Fixed-price compliance and cloud analysis
A clear, written answer to your NIS2, privacy and cloud questions.
VDHome delivers scoped analyses and reports at a fixed price: no hourly rates, no open ends. You know up front what you get, what it costs and when it is done.
Start small: Trust Report, EUR 250Terms check, EUR 99Trust Report Watch, EUR 99Accessibility scan, EUR 190
- Fixed price and fixed scope
- Reports in Dutch, French and English
- Fully remote, by email
NIS2 gap assessment
Fictitious organisation, level Important
Gap list, roadmap to April 2027 and policy skeleton attached.
Free check, 3 minutes
Does NIS2 apply to you?
Everything runs in your browser. Nothing is sent or stored, not even by us; close the page and your answers are gone.
Start the checkFree scan, 3 minutes
Where is your data, and what can go wrong?
Your answers stay in your browser. Nothing is sent or stored, not even by us.
Start the scanNew, beta
Cookie-consent self-check
on request, with domain verification
Does declining your cookies actually work? Unlike the free scan and the NIS2 check, this one runs on my server, not in your browser. So I first verify an e-mail address at your own domain. Then I load your site in each cookie choice (no choice, decline, accept) and report whether analytics and session recording stop when a visitor declines. It is an observation, not a legal verdict.
Request it for your domainServices
Scoped engagements, each with a clear end product. No implementation, no staffing: you get the report and the reasoning to decide for yourself.
Trust Report: website and email
What does a visitor and a mail server see of your organisation? A report with evidence and ready-to-send emails for your suppliers.
- Price
- EUR 250 excl. VAT
- launch price EUR 150 until 31/12/2026
- Turnaround
- 5 working days
More about this service
Terms check
Do your terms and conditions, privacy and cookie texts still refer to repealed law? A list of findings, each with its source and date.
- Price
- EUR 99 excl. VAT
- Turnaround
- 5 working days
More about this service
Trust Report Watch
Every month the same measurements as in your Trust Report, with a short report: what changed since last time.
- Price
- EUR 99 excl. VAT
- Turnaround
- a measurement every month
More about this service
Accessibility scan
An automated check of your website for the common accessibility errors, with a list of what to fix first.
- Price
- EUR 190 excl. VAT
- Turnaround
- 5 working days
More about this service
Supplier evidence pack
Your customer sends a cybersecurity questionnaire. I turn it into one answer you can reuse for the next customer.
- from
- EUR 490 excl. VAT
- Turnaround
- 2 weeks
More about this service
CRA readiness check
Do you make software or connected products? Where you stand against the Cyber Resilience Act, with an ordered list of what is missing.
- from
- EUR 1.500 excl. VAT
- Turnaround
- 3 weeks
More about this service
CyberFundamentals Basic for suppliers
Your customer asks for CyberFundamentals Basic? Within two weeks you know where you stand and what to do.
- Price
- EUR 1,900 excl. VAT
- Turnaround
- 2 weeks
More about this service
NIS2 gap assessment
Where do you stand against CyberFundamentals 2025, and what does the law or your customer ask for first?
- from
- EUR 6,500 excl. VAT
- Turnaround
- 3 to 4 weeks
More about this service
Where is your data?
A map of your cloud and SaaS services: where your data sits, who can reach it and what your exit path is.
- from
- EUR 4,500 excl. VAT
- Turnaround
- 2 to 3 weeks
More about this service
DPIA and AI Act assessment
A data protection impact assessment, with the AI Act fundamental rights impact assessment where needed.
- from
- EUR 3,500 excl. VAT
- Turnaround
- 3 to 4 weeks
More about this service
Coming soon
Available from the first quarter of 2027
CRA technical file
The technical documentation the Cyber Resilience Act requires per product, built as code.
- Price
- Waiting list
- Turnaround
- 4 to 6 weeks
More about this service
Available from the first quarter of 2027
DORA register of information
The register of ICT contractual arrangements DORA requires, as structured data you can update every year.
- Price
- Waiting list
- Turnaround
- 2 weeks
More about this service
How it works
1. Intake by email
You briefly describe your organisation and question. I ask what I need to fix the scope.
2. Fixed quote
You receive a quote with scope, exclusions, price and delivery date. No surprises afterwards.
3. Analysis and report
I work from your documents and answers. You receive an interim version to check.
4. Delivery and debrief
The final report with priorities and recommendations, and a debrief online or once on site.
The regulatory calendar
Most questions do not come out of nowhere. These are the deadlines moving organisations now.
Checked on 11 October 2026 against the official texts; every date links to its source.
Since 17 January 2025
DORA (Regulation (EU) 2022/2554) applies to financial entities. They keep a register of information on all their contracts for ICT services from third parties and hand it to the NBB on request, through OneGate.
DORA Art. 28(3) and Art. 64; circular NBB_2026_05Since 18 April 2026
NIS2 (Belgian law of 26 April 2024): essential entities had to take a first step: a verification at CyberFundamentals Basic or Important, a self-assessment, or the scope and statement of applicability for ISO 27001.
Royal Decree of 9 June 2024, art. 22Since 11 September 2026
Cyber Resilience Act: reporting of actively exploited vulnerabilities and severe incidents, also for products already on the market.
Regulation (EU) 2024/2847, art. 14 and 71- Today 22 October 2026
18 April 2027
NIS2: final deadline for essential entities: certification at CyberFundamentals Essential or ISO 27001, or the progress status on the inspection route. For important entities the conformity assessment is voluntary.
Law of 26 April 2024, art. 39 and 41; Royal Decree of 9 June 20242 December 2027
AI Act, after the AI Omnibus: obligations for high-risk AI systems in Annex III, including the fundamental rights impact assessment for public bodies and private providers of public services.
Regulation (EU) 2026/174411 December 2027
Cyber Resilience Act fully applicable: technical file and declaration of conformity per product.
Regulation (EU) 2024/2847, art. 71
Why VDHome
Fixed price, no hours
You pay for a result, not for time. The scope is on paper before I start.
Fast through own tooling
I build my reports with my own docs-as-code and analysis tools. That makes them consistent, verifiable and fast.
Trilingual
Every report is available in Dutch, French and English, with no surcharge for translating the base report.
Independent
I do not resell software or licences. Any partner relationship is stated explicitly in the quote.
A question waiting for an answer?
Send a short description of your organisation and your question. You will get a reply with a proposed scope within two working days.