysis (MTPD, RTO, RPO), imported from your existing Excel sheets.
- Fourteen ready-to-use emergency playbooks: fire, outage, failing supplier, cyberattack.
- Crisis mode: the playbook runs action by action, every decision goes into a timestamped log.
- A crisis messenger hosted outside your information system, for when your own is down.
- Annual exercise, report and audit file kept current. Run by our consultants, or self-service.
- Hosted by OVHcloud in France, within the European Union.
Your risks, your compliance, your vendors, in the same console
A GRC platform that replaces spreadsheets, e-mail reminders and consolidation meetings. Risk register, frameworks, third-party assessment, incidents and evidence: everything is linked, segregated per client and ready for the next audit.
- 175 NIS 2, DORA, ISO 27001 and AI Act requirements ready to assess: status is computed from closed questions.
- Risk register scored likelihood × impact, ISO 27005 or EBIOS RM campaigns, risk acceptances with a review date.
- Vendors scored criterion by criterion, overdue reassessments flagged, concentration on critical providers in the DORA sense.
- Incidents with a notification countdown: ILR within 24 hours, CNPD within 72 hours, CSSF under DORA.
- An AI copilot that answers from your data without ever touching the database, limited to the active client.
- Application and data hosted in the European Union, security monitored by the LuxGap SOC.
Want to talk it through?
These platforms combine with our DPO and CISO mandates: the same teams operate them. Tell us what you need to cover and we will tell you what applies, and what does not.