Which NIS2 authority are we under?

Most sectors fall under the ILR. Banks and financial market infrastructure fall under the CSSF. Heelr's checks and reports are the same either way, and a vCISO or auditor from the talent pool can help with registration and incident reporting duties.

What does the free check need from us?

Your name, work email, company domain and the tools you use. The snapshot looks only at what anyone on the internet can see, and the results arrive by email from compliance@cyberr.ai.

We have no company domain, only Microsoft 365.

Book a demo. We connect Microsoft 365 read-only instead and check admin MFA, Conditional Access and legacy sign-in.

Do we need to install anything?

No. You approve read-only access in AWS, Microsoft 365 and GitHub from your own admin consoles, and you can revoke it at any time.

Which frameworks are covered?

ISO 27001, NIS2, GDPR and DORA. Startup covers one framework of your choice. Compliance and Managed cover all four.

What if we need more vCISO time?

Managed includes an estimated 5 hours a month. If a month needs more, for example before an audit, extra hours are booked on top of your plan only when you ask for them.

Where is our data kept?

In the EU. We only ever ask for read-only access, and alerts arrive in English, French or German.

How do auditors and engineers from the talent pool work?

When a gap needs a person rather than a setting, we turn it into a brief for the right expert. They are booked separately from your plan, on every plan.

Does this make us certified?

No. We get you audit-ready and introduce you to a lead auditor. Certificates are issued by an independent accredited certification body.

Heelrby Cyberr

NIS2 · DORA · ISO 27001 · GDPR · Luxembourg

Compliance, done by software and finished by people.

Heelr watches your domain, Microsoft 365, AWS and GitHub against four frameworks, including NIS2 as Luxembourg applies it, then hands the last mile to verified auditors and vCISOs.

Request a demo Run the free check

Lead auditor, vCISO or pentester? Join the Heelr talent pool

Pricing

Prices on the page. Pick a plan, or start free.

Monthly prices per company. Managed includes an estimated 5 vCISO hours a month, with extra hours on top if needed. Auditors, pentesters and engineers from the talent pool are booked separately.

Free checkFreeOne-off outside-in snapshot of your domain, with a score and gap report by email. Plus a free GDPR cookie banner for your website.Get the free check

Startup€290/moOne framework of your choice. AWS, Microsoft 365 and GitHub checks, alerts and monthly reports.Book a demo

Compliance€790/moAll four frameworks: ISO 27001, NIS2, GDPR and DORA. Everything in Startup.Book a demo

Managed€1,900/moEverything in Compliance, plus an estimated 5 hours a month of a verified vCISO. Extra hours are booked on top when you need them.Book a demo

Compare plans

What each plan includes.

Feature	Free check	Startup	Compliance	Managed
Price	Free	€290/mo	€790/mo	€1,900/mo
Frameworks	Not included	1 of your choice	ISO 27001, NIS2, GDPR, DORA	ISO 27001, NIS2, GDPR, DORA
Score and gap report	One-off, by email	Monthly	Monthly	Monthly
AWS, Microsoft 365 and GitHub checks	Not included	Included	Included	Included
Alerts in English, French and German	Not included	Included	Included	Included
15-policy pack	Not included	Included	Included	Included
Evidence history	Not included	Included	Included	Included
GDPR cookie banner	Included	Included	Included	Included
vCISO	Not included	Not included	Not included	About 5 hours a month, extra on request
Talent pool experts	Booked separately	Booked separately	Booked separately	Booked separately
Hosted in the EU, read-only access	Included	Included	Included	Included

Luxembourg funding

Based in Luxembourg? 70% of the project may be funded.

The Ministry of the Economy's SME Package Cybersecurity covers 70% of a cybersecurity project costing €3,000 to €25,000 excluding VAT. We help you scope the package against your pre-analysis and prepare the quote for your application. Approval is the ministry's decision.

01
Pre-analysis
Book it through the House of Entrepreneurship. The Luxembourg House of Cybersecurity reviews where you stand and sets the priority actions.
02
Package and quote
Choose a package and a provider, and agree a quote between €3,000 and €25,000 excluding VAT, built on those priorities.
03
Application
The House of Entrepreneurship helps you file it. The Ministry of the Economy reviews the application and decides.
04
Work, review, refund
The package is delivered, the House of Cybersecurity holds a closing review, and once you pay the final invoice the ministry pays out the 70%.

Help me scope a package Read the official conditions on guichet.lu

Eligibility includes a business permit from the Ministry of the Economy, the EU SME size criteria and a registered office in Luxembourg. Craft businesses go through the Chamber of Skilled Trades and Crafts. The aid falls under the EU de minimis rules. Conditions can change, so check guichet.lu before you start.

Mapped toISO 27001NIS2GDPRDORAHosted in the EU · Read-only access · Alerts in English, French and German

Trusted by

How it works

From one form to audit-ready, in six steps.

STEP 1

Apply in two minutes.

Tell us your domain and the tools you use. We run an outside-in snapshot of your domain and email you where you stand.

ScoreA readiness percentage and an outside-in grade for your domain.
Gap reportThe fixes that matter first, in plain language, ordered by impact.
Sendercompliance@cyberr.ai, so you know it is us.

Northwind Labs · connectorsScore %

AWSSecurityAudit role, read-only

ConnectWaiting for admin approvalConnected · 9 checks

Microsoft 365Graph read-only app consent

ConnectWaiting for admin approvalConnected · 8 checks

GitHubRead-only organisation app

ConnectWaiting for admin approvalConnected · 7 checks

Checks run: / 24

PASS aws · root account has MFA

PASS aws · CloudTrail on in all regions

FAIL aws · 2 S3 buckets without encryption

FAIL m365 · MFA off for 3 admin accounts

PASS m365 · legacy auth blocked

PASS github · branch protection on main

FAIL github · 1 repo with secret scanning off

STEP 2

Connect your tools. Nothing to install.

Approve read-only access to AWS, Microsoft 365 and GitHub. We run 24 checks against them and keep the evidence for your auditor.

Read-only. Revoke any time from your own admin console.

AWSSecurityAudit role, read-only. 9 checks.
Microsoft 365Graph read-only app consent. 8 checks.
GitHubRead-only organisation app. 7 checks.

STEPS 3 AND 4

We email you when something needs you. And when it is fixed.

No dashboard to babysit. Each alert says what broke, which control it affects and how to fix it. Fix it, and we confirm it and save the evidence.

Needs youWhat broke, which control it touches and the fix, in one email.
ResolvedWe re-run the check, confirm the fix and save the result.
DigestOne short summary a week, so nothing piles up.

Marc's inboxIT lead, Northwind LabsReadiness %

RESOLVEDMFA is now on for every admin. Evidence saved.now

NEEDS YOUMFA is off for 3 admin accountsnow14:03

DIGESTYour week: 2 checks fixed, score 58%Mon

CONNECTEDAWS, Microsoft 365 and GitHub: 24 checks runningFri

SNAPSHOTYour snapshot: grade C, readiness 42%Thu

From Heelr Compliance · to it@northwind.example

MFA is off for 3 admin accounts

Three Microsoft 365 global admins can log in with a password only. ISO 27001 control A.8.5 and NIS2 Art. 21 expect strong authentication for admins.

Open Entra admin center, Conditional Access
Require MFA for the Global Administrator role
That is it. We re-check automatically.

From Heelr Compliance · to it@northwind.example

Resolved: MFA is on for every admin

We re-ran the check at 14:12. All 3 admin accounts now require MFA. The result is saved to your evidence history for the auditor.

Score54% → 62%

STEP 5

Watch it climb.

Every Monday a short digest tells you what changed. Every month you get a PDF report you can forward to your board, your customers or your auditor.

MondayA digest of what changed and what is still open.
MonthlyA PDF report to forward to your board, customers or auditor.
HistoryEvery result is kept, so the auditor sees the trend.

STEP 6

Audit-ready, with an auditor waiting.

When every check passes, we match you with a verified lead auditor from the Heelr talent pool to run your pre-audit.

MatchA verified lead auditor from the talent pool runs your pre-audit.
Hand-overYour evidence history goes with you, nothing to collect again.
CertificateIssued by an independent accredited certification body.

Why Heelr

Built for Luxembourg companies without a security team.

NIS2 and DORA, as applied here

Luxembourg's NIS2 law has applied since May 2026. The ILR supervises most sectors and the CSSF covers banking and financial market infrastructure. DORA sits next to it for financial entities.

A Luxembourg company

Heelr is run by Cyberr SA in Luxembourg City. Your contract is with a Luxembourg company, and your data is hosted in the EU.

Prices on the page

A free check, then €290, €790 or €1,900 a month. You know the cost before the first call, and before you apply for funding.

Also included

The paperwork, handled too.

15-policy pack

Fifteen security policies adapted to your company, ready for you to approve and share with your auditor.

Free cookie banner

A GDPR consent banner for your website, free on every plan including the free check. It asks before tracking cookies load, keeps a record of each choice, and we keep it in line with the rules.

Evidence history

Every check result is kept with its date, so your auditor sees how long each control has been in place.

Gaps become roles

When a gap needs a person, not a setting, we turn it into a brief for the right expert in the talent pool.

The talent pool · powered by Cyberr

The people behind the checks.

Every expert in the pool is a member of Cyberr, the professional network for cybersecurity. Bring one in by the hour or the project for the gaps your team can't close, and for the audit itself.

See who is in the pool Become an auditor

For IT partners

Already look after a few companies' IT? Bring them Heelr.

Freelance admins, IT consultants and MSPs (managed service providers) earn a share of what their clients pay. Your clients get compliance; you keep doing the fixes you already bill for.

Become a partner

REFER

Send a link. Earn 20%, every month they stay.

Your client signs up and pays us. You get 20% of what they pay, paid out monthly, for as long as they are a client. A Compliance client at €790 a month earns you €158 a month.

RESELL

Bill your clients yourself. Buy at 20% off.

For MSPs who already invoice their clients. You pay us the list price less 20% and bill your client the list price. One invoice from us each month.

The rules, so it stays clean

Same price for your client

Referred clients pay the price on this page. Your share comes out of ours, never added on top.

Your client knows

We tell every referred client who introduced them and that the partner earns a share. No hidden commissions.

Advice stays independent

Partners never act as the auditor for a client they earn from. The pre-audit always goes to someone else in the talent pool.

Questions

Answers before the demo.

Something else? Write to compliance@cyberr.ai.

It can fund 70% of a cybersecurity project costing €3,000 to €25,000 excluding VAT for eligible Luxembourg SMEs. What goes into the package follows the pre-analysis by the Luxembourg House of Cybersecurity, and the Ministry of the Economy decides. Talk to us before you apply and we will help you scope it.

Rather see it with someone first?

A 20-minute walkthrough of the checks, the alerts and the reports, mapped to the framework you need.

Book a demo Get the free check

In the 20 minutes

1Your free check, read togetherWhat the public scan found and what it means for you.
2Your framework, mappedISO 27001, NIS2, GDPR or DORA, and how far off you are today.
3Alerts and reportsWhat lands in your inbox and what your auditor sees.
4Plan and peopleWhich plan fits, and when to bring in someone from the talent pool.