About Asteron
Asteron is a European healthtech compliance and security company. We build and operate Compliance Core and ISO 27001, Compliance Operations, privacy and health-data governance, medical-software security and lifecycle programmes, AI governance, national market readiness and Security Operations for teams building regulated software.
The problem we're solving
European healthtech teams are absorbing an unusually dense wave of regulation: ISO 27001, medical-software lifecycle (IEC 81001-5-1, IEC 62304, ISO 13485, ISO 14971), MDR and IVDR obligations, GDPR Article 9 for health data, ISO 27701 and ISO 42001, NIS2, CRA, product liability and national requirements such as NEN 7510, Cyberbeveiligingswet, DiGA and HDS.
The real cost is internal time. Product, engineering and clinical leaders end up carrying compliance in parallel with delivery, and each new obligation restarts the coordination from scratch. Asteron exists to keep this work structured, contained and reusable across frameworks.
As NIS2, the EU AI Act, the Cyber Resilience Act, EHDS and hospital procurement obligations expand, the number of companies affected keeps growing. A single Compliance Core reused across frameworks is the only way to keep this manageable at healthtech pace.
Our solution
Asteron delivers structured compliance and security engagements against a defined scope, timeline and price. Independent certification decisions and audit outcomes remain with accredited third-party bodies.
Our automation layer handles evidence collection via API integrations, continuous control monitoring, structured risk modeling, and policy generation tailored to your actual tech stack and workflows. This isn't a third-party platform we configure for you - it's internal tooling built around how European certification bodies evaluate companies.
Automation covers evidence, monitoring and structured documentation. The rest requires human judgement: understanding your product and business context, making defensible risk decisions, running an internal audit, preparing your team and coordinating with the independent certification body that ultimately assesses the system.
That's where your dedicated expert operates - not replacing the automation, but working on top of it. The result is a faster, more predictable path to certification with significantly less involvement from your team. Fixed scope, fixed price, and a contractual guarantee on our deliverables.
Who we are
Asteron was started by a team from European tech and enterprise software - engineers and operators who saw how much damage the traditional compliance process does to fast-moving companies.
We built Asteron around a simple thesis: if you combine structured automation with focused human expertise and run it as a productized delivery model, you can make certification dramatically faster and less painful - without sacrificing the quality that auditors expect.
Our team combines compliance engineering, information-security operations and regulated-software experience. We build management systems that hold up under independent assessment; the certification decision itself is always made by the accredited body, not by us.
We work exclusively with European healthtech: digital health, medical-device software and clinical AI. That focus lets us reuse a common Compliance Core across ISO 27001, ISO 27701, ISO 42001, IEC 81001-5-1, NEN 7510, GDPR Article 9, NIS2, CRA, MDR and IVDR obligations, and understand the national market context in the Netherlands, Germany, France and adjacent jurisdictions.
How we work
Outcome over activity
We don't sell hours or advisory retainers. We sell a structured path to certification with defined scope, clear deliverables, and a contractual guarantee. Every decision - what to automate, what to handle manually, how to sequence the project - is made to minimize your team's involvement and maximize the chance of a clean audit.
Automation where it removes real work
We automate what used to take weeks of manual effort: evidence collection, control monitoring, risk register generation, policy drafting. Your team shouldn't spend engineering hours on tasks that an integration or a script can handle better and faster.
Human layer where judgment matters
Automation doesn't attend your audit. It doesn't prepare your team for auditor questions or negotiate timelines with a certification body. We keep a dedicated expert on every project for the work that still requires context, judgment, and accountability.
European focus as an operating advantage
We work with European regulatory requirements and European companies. That focus is what allows the Compliance Core to be reused across frameworks and countries; certification and assessment decisions remain with the accredited bodies that perform them.
Our mission
Enterprise-grade certification shouldn't require enterprise-grade overhead. Our mission is to make ISO certification operationally realistic for European healthtech companies - faster to complete, lighter on the team, and backed by someone who shares responsibility for the outcome.
Want to learn more?
Book a free 30-minute assessment. We'll evaluate your setup, walk you through the process, and tell you if we're a fit - honestly.