# Qalea > Qalea is a cybersecurity and compliance platform based in Barcelona, Spain. It combines continuous security monitoring with continuous compliance management in one system, acting as the in-house security team that small and mid-sized companies cannot afford to staff. It replaces the usual mix of point tools, external consultants, and spreadsheet-driven audit preparation. Qalea Cybersecurity S.L. was founded in 2022 and operates from Barcelona. Its customers are typically small and mid-market companies in Spain and the wider EU, bought by CISOs, IT leads, and operations or compliance owners — often teams pursuing a first certification, or maintaining several frameworks at once without dedicated security headcount. ## What Qalea does Qalea covers three coordinated areas, wrapped in a continuous monitoring layer (endpoint detection and response, SIEM, and a security operations centre): - **Processes (compliance)**: framework scoping, policies and procedures, risk management, auditable controls, automated evidence collection, and audit preparation. Controls map across frameworks, so one control can satisfy requirements in several standards at once. - **People**: security awareness training, phishing simulations, endpoint protection, mobile device management, SaaS and identity visibility, and password manager rollout. - **Infrastructure**: external attack surface management, internal surface, cloud posture, applications, and source code analysis (SAST, SCA, SBOM, DAST). Frameworks supported include ISO 27001, SOC 2, ENS, DORA, NIS2, PCI-DSS, HIPAA, ISO 9001, ISO 42001, and GDPR. Integrations include Microsoft 365, Google Workspace, AWS, Azure, Google Cloud, GitHub, Bitbucket, Slack, Notion, Apple, Windows, and Linux, plus a lightweight endpoint agent. Qalea is certified to ISO 27001:2022 by AENOR and holds an ENS certification. Current attestations are published in its Trust Center. In 2026 Qalea announced a US$1,000,000 pre-seed round; the CEO and co-founder is Olmo Rayón. Customers include Cuideo, Payflow, Worldsensing, Build38, Embat, iContainers, Plytix, ioBuilders, Barkibu, Bdeo, IriusRisk, Invopop, Civitfun, and Method. ## Product and platform - [Qalea homepage](https://www.qalea.ai/): What Qalea is, the unified compliance and security model, and the five-step path from framework selection to audit-ready. - [Platform features](https://www.qalea.ai/#features): Security coverage by layer — external surface, employees and identities, infrastructure, applications, and source code. - [Certifications supported](https://www.qalea.ai/#certifications): The frameworks Qalea helps companies certify against. - [Integrations](https://www.qalea.ai/#integrations): The cloud, identity, code, endpoint, and productivity tools Qalea connects to for evidence collection and monitoring. - [Customers](https://www.qalea.ai/#customers): Companies using Qalea, with testimonials from Worldsensing and Build38. - [FAQs](https://www.qalea.ai/#faqs): How Qalea automates compliance work, which frameworks are covered, supported integrations, data-security practices, and how Qalea differs from compliance-only software. - [Contact Qalea](https://www.qalea.ai/contact): Book a demo or request a call. A member of the team replies within one business day. - [Free risk assessment](https://www.qalea.ai/free-risk-assessment): A no-obligation review of gaps, attack surface and security posture, returned as a prioritised plan. - [SOC 2 compliance checklist](https://www.qalea.ai/soc-2-compliance-checklist): Free downloadable SOC 2 readiness checklist covering scope, policies, the nine Common Criteria, evidence, and the audit. ## Guides on compliance frameworks - [Does ENS apply to your company, and at which level?](https://www.qalea.ai/blog/ens-conformity-declaration-or-certification): Who the Esquema Nacional de Seguridad reaches, including foreign suppliers to Spanish public bodies, which category applies, and when a declaration of conformity is sufficient instead of certification. - [ENS in a public tender: the first steps](https://www.qalea.ai/blog/ens-in-a-public-tender-first-steps): What to do when a Spanish tender requires ENS and the deadline is short — identifying the required category, declaration versus certification, the article 11 trap, and a two-week plan. - [Running ISO 27001 and ENS as a single programme](https://www.qalea.ai/blog/iso-27001-and-ens-single-programme): Where the two standards overlap and where they diverge, and how to operate one management system that satisfies both audits. - [SOC 2 Trust Services Criteria: the five explained](https://www.qalea.ai/blog/soc-2-trust-services-criteria-explained): Security, Availability, Processing Integrity, Confidentiality and Privacy — which criterion is mandatory, and the difference between Type I and Type II reports. - [DORA: the five pillars, explained](https://www.qalea.ai/blog/dora-five-pillars): What each pillar of EU Regulation 2022/2554 requires, who falls in scope, and how the third-party pillar reaches companies that are not financial institutions. - [Stalled ISO 27001 project: how to restart it](https://www.qalea.ai/blog/stalled-iso-27001-project-restart): What evidence can be salvaged from a stalled implementation, what has to be rebuilt, and the order to do it in before a surveillance audit. ## Guides on compliance operations - [ISMS vs security policies: what's the difference?](https://www.qalea.ai/blog/isms-vs-security-policies): Why a folder of policies is not an information security management system, what ISO 27001 clauses 4 to 10 actually require, and how to tell which one a company has. - [What a certification audit actually tests](https://www.qalea.ai/blog/what-a-certification-audit-actually-tests): The distinction between a documented control, a verified control and an operated control, and what certification audits leave untouched. - [Compliance platform vs security: what a licence misses](https://www.qalea.ai/blog/compliance-platform-vs-security): Why compliance automation documents security rather than performing it, what a licence leaves out — detection, response, monitoring — and an honest cost comparison. - [Best compliance automation platforms for Spain in 2026](https://www.qalea.ai/blog/compliance-automation-platforms-spain): How to evaluate compliance software for the Spanish market, centred on ENS coverage alongside ISO 27001 and whether a platform operates security or only documents it. ## Guides on security operations - [External attack surface: what you're exposing online](https://www.qalea.ai/blog/external-attack-surface-exposed-online): Forgotten subdomains, open staging environments and leaked credentials — how to find what a company exposes publicly and prioritise it by real risk. - [MDM: what your company can and can't see](https://www.qalea.ai/blog/mdm-what-your-company-can-and-cannot-see): What mobile device management can and cannot observe on personal (BYOD) versus company-owned devices, covering browsing history, messages, photos and location. ## Blog - [Qalea blog](https://www.qalea.ai/blog): Practical guidance on ISO 27001, ENS, NIS2, DORA and SOC 2 for companies without an internal security team. - Topic indexes: [ISO 27001](https://www.qalea.ai/topics/iso-27001), [ENS](https://www.qalea.ai/topics/ens), [SOC 2](https://www.qalea.ai/topics/soc-2), [DORA](https://www.qalea.ai/topics/dora), [NIS2](https://www.qalea.ai/topics/nis2), [Compliance operations](https://www.qalea.ai/topics/compliance-operations), [Attack surface and pentesting](https://www.qalea.ai/topics/attack-surface-pentesting), [SOC and monitoring](https://www.qalea.ai/topics/soc-monitoring), [Security awareness](https://www.qalea.ai/topics/security-awareness), [Company news](https://www.qalea.ai/topics/company-news). ## Trust and security - [Qalea Trust Center](https://trust.qalea.ai/): Live security and compliance posture, current certifications, and security documentation. - [Privacy Policy](https://www.qalea.ai/privacy-policy): How Qalea processes personal data, data-subject rights, and the scope of Google Workspace access. - [Terms and Conditions](https://www.qalea.ai/terms-and-conditions): Terms governing use of the Qalea website and platform. - [Legal notice (Spanish)](https://www.qalea.ai/legal-notice-es): Aviso legal — corporate identification and legal terms under Spanish law. ## Company news - [Qalea secures US$1 million pre-seed to unify compliance and security](https://www.qalea.ai/blog/qalea-raises-us-1-million): Funding announcement covering the platform's scope, its AI agents, customer traction, and investors. ## Optional - [Log in to Qalea](https://app.qalea.ai/login): Customer application login. Requires authentication and contains no public content.