100% Made in Germany
Built in Germany, hosted in the EU. German data residency — vendor and subprocessor review against documented sovereignty criteria.
Control what matters · Made in Germany · Hosted in the EU
Control what matters.
GRC for mid-market, utilities, agencies and staffing firms.
deveca GRC keeps ISMS, risks, actions and evidence in one place. ISO 27001, NIS2, BSI IT-Grundschutz and privacy — with the specialist teams, not only the CISO office. Audit-ready and without Excel chaos.
Try free for 6 weeks
No contract, no credit card. Afterwards a permanent Free plan with Micro-ISMS.
6 weeks freeNo contractNo credit cardReady in 5 minutes
grc.deveca.app
Frameworks · available live
Planned frameworks: DORA, SOC 2, PCI DSS, HIPAA — see the roadmap.
ISO 27001
ISO 9001
ISO 27701
TISAX
NIS2
BSI IT-Grundschutz
GDPR
EU AI Act
HinSchG
Cyber Resilience Act
ISO 27001
ISO 9001
ISO 27701
TISAX
NIS2
BSI IT-Grundschutz
GDPR
EU AI Act
HinSchG
Cyber Resilience Act
Why deveca
A platform built for people who actually do GRC.
Six promises we keep in a measurable way — not only on marketing slides.
Tenant-isolated · security by design
Every tenant gets its own schemas and keys. Encryption at rest and in transit, granular RBAC, complete audit logs.
Framework-independent
TISAX without ISO — or together: modules combine freely. You pay only for what you need.
SharePoint distribution
Push policies into Microsoft 365, collect read acknowledgements and send news to the right audiences.
AI-native GRC
An AI assistant in every workflow: evidence check, crosswalk gaps, RoPA/DPIA drafts and 6 agentic AI agents — not bolted on afterwards.
Whistleblowing, done properly
A complete whistleblowing portal with anonymous communication, a case file, deadline control and action tracking.
Modules
What you actually run.
Only capabilities from the product catalogue. Anything not live is marked in preparation.
ISMS / ISO 27001
Scope, policies, controls, SoA and evidence.
NIS2
Framework in the platform. Applicability and notification timelines free on the website; we do not file authority registrations for you.
BSI IT-Grundschutz
Live control set. KRITIS as its own framework: in preparation.
Risk management
IT and business risk with methodology, matrix and KPIs/KRIs.
BCM including PDF plan
Business continuity plans with flow editor and PDF — in Professional.
Assets and processes
Inventory with CIA rating; process modelling is live.
Actions
Central register with deadlines, owners and links to risk, audit, incident.
Incidents / notification paths
Incidents, root cause, notification-duty check.
GDPR data-subject requests
Art. 15–22 including the DSR portal.
Audit / evidence
Audit programme, evidence, time-limited auditor access.
Multi-company
Starter: 1 company. Professional: up to 3. Group: unlimited with group overview.
Integrations
Microsoft 365 and Entra login live. ServiceNow: in preparation.
Modules
View all modules One platform. 25 modules live.
25 modules ready to use. Further integrations and frameworks sit on the roadmap.
Three packages, unlimited users.
Starter €349/month net, Professional €849, Group from €1,499. After the trial a 24-month term.
Starter
A small NIS2-obligated organisation: one company, one framework — and every user who needs to take part.
349 €/month net
Start now — freeProfessional
RecommendedMid-market and utilities with several companies: all live frameworks, BCM and Microsoft 365 / Entra login.
849 €/month net
Start now — freeGroup
Group-wide overview across unlimited companies — with Entra group→role mapping and a guided start.
from1.499 €/month net
Request a conversationSovereign IT
German data. German servers. German responsibility.
100% Made in Germany, hosted in the EU. German data residency: vendor and subprocessor review against documented sovereignty criteria — transparent for audits and procurement.
- Hosting in Nuremberg · ISO 27001 certified data centre
- Backup data centre in Falkenstein · geographically separate
- German data residency · hosted in the EU
- Full DPA under Art. 28 GDPR
- Vendor and subprocessor review against sovereignty criteria
- TOMs aligned with BSI IT-Grundschutz (technical and organisational)
Sovereignty guarantee
Made in Germany · Hosted in the EU
- Primary site
- Nuremberg
- Backup site
- Falkenstein
- Data residency
- Germany
- AI inference
- EU-private
- Encryption
- AES-256 / TLS 1.3
- Processing
- DPA included
Full security documentation
Security and privacyHighlights
Four capabilities you will miss everywhere else.
Root-cause analysis people actually use
5-Why, Ishikawa, fault-tree analysis, timeline analysis and configurable methods — inside every incident, not in a separate spreadsheet.
5-WhyIshikawaFault tree (FTA)TimelineCustom methodsLessons learned
ISMS into SharePoint automatically — including news
Publish policies, instructions and news into the right SharePoint libraries in one click. Read acknowledgements, versioning and automatic reminders included.
- 1Create and approve the policy in deveca
- 2deveca syncs it to SharePoint, including permissions
- 3News post to site, department or function
- 4Read acknowledgement and reminder requested automatically
HinSchG portal with a real case file
Anonymous whistleblowing portal with a two-way mailbox, encrypted attachments, investigation steps and automatic deadline monitoring (7-day acknowledgement, 3-month feedback).
Go to the HinSchG moduleForce-directed graph: what is actually connected?
Aggregates 20+ relationships — assets, risks, controls, suppliers, sites. Filter by protection need or owner and drill into every element. It looks like a map and serves as audit evidence.
Explore the graphRoadmap
What comes next.
Transparency instead of vapourware. These modules are in active development and roll out as they are ready.
In planning
Atlassian bridge (Jira & Confluence)
Two-way connection to Jira (incidents, actions, CAPA) and Confluence (policy mirroring). Issues, status changes and evidence flow without a media break.
In planning
Vulnerability connectors (Greenbone, OpenVAS, Nessus)
Import scan results from Greenbone / OpenVAS, Tenable Nessus and OWASP Dependency-Check. Automatic CVE/CVSS matching onto assets and controls.
Research
CMDB sync (ServiceNow, i-doit)
Two-way sync with ServiceNow and i-doit: assets, owners and dependencies are imported automatically — deveca adds protection needs and control mapping.
Coming soon
DORA framework
Preconfigured control set for the Digital Operational Resilience Act in the financial sector.
Coming soon
SOC 2 Type II framework
Trust Services Criteria as a native mapping, with crosswalks to ISO 27001.
Coming soon
PCI DSS v4 framework
Payment Card Industry controls for payment service providers and merchants.
Check, checklist, supplier reply.
NIS2-Betroffenheitscheck8–12 Fragen zu Sektor, Größe und Umsatz. Ergebnis sofort im Browser.NIS2-/ISMS-Startcheckliste§ 30 und § 32 BSIG als abhakbare Liste. Download gegen geschäftliche E-Mail.Lieferantenanfrage beantwortenFür Agenturen, Zeitarbeit und Mittelstand, die Fragebögen von NIS2-Kunden bekommen.Meldefristen-Rechner24 Stunden, 72 Stunden, ein Monat – Zeitplan ab Kenntnis des Vorfalls.
Six weeks to try. Then decide.
No credit card, no commitment during the trial. Then Free with Micro-ISMS or a paid package with 24 months. Group and individual onboarding: request a conversation.