The Trust Bridge Due Diligence

Run due diligence on The Trust Bridge: check compliance and get alerts when suppliers or ownership change.

United Kingdom · owned by Independent (United Kingdom) · thetrustbridge.co · 9 vendors

The Trust Bridge is a UK-based consultancy specialising in data protection, cybersecurity, and compliance services, helping organisations align with GDPR, PECR, DORA, NIS2, the AI Act, and other global data privacy regulations. The company offers a 'done for you' model acting as a Virtual Data Protection Officer, Virtual CISO, and Compliance-as-a-Service partner, including ISO certification preparation and incident response. It also co-owns a UK GDPR certification scheme with ICO-approved certification criteria and serves both UK and US markets.

Resilience scores

Technology vendors

Insights

Last updated 2026-09-16 · revision 2

9 direct vendors, 126 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

8 in-scope frameworks identified; showing 3.

NIS2 (source) — No public evidence

As a cybersecurity firm, it could be considered a provider of ICT service management. The EU's NIS2 Directive applies to such providers if they are medium/large and serve entities within the EU. Its size and EU operations are not confirmed.

Evidence: https://www.figgroup.co.uk/blog/nis2-directive-uk-businesses-2026, https://www.bureauveritas.co.uk/cybersecurity/network-and-information-security-directive-nis2, https://www.ajg.com/uk/news-and-insights/nis2-in-focus-a-guide-to-building-a-secure-compliant-uk-business/, https://www.transputec.com/blogs/nis2-uk/, https://www.trendmicro.com/en_gb/compliance/nis2-directive.html

SOC 2 (source) — No public evidence

SOC 2 is a voluntary compliance standard for service organizations, developed by the AICPA. It is effectively required by customers who need assurance about the security, availability, processing integrity, confidentiality, and privacy of their data.

UK CSRB — No public evidence

The prompt's 'UK CSRB' likely refers to the UK's cybersecurity regulatory framework, principally The Network and Information Systems Regulations 2018. This applies to operators of essential services and relevant digital service providers.

Evidence: https://www.gov.uk/government/collections/nis-directive-and-nis-regulations-2018, https://ico.org.uk/for-organisations/the-guide-to-nis/what-is-nis/, https://www.gov.uk/government/publications/network-and-information-systems-regulations-2018-health-sector-guide/the-network-and-information-systems-regulations-2018-guide-for-the-health-sector-in-england, https://learn.microsoft.com/en-us/compliance/dora/dora-what-is-dora, https://www.whitecase.com/insight-alert/reform-uks-cybersecurity-regime-incoming, https://outpost24.com/blog/uk-cybersecurity-resilience-bill-need-to-know/

Financials

Three-year financials

Financial Resilience Score: 5/10

The Trust Bridge (The Bridge Group Limited, CH 09533176) is a long-established micro-scale UK consultancy that has traded continuously since April 2015, filing accounts on schedule every year under the total-exemption small/micro-entity regime. This filing status means revenue, EBIT, and detailed P&L data are not on the public record, so quantitative resilience cannot be verified from Companies House. Qualitatively, the business benefits from regulatory tailwinds (GDPR, PECR, CCPA, DORA, NIS2, e-privacy laws), founder continuity under David Clarke (CISO) and Penny Heyes (COO), and credibility-enhancing partnerships such as its cyber-attack simulation workshops with Squire Patton Boggs. Offsetting these strengths are material scale and concentration risks. The company qualifies for total-exemption filings, implying turnover well below the UK small-company threshold of £10.2m and likely at micro-entity level. Third-party trackers estimate headcount between 3 (Apollo) and 11-50 (Crunchbase), suggesting heavy reliance on a small core team plus associates. Key-person concentration around Clarke and Heyes, competitive pressure from Big 4 and boutique law-firm-linked practices, and limited public transparency all weigh on the score. On balance, the firm appears stable but small and vulnerable, meriting a mid-range resilience score.

Key strengths: Continuous trading since April 2015 with on-schedule Companies House filings, Founder/director continuity (David Clarke CISO, Penny Heyes COO), Regulatory tailwinds from GDPR, PECR, CCPA, DORA, NIS2, e-privacy laws, Credibility partnerships (Squire Patton Boggs cyber-attack simulation workshops), Transatlantic footprint (UK + South Carolina, USA), Diversified service lines: advisory, TrustBridge Report, training, vDOC managed service

Risk factors: Micro-entity scale - turnover likely well below UK small-company threshold of £10.2m, Key-person concentration on two named principals (Clarke, Heyes), Limited public financial transparency (total-exemption filings, no P&L disclosed), Crowded competitive landscape (Big 4, boutique law-firm practices, MSSPs, Trustify), Undisclosed but likely client concentration risk typical for boutique consultancies, International marketing ambition (UK/EU/US/Canada) vs. very thin operating base

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report