shatov-consulting.com

What It Is

Shatov Consulting Services is not a traditional SaaS platform, but an independent compliance consulting service based in Frankfurt. According to its website, it serves EU fintech companies, financial institutions, Crypto-Asset Service Providers, ICT vendors, and growing B2B technology companies, helping clients pass DORA audits, complete MiCA authorization, establish EU AI Act governance frameworks, and address broader enterprise compliance needs such as ISO 27001, SOC 2, NIS2, and ISO 22301.

Core Capabilities

Its service modules are fairly comprehensive. Key areas include ISO 27001:2022 gap analysis, Statement of Applicability, ISMS scoping, risk assessment, internal audit planning, and pre-certification preparation. For SOC 2, it covers Trust Services Criteria scoping, control mapping, and evidence frameworks. For DORA / ICT third-party risk management, it covers vendor inventories, criticality assessments, due diligence templates, contract clauses, ongoing monitoring, exit plans, and the Register of Information. For sales-led B2B companies, the security questionnaire response library is a practical feature: it can cover SIG, SIG-Lite, CAIQ v4, and customer-specific questionnaires, reducing repeated back-and-forth from sales and legal teams to engineering.

Pricing and Delivery

The website only states that services can be delivered on a project basis or as a fractional compliance lead, and it offers a free initial 30-minute consultation. It does not disclose fixed packages, hourly rates, or project pricing. Delivery is mainly based on consulting, documentation, control frameworks, evidence packages, and pre-audit preparation, rather than software subscriptions.

Pros and Cons

Its strengths are clear positioning and strong relevance for EU finance, crypto-asset, ICT supply chain, and enterprise SaaS pre-sales compliance scenarios. It covers a broad range of regulations and standards, and clearly distinguishes the role of a consultant from that of a certification or audit body. The limitations are that it is not an automated compliance platform, and it does not disclose integrations, APIs, permission management, dashboards, or continuous monitoring product capabilities. Technical implementation such as penetration testing, vulnerability management, and security operations would need to be handled by the client’s engineering team or external technical partners. Pricing transparency is also limited.

Who It’s For and Access from China

It is better suited to companies preparing to enter the EU or US enterprise customer market, companies being asked by customers for ISO 27001 / SOC 2, companies receiving DORA flow-down questionnaires, or organizations that need MiCA, NIS2, or DORA compliance design. Chinese companies serving European financial clients could evaluate it as an EU-based compliance advisor. The text does not specify website hosting or accessibility from mainland China, and payment methods are not disclosed. If a SaaS alternative is needed, it can be compared with automated compliance platforms such as Vanta, Drata, Secureframe, and Sprinto.