A small European team, running security that proves itself.
CloudSoul is a Luxembourg-headquartered security and compliance minded company. We were started by people who ran security programmes inside regulated European organisations and grew tired of watching a good SOC and a good GRC tool fail to talk to each other.
Security and compliance should be one job. They are not.
In most European organisations we’ve worked inside, security operations and compliance live in different tools, run by different teams, on different budgets. The SOC triages alerts. The compliance lead chases screenshots. The audit happens once a year and sends everyone scrambling. The controls the auditor evaluates are often not the controls the SOC is actually running.
CloudSoul was built on one opinion: the work of running security and the work of proving it should share a single system. Every action the platform executes (a patch applied, an alert triaged, a backup tested, a phishing sim completed) emits an artefact that is filed against the control it satisfies. You don’t maintain a parallel compliance workflow. The evidence is a by-product of doing the work.
We are based in Luxembourg by choice. EU-only infrastructure and no US Cloud Act exposure are non-negotiable for the regulated operators we serve. Everything downstream of that (deployment flexibility, transparent pricing, operated delivery) is consequence, not marketing.
Why Luxembourg
Luxembourg is a small jurisdiction with a disproportionately developed regulatory ecosystem. It hosts ILR (the national regulator for NIS2 transposition), the Luxembourg House of Cybersecurity, CIRCL (the national CSIRT), and a density of regulated financial-services operators that keeps compliance infrastructure sharp.
We’re here because the regulatory proximity is useful: we can walk into the CSIRT, not just email them. We’re here because the data-residency claim is load-bearing for our customers. We’re here because the Grand Duchy takes cybersecurity policy seriously enough to fund it. And we’re here because the multilingual workforce (English, French, German, Luxembourgish) matches our target customer geography naturally.
Everything a security-sensitive buyer needs.
Sub-processors, data-residency, certifications, vulnerability disclosure policy, security.txt, and the request form for SOC reports and pen-test summaries, all published on the Trust Centre.
Talk to us.
Press
press@cloudsoul.net- Name
- CloudSoul S.à r.l.
- Office
- 9 Rue du Laboratoire, L-1911 Luxembourg, Luxembourg
- RCS
- B288476
- VAT
- LU35952049
Walkthrough is with a real engineer. No deck. No sales qualification.