# SecureLeap

> SecureLeap is a cybersecurity and compliance consultancy for startups, based in Porto, Portugal. It helps Seed to Series B companies get a SOC 2 report or ISO 27001 certification, run manual penetration tests, and work with a virtual CISO (vCISO) instead of hiring a full-time security executive. Work is delivered remotely to clients worldwide, mainly in the EU, the UK and the US.

This file describes what SecureLeap is and does. Prices, timelines and package details change over time, so they are kept on the service pages linked below, which are the source of truth.

## Key facts

- Company: SecureLeap is the trading name of Secureleap Lda, a company registered in Portugal and based in Porto, launched in 2024. The website is in English.
- Founder: Marçal Santos, CISO. He holds the CISM and CDPSE certifications from ISACA, is a former cybersecurity lead at Aircall, Citibank and Talkdesk, has more than 20 years of enterprise security experience and has led more than 30 SOC 2 audits over his career.
- Clients: Seed to Series B startups that sell to enterprises and face customer security reviews, investor due diligence, or a SOC 2 or ISO 27001 deadline, including SaaS, fintech, healthtech and AI companies.
- Frameworks: SOC 2 (Type 1 and Type 2) and ISO 27001 are the core services. SecureLeap also covers ISO 42001, NIS2, GDPR, HIPAA and DORA.
- Audits: SecureLeap prepares companies for audits and manages the auditor, but does not issue SOC 2 reports or ISO 27001 certificates. Independent CPA firms (SOC 2) and accredited certification bodies (ISO 27001) do, and SecureLeap does not guarantee audit results.
- Compliance platforms: SecureLeap is a certified partner of Vanta, Drata and Secureframe. A platform is not required to get SOC 2 or ISO 27001.
- Penetration testing: manual testing by certified penetration testers, with reports built to serve as SOC 2 and ISO 27001 audit evidence and retests of fixed findings included.

## How engagements work

- The first step is a free 30-minute call.
- Projects are quoted at a fixed price after that call, and the price changes only if the scope does. vCISO runs as a monthly plan.
- Work happens remotely inside the client's own tools, such as Slack, ticketing and document workspaces, with no separate portal.
- Compliance programs run in four phases: gap analysis, policies and controls, audit preparation including auditor selection, then audit support and ongoing maintenance.
- SecureLeap works with registered companies, not individuals, under its Terms and Conditions plus a Statement of Work for each engagement.

## Fit

- Good fit: a startup that needs a SOC 2 report or ISO 27001 certificate to close enterprise deals, a pentest report for audit evidence or security questionnaires, or a named security owner without a full-time hire.
- Less of a fit: companies large enough to justify a full-time security executive, and very early teams with no enterprise prospects, no regulated data and no near-term compliance deadline.

## Services

- [SOC 2 consulting](https://www.secureleap.tech/service/soc-2-consulting-services): SOC 2 Type 1 and Type 2 readiness and audit support.
- [ISO 27001 consulting](https://www.secureleap.tech/service/iso-27001-consulting): ISO 27001 implementation through to certification.
- [Penetration testing](https://www.secureleap.tech/service/pentest): Manual penetration testing of web applications, APIs, cloud, mobile apps and networks.
- [Virtual CISO (vCISO)](https://www.secureleap.tech/service/virtual-ciso): A senior security leader who owns the security program without a full-time hire.
- [Compliance platform support](https://www.secureleap.tech/service/compliance-tool-support): Vanta, Drata and Secureframe licences, platform selection and implementation.

## Company

- [Home page](https://www.secureleap.tech/): Overview of the services, clients and testimonials.
- [About](https://www.secureleap.tech/about): Why SecureLeap was founded and how it works.
- [Case studies](https://www.secureleap.tech/blog-category/case-study): Published client engagements.
- [Blog](https://www.secureleap.tech/blog): Guides on SOC 2, ISO 27001, penetration testing, vCISO and compliance platforms.

## Contact

- [Book a free 30-minute call](https://cal.com/marcal-santos-qx8l0j/30min): Direct scheduling with the founder.
- [Email](mailto:info@secureleap.tech): info@secureleap.tech
- [Phone (US)](tel:+19293337861): +1 (929) 333-7861

## Optional

- [Terms and Conditions](https://www.secureleap.tech/terms-of-service): Contract terms for all services.
- [Privacy policy](https://www.secureleap.tech/privacy-policy): How SecureLeap handles personal data and cookies.