# Qontrol

> Qontrol is the vCISO-first GRC platform for cybersecurity consultants and their SMB clients. It replaces Excel, Word, and a patchwork of point tools with a single, European, agentic platform to run governance, risk, and compliance (GRC) missions at scale.

Qontrol serves two audiences from one codebase:
- **vCISO consultants** (default, root URL): independent consultants, MSPs and MSSPs who run 3–20 client portfolios and want to scale without losing quality. Pricing: 20€/consultant/month (seat) + 69€/client/month (licence).
- **SMB / Mid-cap end-users** (`/enduser/`): internal cyber/IT leaders piloting compliance directly, alone or alongside a vCISO. Pricing: 69€/month per licence, optional +1.50€/user/month for user governance.

The site is bilingual: **French** (default, no URL prefix) and **English** (`/en/`). Company is based in Paris, France; infrastructure hosted in France at OVH.

## Core pages (vCISO — priority audience)

- [Qontrol Home (vCISO)](https://www.qontrol.io/): elevator pitch — industrialize your cyber consulting practice without losing quality.
- [Pricing vCISO](https://www.qontrol.io/pricing): seat + licence pricing model, FAQ about packaging and partner rates.
- [Qontrol Pilot for vCISO](https://www.qontrol.io/product/pilot): continuous GRC management across a client portfolio — compliance, risks, documentation, reporting, collaboration.
- [Qontrol Avant-vente](https://www.qontrol.io/product/avant-vente): pre-sales diagnostic from a prospect's domain name.
- [Qontrol Gestion](https://www.qontrol.io/product/gestion): multi-client industrialization — libraries, templates, centralized operations.
- [Qontrol Diagnostic des Usages](https://www.qontrol.io/product/diagnostics/usages): conversational 3-min/day assessment of real-world user behavior (NPS 4.6/5).

## Core pages (SMB end-user)

- [Qontrol Home (SMB)](https://www.qontrol.io/enduser): piloter sa cyber seul ou accompagné.
- [Pricing SMB](https://www.qontrol.io/enduser/pricing): licence unique 69€/mois, option governance utilisateurs +1.50€/user/mois.
- [Find a vCISO](https://www.qontrol.io/enduser/find-vcisos): directory of partner vCISO consultants.
- [Qontrol Pilot for SMB](https://www.qontrol.io/enduser/product/pilot): GRC platform for internal use.
- [Qontrol Diagnostic des Usages (SMB)](https://www.qontrol.io/enduser/product/diagnostics/usages): conversational user behavior diagnostic.

## Resources

- [Blog](https://www.qontrol.io/blog): product updates, cyber governance and compliance insights.
- [Blog RSS feed](https://www.qontrol.io/blog/feed.xml)
- [Référentiels couverts](https://www.qontrol.io/referentiels): 15+ frameworks mapped (ISO 27001, NIS2, DORA, SOC 2, GDPR, ANSSI, TISAX, CIS, SecNumCloud, CRA, etc.).
- [White Paper 2030 — Cyber consulting](https://www.qontrol.io/white-papers/white-paper-consultant-cyber-2030)
- [Sitemap](https://www.qontrol.io/sitemap.xml)

## Legal and trust

- [Privacy Policy](https://www.qontrol.io/legal/privacy)
- [Terms of Service](https://www.qontrol.io/legal/tos)
- [Data Processing Agreement](https://www.qontrol.io/legal/dpa)
- [Acceptable Use Policy](https://www.qontrol.io/legal/aup)
- [Mentions légales](https://www.qontrol.io/mentions-legales)

## Vocabulary (glossary)

- **vCISO** (virtual CISO, a.k.a. RSSI externalisé in French): an external cybersecurity leadership role served on a fractional or on-demand basis. vCISOs typically run 3–20 client portfolios in parallel, unlike an internal CISO serving one company.
- **GRC** (Governance, Risk & Compliance): the discipline that bundles policy governance, risk analysis, and compliance management. Qontrol is a GRC *orchestration* platform — it does not replace human expertise, it industrializes delivery.
- **RSSI** (Responsable de la Sécurité des Systèmes d'Information): French equivalent of CISO.
- **SMSI** / **ISMS**: Information Security Management System — the set of policies and processes required by ISO 27001.
- **ISO 27001**: international standard for information security management. Flagship GRC certification for B2B enterprise sales.
- **NIS2**: EU directive (2022/2555) extending cybersecurity obligations to essential and important entities across 18 sectors. Transposition deadline passed in October 2024.
- **DORA**: EU Digital Operational Resilience Act — cyber resilience requirements for financial entities, in force since January 2025.
- **SOC 2**: American attestation framework (AICPA) for service organizations handling customer data.
- **RGPD / GDPR**: EU data protection regulation.
- **ANSSI**: French national cybersecurity agency; publishes the HDS, SecNumCloud and LPM frameworks.
- **CRA**: EU Cyber Resilience Act — security requirements for products with digital elements.
- **Diagnostic des Usages**: Qontrol's signature module — 3-min/day conversational parcours for each team member that surfaces the gap between security theory and actual digital behavior.

## Positioning and differentiators

- **vCISO-first**: the product was designed starting from the vCISO workflow (multi-client, industrialization), not retrofitted from a single-company tool.
- **European sovereignty**: French company, hosted at OVH in France; RGPD/NIS2-native; no US data transfers.
- **Agentic**: AI agents embedded in GRC workflows for drafting, mapping, and analysis — not a chatbot bolted on.
- **Business model fit**: seat (recurring consultant cost) + licence (per-client) aligns Qontrol's revenue with consultant growth, not seat count inflation.
- **15-day SLA for new frameworks**: if a client asks for a framework not yet mapped, Qontrol adds it in ≤15 days.

## Contact

- Website: https://www.qontrol.io
- LinkedIn: https://www.linkedin.com/company/qontrol-io
- Founder: Michael Monerau (CEO, Articule SAS, trading name Qontrol)
- Headquarters: 231 rue Saint-Honoré, 75001 Paris, France