Română
Português
EspañolSecurity overview
Alerts by severity, failed sign-ins, attacking addresses, open vulnerabilities and your NIS2 score — with the live alert stream beside them.
Continuous monitoring • Audit-ready reports
Cyber Security Compliance,
security operations with the reports built in
Round-the-clock monitoring of your servers, your Cloud Office and your cloud accounts: detection and alerting, CIS hardening scores, vulnerability management and live evidence for twelve compliance frameworks — in one portal, with reports ready for your auditor.
INSIDE THE SECURITY PORTAL
Your security operations centre
The screens your administrators use every day, in one place.
Live triage
High and critical detections grouped by rule and target, each with its playbook, with every event from the last hour streaming beside them.
Threat map
Where attacks come from, by country and source address, replayed over the last day.
Event explorer
Every event from every machine, searchable by address, user, host or rule, each with its MITRE ATT&CK technique.
Compliance and evidence
Twelve frameworks scored from live evidence; every gap named, with the NIS2 Article 23 incident clock.
Vulnerabilities and hardening
Every package matched against published CVEs, and every machine scored against its CIS benchmark.
Fleet and sensors
Your servers, on-premises or in any cloud: which report, which went quiet, and one command to add more.
Cloud resources
Cloud accounts and SaaS, read-only through their audit logs, beside your servers.
Reports
An executive summary, the control matrix and the incidents, per framework, ready to hand to your auditor.
WHAT THE MODULE DOES
Security operations and compliance, in one module
Other providers sell you servers and leave the security to you. Here it is part of the service.
Continuous
Security operations, around the clock
Events from your servers, your Cloud Office and your cloud accounts in one console: live alerts, a threat map and an event explorer.
Real time
Detection and alerting
Rules for brute force, privilege escalation, suspicious sign-ins and changes to who may do what, each mapped to MITRE ATT&CK.
Every machine
CIS benchmarking
Every machine scored against the CIS benchmark for its system, with each failing check and how to fix it.
Daily
Vulnerability management
Installed packages matched against published CVEs, ranked by severity, with the fix path for the worst first.
Live evidence
Twelve compliance frameworks
NIS2, DORA, ISO/IEC 27001:2022, NIST CSF 2.0, NIST SP 800-53, CIS Controls v8, GDPR Article 32, PCI DSS, SOC 2, HIPAA, UK CAF and UAE IAS.
Any server
Fleet and sensors
One command installs the sensor on any Linux server, on-premises or in any cloud; the fleet view shows which have gone quiet.
Read-only
Cloud accounts and SaaS
AWS, Azure, Google Cloud, Microsoft 365, Google Workspace, Okta, GitHub and more, connected read-only through their audit logs.
On demand
Reports and evidence
An executive summary, a control matrix with its evidence and an incident timeline, per framework, for your auditor.
REGULATORY JURISDICTIONS
Target Your National & Industry Framework
Choose a regulatory zone to see the frameworks the monitoring is mapped to. Each mapping references the framework's own articles and controls.
DIRECTIVE 2022/2555
MAPPEDNIS2 Directive & CIR 2024/2690
Article 21 risk-management measures, Article 23 incident notification thresholds (24-hour early warning, 72-hour incident notification, 1-month final report).
Controls evidenced:
- Asset and package inventory
- Vulnerability detection
- Access control and two-factor sign-in
- Security event monitoring for incident detection
Report: annex coverage, PDF and JSON
REGULATION 2016/679
MAPPEDGDPR Article 32 (Security of Processing)
Technical and Organisational Measures (TOMs) required to ensure confidentiality, integrity, availability, and ongoing resilience of processing systems.
Controls evidenced:
- Checks of encryption in transit
- Account lifecycle and access reviews
- Review of sharing and permissions on Cloud Office files
- Configuration assessment results
Report: Article 32 evidence pack
REGULATION 2022/2554
FINANCIAL RESILIENCEDORA (Digital Operational Resilience)
Framework for financial entities and critical ICT third-party suppliers addressing operational ICT risk management and continuous system resilience.
Controls evidenced:
- ICT risk-management records
- Availability monitoring records
- Third-party dependency inventory
- Incident classification support (Articles 17–23)
Report: DORA evidence pack
TDRA / NESA
NESA IAS Standard
UAE National Electronic Security Authority Information Assurance Standard controls for critical information infrastructure.
DUBAI DESC
DESC ISR Framework
Dubai Electronic Security Center Information Security Regulation, mapped to agent data.
FEDERAL LAW
PDPL (Law 45 of 2021)
UAE Personal Data Protection Law (Federal Decree-Law 45 of 2021), mapped for security of processing and cross-border transfers.
NIST
NIST CSF 2.0 & SP 800-53 / 171
Govern, Identify, Protect, Detect, Respond and Recover, mapped to agent data.
DOD / FEDERAL
CMMC 2.0 (Level 1 & Level 2)
Cybersecurity Maturity Model Certification alignment for safeguarding Federal Contract Information (FCI) and CUI.
AICPA & HHS
SOC 2 Type II & HIPAA Security
Evidence for the Trust Services Criteria (security, confidentiality, availability) and the HIPAA Security Rule safeguards.
NCSC UK
Network and Information Systems (NIS) Regulations 2018
For UK Operators of Essential Services and Relevant Digital Service Providers, mapped to the NCSC Cyber Assessment Framework (CAF).
IASME & NCSC
Cyber Essentials & Cyber Essentials Plus
The five technical controls: firewalls, secure configuration, user access control, malware protection and patch management, checked from agent data.
ISO / IEC
ISO/IEC 27001:2022 Annex A
Mapped across the 93 Annex A controls: organisational, people, physical and technological.
CENTER FOR INTERNET SEC
CIS Controls v8 (IG1, IG2, IG3)
Asset inventory, data protection safeguards and audit log management.
PAYMENT CARD INDUSTRY
PCI DSS 4.0
Checks of cardholder data environment segmentation, TLS configuration and authentication rules.
Need a framework that is not listed?
Send us your framework or your supervisory authority's guidelines, and we map the monitoring to it.
METHODOLOGY
How It Works
The five stages of the module, from collection on your servers to a report you can hand to your auditor.
STEP 01
Agent Installed
The monitoring agent runs on each VPS or VM, and Cloud Office reports its own sign-in, sharing and administrative events.
ContinuousSTEP 02
Telemetry Collected
Security events, process execution, open ports, package vulnerabilities, configuration checks, and file integrity traces.
ContinuousSTEP 03
Controls Evaluated
Findings mapped to the controls of the framework you select.
AutomatedSTEP 04
Gaps Flagged
Findings with remediation guidance for your administrators. Changes stay in your hands.
AutomatedSTEP 05
Report Generated
PDF reports for auditors and machine-readable exports.
Automated
OBSERVABILITY BOUNDARY
What is Monitored
Two areas. The agent reads system events, configuration and package inventory — not the contents of your databases or mail.
Your Sovereign VPS / VM Infrastructure
OS & Host Daemon
- SSH Key Authentication & Brute-Force DetectionSSH configuration checks and alerts on repeated failed sign-ins.
- OS Kernel Patches & CVE Vulnerability ScanningInventory of installed packages checked against published vulnerability data (vulnerability detection).
- Inbound/Outbound Firewall Rules & Port BindingsInventory of listening ports and checks of firewall configuration.
- File Integrity Monitoring (FIM) across Critical PathsCryptographic checksum verification on /etc, /bin, /sbin, /usr/bin to flag unauthorized binary tampering.
- Privileged Sudo Escalations & Unmapped UsersAlerts on privilege escalation (sudo) and on changes to local accounts.
Your Sovereign Cloud Office
Application & Collaboration Core
- Sign-in monitoringAlerts on unusual sign-ins, and checks of your domain's SPF, DKIM and DMARC.
- File sharing reviewA list of public share links, including links without an expiry.
- Administrative actionsThe Cloud Office admin audit log — account, role and mailbox changes — sent to the module.
- Sync connectionsWhich device passwords are used by calendar, contacts and files clients.
- Mailbox access reviewWho can open which shared mailbox, for periodic access reviews.
SAMPLE REPORT
Sample report
What your auditor receives. The rows below are example data, not a real customer.
EXAMPLE DATA — NOT A CUSTOMER • Framework: Directive (EU) 2022/2555 & CIR 2024/2690
NIS2 Article 23 Incident-Notification Statutory Clock
Interactive Checklist| Control Ref | Requirement Title | Evidence Observed | Status |
|---|---|---|---|
| CIR Point 11.6 | Cryptographic Authentication | All SSH logins enforce Ed25519 public keys. Root password authentication disabled in sshd_config. | PASS |
| CIR Point 11.2 | Access Control & File Shares | 3 active public shared folders detected in Cloud Office Drive with no expiration date set. Remediation: Set max expiration date to 7 days or revoke anonymous external link tokens. | GAP |
| CIR Point 6.7 | Network Segmentation | Default iptables policy DROP on INPUT; only ports 22, 80, 443 bound to public interface eth0. | PASS |
| CIR Point 6.10 | Vulnerability Handling | 1 critical CVE detected in OpenSSL runtime library requiring immediate distro package upgrade. Remediation: Run 'apt-get update && apt-get install --only-upgrade openssl' | GAP |
| CIR Point 3.2 | Monitoring and Logging | System logs and the systemd journal collected by the monitoring agent. | PASS |
| CIR Point 15.3 | Industrial Control / SCADA | No operational technology (OT) or Modbus/DNP3 industrial protocols detected on your organisation's network. | N/A |
No Telemetry Data Collected Yet
Once the agent is installed on your servers, your first report appears here.
DATA RESIDENCY
Isolated organisations. Your data stays in your jurisdiction.
Each organisation is kept apart: its agents form their own group, and its data can be read only through a role restricted to that organisation. Monitoring data is stored and processed in the jurisdiction you choose.
What is true today
- Your jurisdiction
- Agent-to-server traffic encrypted
- No analytics or advertising trackers
- Encrypted off-site backups
INCLUDED • UPGRADE • YOUR OWN ESTATE
Pricing
The Compliance Baseline comes with every Cloud Office and VPS plan. Upgrade for every framework, or bring the machines you run yourself into the same reports.
In every plan
IncludedCompliance Baseline
Comes with every Cloud Office and VPS plan, from the first day.
Included in every plan
- Monitoring of your Cloud Office and VPS
- Live security dashboard
- One framework report, for your jurisdiction
- 90 days of history
- PDF and JSON export
Upgrade
RecommendedCompliance Pro
For regulated organisations that answer to several frameworks or an external auditor.
€149 / month per organisation
- Every framework, in every jurisdiction
- Auditor evidence packs and auditor sign-in
- NIS2 Article 23 incident notice drafts
- Scheduled reports
- 24 months of history
- Active response, with your approval
Your own estate
Flat tiersYour Own Infrastructure
Your own servers, other clouds and office machines, in the same reports. Available with or without a TotulDigital plan.
From €99 / month, by number of servers
- Small: up to 10 servers, €99 / month
- Medium: up to 20 servers, €249 / month · Large: up to 40, €499 / month
- The frameworks of your plan
- One report across everything you run
- No TotulDigital hosting required
QUESTIONS & ANSWERS
Frequently Asked Questions
About the compliance module and its monitoring engine.
How does TotulDigital collect compliance data without compromising confidential files?
The monitoring agent reads system events, logs, configuration and package inventory. It is not configured to read the contents of mail, databases or documents.
Does the agent have write or remediation permissions on my VPS or Cloud Office?
The agent runs with the privileges it needs to read logs and configuration. Active response, which can block a threat automatically, is switched on only with your approval, and remediation stays under your administrators' control.
How does the 24-hour and 72-hour NIS2 Article 23 early warning mechanism work?
Yes. When a significant incident is detected, the module starts the Article 23 timeline and prepares draft notifications for you to review and submit to the authority.
Can I export evidence for external auditors?
Yes: PDF reports for your auditor, with the underlying data as JSON.
What happens if our company operates across multiple jurisdictions (e.g., EU and UK or US)?
Yes. The same monitoring data is mapped to each framework you select, with a separate report per framework.
Where is the monitoring data stored?
In the sovereign jurisdiction you choose, under its law. TotulDigital has no US parent company or subsidiary.
BOOK A DEMO
Audit-ready compliance, every day.
Book a demo.
Tell us your jurisdiction and your setup. We set up your organisation, connect your servers and deliver your first report.
Your jurisdiction • Per organisation, not per user • NDA on request