Hicomply Ltd. Due Diligence

Run due diligence on Hicomply Ltd.: check compliance and get alerts when suppliers or ownership change.

United Kingdom · owned by Independent (United Kingdom) · hicomply.com · 18 vendors

Hicomply is a UK-based compliance management software company that provides an ISMS platform to help businesses automate and achieve information security certifications such as ISO 27001, SOC 2, NIST, GDPR, and more. Founded in late 2019 by Ed Bartlett and Nick Graham, the platform streamlines audit preparation, risk management, policy management, and controls monitoring. Hicomply is backed by BGF and serves startups, mid-market, and enterprise customers across the UK, US, and EMEA.

Resilience scores

Disruption prediction

The category benchmark for Hicomply Ltd. is a 5% probability of disruption in the next three months.

10 of Hicomply Ltd.'s 18 vendors have incident tracking.

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 18 sub-vendors.

Insights

Last updated 2026-09-29 · revision 2

18 direct vendors, 280 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 7/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Hicomply exhibits a good level of migration readiness, primarily driven by its modern technological approach and vendor relationships. The company's key technologies, which include compliance automation, AI, and over 75 pre-built integrations with REST API/Webhook and SSO capabilities, suggest a modular and adaptable architecture that would facilitate migration efforts. Its strong existing regulatory compliance framework (ISO 27001, SOC 2 Type 2, GDPR, NIS2 applicable) means established processes for data handling and security are already in place, which can streamline compliance during a migration. A major advantage is the low vendor lock-in risk, stemming from a diverse base of 21 vendors, which significantly reduces the complexity and potential costs associated with transitioning away from specific vendor technologies or contracts. However, there are challenges to consider. The explicit data residency requirement to host data in the EU will necessitate careful planning to ensure any new infrastructure or cloud provider maintains this compliance, potentially limiting certain migration options. Additionally, the lack of publicly disclosed financial stability or growth history makes it challenging to assess the company's capacity to fund a potentially significant migration project.

Compliance

8 in-scope frameworks identified; showing 3.

NIS2 (source) — No public evidence

As a UK-based cybersecurity company, Hicomply could be considered a 'digital provider' or 'ICT service management' provider under NIS2 if it offers services to in-scope entities within the EU and meets the size thresholds.

HIPAA (source) — No public evidence

With an office in the US, Hicomply would be subject to HIPAA if it acts as a Business Associate to US healthcare organizations by handling their patients' PHI.

DORA (source) — No public evidence

The Digital Operational Resilience Act applies to financial entities in the EU and their critical third-party ICT service providers. Hicomply's applicability depends on its client base in the EU financial sector.

Evidence: https://www.hicomply.com/company/about, https://www.g2.com/products/hicomply/reviews, https://businesswith.co.uk/grc-systems/, https://enactia.com/best-grc-tool-in-uk-2026-top-compliance-software/

Financials

Three-year financials

Financial Resilience Score: 5/10

Hicomply is a micro-scale UK cybersecurity/GRC SaaS scale-up with limited public financial disclosure due to small-company filing exemptions. The Endole classification indicates turnover under £1m and balance sheet under £500k as of March 2024, which puts the company in a fragile absolute scale relative to well-funded competitors like Vanta, Secureframe, and Scrut. However, the company has meaningful institutional backing from BGF (approximately £3m Series A in September 2021, part of ~$4.92M total funding across Seed and Series A), and has secured additional lending facilities evidenced by three registered charges (April 2024, November 2025, December 2025), suggesting continued access to capital. Growth signals are positive: user base surpassed 20,000 in 2024, headcount grew ~28% to roughly 30 employees by March 2026, a Manchester office opened in May 2025, and North American expansion launched in July 2025. However, the mid-2025 governance transition — founder-CEO Ed Bartlett departing as director on 3 June 2025 and Mark Edgeworth taking over — introduces execution risk. Combined with reliance on a single product line, heavy UK revenue concentration, intense competition from better-funded peers, and lack of public P&L transparency, resilience is moderate at best.

Key strengths: BGF institutional backing (~£3m Series A in 2021), Total institutional funding of ~$4.92M across Seed and Series A, Three registered charges indicating access to secured lending facilities, User base exceeded 20,000 in 2024, Headcount growth of ~28% since 2023, Geographic expansion into Manchester (May 2025) and North America (July 2025)

Risk factors: Micro-scale finances (turnover <£1m, balance sheet <£500k at March 2024), Limited public financial disclosure under small-company exemptions, Funding-dependent growth with last equity round in 2021, Key-person/governance change with founder-CEO departure in June 2025, Intense competition from well-funded peers (Vanta, Secureframe, Scrut), Single-product SaaS concentration with no revenue diversification, Heavy UK geographic revenue concentration

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report