60% of French SaaS vendors lose deals because of compliance. WakaStart embeds ISO 27001, NIS2, HDS and eIDAS from the very first line of code — no extra project, no delay, no hidden budget.
The 2026 regulatory landscape
Since 1 January 2026, NIS2 has been fully applicable. Your enterprise clients' CISOs have issued instructions: any uncertified SaaS provider is excluded from tenders. This isn't a threat — it's the market.
What's blocking your sales
"Are you ISO 27001 certified?"
Your prospect's CISO asks the question in the meeting. You answer "no" or "in progress". The deal doesn't get signed.
"Is your provider NIS2 compliant?"
The enterprise client receives a directive from its IT department. All subcontractors must be NIS2 compliant. You're not on the list.
"Where is your health data hosted?"
The hospital or clinic requires HDS certification. Without it, the deal is impossible — no matter how good your product is.
"Is your signature legally valid?"
Without eIDAS compliance, your electronic signature module has no legal value in the European Union.
"In 2024, one of our clients lost a 80 000 € deal over a single question: are you ISO 27001 certified? The answer was no."
What WakaStart changes
With WakaStart, these questions become your selling points. Your SaaS is delivered ISO 27001 certified, NIS2 compliant, with optional HDS and eIDAS modules available — plus full audit documentation, ready to present to any CISO.
Your certifications
Each certification addresses a specific market. WakaStart bundles them all into a single framework — Cybercoding — so you never have to choose between moving fast and being compliant.
ISO 27001
The global standard for information security
ISO 27001 is the benchmark certification for any B2B SaaS vendor looking to sign with businesses, public bodies or large accounts. It proves that your information security management system (ISMS) has been audited and certified by a COFRAC-accredited body. Without it, 60% of B2B tenders are closed to you.
NIS2
European cybersecurity directive — applicable since 1 Jan. 2026
The NIS2 directive applies across the entire European digital supply chain. As a SaaS vendor, you're a provider to your enterprise clients — who are themselves subject to NIS2. If you're not compliant, you expose them to regulatory risk. Result: you're ruled out, even if your product is excellent.
HDS
Health Data Hosting certification — a legal requirement in France
If your SaaS touches personal health data in any way — hospitals, clinics, doctors, e-health, medtech — HDS certification is a legal obligation, not an option. Without it, your solution cannot legally host or process this data, regardless of its technical security level.
eIDAS 2.0
European electronic signature and digital identity
If your SaaS includes contract signing, strong authentication or digital identification, the eIDAS 2.0 regulation applies. A signature that isn't eIDAS compliant has no legal value in the European Union — and could invalidate all your client contracts. The WAKA-SIGN module builds in eIDAS compliance natively.
The Cybercoding method
Security bolted on after development costs on average 30 times more than security built in from the design stage. In Cybercoding, security isn't a layer — it's the foundation.
Security Functional Specifications (SFS)
Before the first commit, the AI maps out every access right, every piece of sensitive data, every network flow. The SFS are validated by an expert CISO. No security ambiguity is tolerated.
Generation within a hardened framework
The AI generates code within a pre-configured security framework: Keycloak IAM, PostgreSQL RLS, WAF, secrets injected via OpenBao/Vault. No API keys in the source code.
Automated SAST/DAST pipeline
Every build triggers a series of scans: static code analysis (SAST), dynamic testing (DAST), OWASP Top 10 checks, CVE scanning. No deployment without a perfect compliance report.
Multi-framework compliance verified
The pipeline automatically checks compliance against ISO 27001, NIS2, HDS and eIDAS requirements. One build — four certifications verified simultaneously.
Deployment on pre-hardened infrastructure
The code lands on Kubernetes infrastructure pre-configured and validated by CISOs. Developers never have access to production. Absolute segregation of duties (SoD).
Traditional security vs Cybercoding
Secrets management
Rights management
Audit & traceability
Security testing
Encryption
Quantum computers will render all current encryption algorithms obsolete by 2030. WakaStart already integrates quantum-resistant algorithms recommended by NIST — so your data stays protected in the long run.
Encryption at rest
AES-256-GCMAll disk partitions, databases (SQL and NoSQL) and cold backups are encrypted with AES-256-GCM — the military-grade standard at ANSSI Enhanced level. Automatic key rotation via OpenBao/Vault.
Encryption in transit
TLS 1.3 + mTLSAll network communications use TLS 1.3 as a minimum. Inter-service exchanges are protected by mTLS (mutual TLS) — each service authenticates the other before any data transfer.
Build signing
ML-DSA (Post-quantum)Every build archive is signed with ML-DSA via the Liboqs library — an algorithm resistant to quantum computers. Any tampering with the code between build and deployment is detected immediately.
Key exchange
ML-KEM (Post-quantum)The hybrid key exchange uses ML-KEM (formerly Kyber) — the post-quantum standard adopted by NIST. Even if a quantum computer intercepts the exchange today, it won't be able to decrypt it tomorrow.
Immutable audit logs
SHA-256 + BlockchainEvery log is hashed in SHA-256, chained to the previous log and anchored in a distributed blockchain ledger. Tampering with a single line breaks the chain — instant detection, irrefutable forensic proof.
WORM Object Lock
Compliance ModeLog archives are stored in WORM (Write Once Read Many) mode with a strict Compliance lock. Not even a root administrator can modify, overwrite or delete an archived log — ready for any ISO or legal audit.
For your profile
Compliance isn't a cost — it's a commercial lever. Here's what it opens up in practice, depending on your profile.
Sign your first enterprise clients by month 2.
Unlock NIS2-blocked deals that have stalled for 6 months.
Access the hospital market and ANS tenders.
Frequently asked questions
How long does it take to get ISO 27001 with WakaStart?
From €30,000 excl. VAT, spread over time with no bank loan needed — instalments from €2,000/month. Our framework is itself certified by a COFRAC auditor: your SaaS benefits from a direct extension of our certified scope in 1 month. You don't start from scratch, the auditor is already known, and the risk of failure is zero.
What does the NIS2 directive mean for a B2B SaaS vendor?
Applicable since 1 January 2026, NIS2 imposes strict requirements across the entire digital supply chain: cyber risk management, business continuity, 24-hour incident traceability, and provider compliance. As a SaaS vendor, you're a provider to your enterprise clients — if they're themselves subject to NIS2, they're accountable for your compliance. A SaaS that isn't NIS2 compliant means exclusion from tenders.
Is WakaStart HDS certified for health data?
Yes. WakaStart offers the WAKA-HDS module for SaaS operating in the healthcare sector. The OVH infrastructure we deploy on is HDS certified — which makes it easier to extend the scope to your application. HDS certification is a legal obligation for hosting any personal health data in France.
What is Secure-by-Design in Cybercoding?
In the Cybercoding approach, security isn't added after development — it's built into the specifications before the first line of code. The AI generates code within a security framework pre-validated by CISOs: Keycloak IAM, PostgreSQL RLS, WAF, secrets via Vault, SAST/DAST pipeline. The result: zero critical flaws at delivery, ISO compliance verifiable immediately.
Does eIDAS compliance apply to my SaaS?
If your SaaS includes electronic signature, strong authentication or digital identification, then yes. The eIDAS 2.0 regulation imposes a strict framework on European digital identities. A signature that isn't eIDAS compliant has no legal value in any of the 27 EU member states. The WAKA-SIGN module builds in eIDAS compliance natively, with support for the upcoming EUDI Wallet.
What happens if my existing SaaS isn't compliant?
Start with our free audit. Our Lead Developer and CISO analyse your existing architecture, identify compliance gaps, and propose a WakaStart migration plan with a fixed timeline and budget. Migration takes place with business continuity: your current clients won't notice a thing during the transition. Average timeline for a scale-up: 1 to 3 months.
Start with a free compliance audit. Our CISO reviews your situation and proposes a concrete action plan with a fixed timeline and budget. No commitment required.