The Trust Bridge

United Kingdom · owned by Independent (United Kingdom) · thetrustbridge.co · 9 vendors

The Trust Bridge is a UK-based consultancy specialising in data protection, cybersecurity, and compliance services, helping organisations align with GDPR, PECR, DORA, NIS2, the AI Act, and other global data privacy regulations. The company offers a 'done for you' model acting as a Virtual Data Protection Officer, Virtual CISO, and Compliance-as-a-Service partner, including ISO certification preparation and incident response. It also co-owns a UK GDPR certification scheme with ICO-approved certification criteria and serves both UK and US markets.

Resilience scores

Disruption prediction

The Trust Bridge has an estimated 17% probability of disruption in the next 6 months.

7 of The Trust Bridge's 9 vendors monitored for disruptions.

Technology vendors

Insights

Last updated 2026-09-16 · revision 2

9 direct vendors, 144 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 8/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

The Trust Bridge exhibits a strong migration readiness, scoring 75. A primary advantage is their deep expertise and specialization in a comprehensive range of regulatory and security frameworks (GDPR, ISO 27001, DORA, NIS2, EU AI Act, CCPA, SOC 2). This profound understanding of compliance requirements would significantly streamline any migration effort by proactively addressing legal and security considerations. Their current internal tech stack is predominantly SaaS-based (Wix.com, Amazon Web Services S3, JotForm, Calendar.com, GoToStage, Livestorm), meaning they are already operating in a cloud-native consumption model. This eliminates the significant challenge of migrating from legacy on-premise infrastructure. However, while already cloud-based, migrating *away* from these specific SaaS platforms could present challenges due to inherent vendor lock-in, requiring effort in data extraction, re-platforming, and process re-engineering. The company relies on approximately 6 key SaaS vendors, which represents a moderate level of vendor lock-in. The geographic concentration of these vendors (US and Israel) is also moderate. Data residency requirements are not explicitly specified, which could introduce unknown complexities if strict, unaddressed requirements exist. The absence of financial stability data (revenue, growth) also limits the assessment of their capacity to fund a major migration project. Despite these challenges, their strong regulatory knowledge and existing cloud-based operational model position them well for future migrations.

Compliance

8 in-scope frameworks identified; showing 3.

NIS2 (source) — Assessment Required

As a cybersecurity firm, it could be considered a provider of ICT service management. The EU's NIS2 Directive applies to such providers if they are medium/large and serve entities within the EU. Its size and EU operations are not confirmed.

If The Trust Bridge provides cybersecurity services to 'Essential' or 'Important' entities operating in the EU, it could be directly in scope. Non-compliance would risk significant fines and exclusion from EU markets. The likelihood is medium as its EU client base is unconfirmed.

Evidence: https://www.figgroup.co.uk/blog/nis2-directive-uk-businesses-2026, https://www.bureauveritas.co.uk/cybersecurity/network-and-information-security-directive-nis2, https://www.ajg.com/uk/news-and-insights/nis2-in-focus-a-guide-to-building-a-secure-compliant-uk-business/, https://www.transputec.com/blogs/nis2-uk/, https://www.trendmicro.com/en_gb/compliance/nis2-directive.html

ISO 27001 (source) — Assessment Required

ISO 27001 is a voluntary information security management standard, not a legal requirement. However, it is a significant benchmark for cybersecurity companies and is often required by clients to demonstrate security posture.

In the cybersecurity sector, ISO 27001 certification is a common client expectation and competitive differentiator. Lacking it could result in lost business opportunities, representing a medium commercial risk.

SOC 2 (source) — Assessment Required

SOC 2 is a voluntary compliance standard for service organizations, developed by the AICPA. It is effectively required by customers who need assurance about the security, availability, processing integrity, confidentiality, and privacy of their data.

Similar to ISO 27001, a SOC 2 report is frequently required by clients, especially in North America, to provide assurance over security controls. The absence of a report could be a barrier to winning contracts.

Financials

Three-year financials

Financial Resilience Score: 5/10

The Trust Bridge (The Bridge Group Limited, CH 09533176) is a long-established micro-scale UK consultancy that has traded continuously since April 2015, filing accounts on schedule every year under the total-exemption small/micro-entity regime. This filing status means revenue, EBIT, and detailed P&L data are not on the public record, so quantitative resilience cannot be verified from Companies House. Qualitatively, the business benefits from regulatory tailwinds (GDPR, PECR, CCPA, DORA, NIS2, e-privacy laws), founder continuity under David Clarke (CISO) and Penny Heyes (COO), and credibility-enhancing partnerships such as its cyber-attack simulation workshops with Squire Patton Boggs. Offsetting these strengths are material scale and concentration risks. The company qualifies for total-exemption filings, implying turnover well below the UK small-company threshold of £10.2m and likely at micro-entity level. Third-party trackers estimate headcount between 3 (Apollo) and 11-50 (Crunchbase), suggesting heavy reliance on a small core team plus associates. Key-person concentration around Clarke and Heyes, competitive pressure from Big 4 and boutique law-firm-linked practices, and limited public transparency all weigh on the score. On balance, the firm appears stable but small and vulnerable, meriting a mid-range resilience score.

Key strengths: Continuous trading since April 2015 with on-schedule Companies House filings, Founder/director continuity (David Clarke CISO, Penny Heyes COO), Regulatory tailwinds from GDPR, PECR, CCPA, DORA, NIS2, e-privacy laws, Credibility partnerships (Squire Patton Boggs cyber-attack simulation workshops), Transatlantic footprint (UK + South Carolina, USA), Diversified service lines: advisory, TrustBridge Report, training, vDOC managed service

Risk factors: Micro-entity scale - turnover likely well below UK small-company threshold of £10.2m, Key-person concentration on two named principals (Clarke, Heyes), Limited public financial transparency (total-exemption filings, no P&L disclosed), Crowded competitive landscape (Big 4, boutique law-firm practices, MSSPs, Trustify), Undisclosed but likely client concentration risk typical for boutique consultancies, International marketing ambition (UK/EU/US/Canada) vs. very thin operating base

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report