Canadian compliance firm directory
There are no firms in this directory yet. Rather than pad it out with scraped names, this page explains what it will hold and how to be in it when it opens.
The directory is empty. Not filtered to nothing, not loading slowly: there are no firms in it, because it has not opened yet and we are not going to seed it with companies scraped from search results who never agreed to be here.
What we can do today is match you with Canadian firms directly. Describe what you need on the quote form and a person reads it. If you are a firm that wants to appear when the directory opens, the same form is how you register.
What the directory will list
Canadian firms that do compliance and security work for other Canadian companies, in the categories this network covers.
| Category | What that firm does |
|---|---|
| SOC 2 audit firms | CPA firms that examine evidence and issue the report |
| Readiness consultants | Preparation work, policies, evidence, gap remediation |
| ISO certification bodies | Accredited bodies that issue ISO 27001 and ISO 42001 certificates |
| Penetration testing firms | Independent technical testing against an agreed scope |
| vCISO and fractional security leadership | Named accountable security ownership on a part-time basis |
| Privacy advisors | PIPEDA, Law 25, PHIPA and the other provincial statutes |
Each listing will carry the categories the firm actually works in, the provinces it serves, the frameworks it has delivered, and a description written by the firm rather than by us. Audit firms and readiness consultants will be separated rather than merged, because independence rules mean the same firm usually cannot do both for you and a directory that blurs them is misleading in a way that costs its readers money.
How listings will work
Three states, and the difference between them is about who confirmed the information rather than who paid the most.
Unclaimed. A firm we know does this work, listed with public information only. Nothing on an unclaimed listing has been confirmed by the firm itself, and the listing will say so on its face. Any firm can ask to be removed and it will be removed.
Claimed and free. Someone at the firm has confirmed they work there and taken control of the entry: description, categories, provinces, contact route. Free, permanently, with no listing fee and no requirement to buy anything. The point of a directory is that it is complete, and a paywall makes it incomplete.
Verified. A paid tier where we have checked specific claims before publishing them, such as professional registration where the work requires it, insurance, and references from completed engagements. Verified will mean those checks were done, on a stated date, and nothing more than that. It is not a quality ranking and it will never be described as one. When the tier opens, what each check covers will be written on the page rather than implied by a badge.
What a listing will look like
The two rows below are an illustration of the format. They are not real firms, the names are placeholders, and nothing in them describes a company that exists.
Example Readiness Partners Verified
Illustration only. A claimed and verified listing shows the firm's own description here, alongside the categories and provinces it confirmed, and the date the verification checks were done.
Example Security Testing Co. Unclaimed
Illustration only. An unclaimed listing carries public information that the firm has not confirmed, and says so, until someone at the firm claims it.
Adding your firm
Use the same form buyers use and say you are a firm rather than a buyer. Tell us what you do, which provinces you serve, and which frameworks you have actually delivered. There is no fee to be listed and no obligation attached to registering.
Two things worth saying plainly. Registering does not put you in front of anyone today, because there is no directory traffic to be in front of and we are not going to pretend otherwise. And a listing will never be a condition of receiving a match through the quote form. Questions about either go to [email protected].
What to do meanwhile
If you are trying to hire someone now, the useful pages are which framework you actually need, which settles the question before you start calling firms, and how to choose a compliance consultant, which covers what to ask, how engagement models differ and what should end a conversation. Both are more useful than a list of names, and they will still be useful once the list exists.
Get matched now, directory or not
Tell us what you need and which province you are in, and we will point you at Canadian firms that do that work.
Get matchedCommon questions
Why is the directory empty?
Because it has not opened and no firms have been listed. The alternative was to scrape company names into rows so the page looked populated on launch day, which produces a directory whose entries nobody has confirmed and whose subjects never agreed to appear.
Does a listing cost anything?
A claimed listing is free and stays free. The Verified tier is paid, because the checks behind it take someone's time. Pricing for that tier is not set yet, and it will be published on this page rather than quoted privately.
Will paying push our firm higher in the results?
No. Verified indicates that specific claims were checked on a specific date, not that the firm is better than an unverified one. Ordering will be based on the categories and provinces a reader filters for, and where paid placement ever appears it will be labelled as paid placement.
We do not want to be listed. How do we get removed?
Email [email protected] and the listing comes down. No form, no negotiation, and no requirement to explain why.
Can we get matched with a firm before the directory opens?
Yes, and that is the part that works today. The quote form routes to Canadian firms directly, so the absence of a public directory does not stop you from finding someone for a SOC 2, an ISO 27001, a penetration test or a privacy program.