25 integrated modules — from cockpit and risk through GDPR, TPM and the EU AI Act to SBOM, CRA and ISO 9001 QMS. Each module is productive on its own.
25 modules in production. Wording taken from the platform module catalogue.
The same live modules cover NIS2, ISO 27001, BSI IT-Grundschutz, KRITIS-related duties and the other live frameworks. Planned frameworks are marked separately.
ISO-aligned management-system scope with PDF export, org structure, sites, obligations and interested parties as the foundation for risk and controls.
Policy register with versioning, multi-step approval, a policy centre for end users, PDF export and optional SharePoint synchronisation.
Configurable dashboard with KPI widgets, approval inbox, global search and a dependency graph. Everyone sees their priorities — with a complete audit log.
Training campaigns for security and compliance courses with attendance tracking as auditable evidence.
Full risk lifecycle: identification, assessment, treatment, review. Configurable matrix, escalation routes and mapping to ISO 27001, TISAX, NIS2 and BSI.
Strategic and operational business risks with KRIs, your own risk criteria and management reporting for the board and executive team.
IT assets, information, applications and infrastructure with CIA ratings, lifecycle, dependencies and confidentiality classes — visualised as a graph.
Central action register with status tracking and links to risks, controls, audits and incidents — including owners, due dates and escalation.
Preconfigured control sets, statement of applicability, crosswalks between frameworks, evidence attachments, maturity ratings and a compliance dashboard.
Incident register with RCA (fault tree and more), notification assessment for NIS2/GDPR, incident portal, BCM plans with a flow editor and PDF reports.
Process register, BPMN editor, interactive process map (React Flow) and policy-centre integration for staff.
SLA dashboard, policies, agreements, a calendar with automatic escalation on breach, and OLA tracking for internal service agreements.
Audit planning, calendar, findings management, evidence per finding and a dedicated auditor portal with scope grants and time-boxed access.
Complete GDPR module: records of processing, TOMs, DPIA, LIA, data-subject requests, DSR portal, DPA generator, consents, deletion concept and a DPO dashboard.
Supplier register, risk rating, contracts and DPAs, supplier ratings, assessment catalogues, external assessments via token link and automatic review reminders.
Dedicated HinSchG portal with a shareable link, anonymous two-way communication, a case file and deadline monitoring. Included from Growth, otherwise an add-on.
Report builder for individual GRC reports, PDF export (SoA, scope, incidents, BCM, DPA, DPIA) and audit-trail export.
Tenant-isolated S3 storage with folder structure, attachments on every GRC entity and branding assets for portals.
Interactive force-directed graph for asset, risk and control relationships, with drill-downs and filters by site, protection need or owner.
Form builder, categories, submissions with an approval workflow, public forms by link and bulk import from Excel/CSV.
AI system register, automatic risk classification, compliance status and deployer duties under Art. 26 EU AI Act.
QMS overview, quality instruments, quality objectives, customer feedback, change requests and management reviews under ISO 9001 clause 9.3.
SBOM upload (SPDX, CycloneDX), component inventory, dependency graph, NVD vulnerability scan, vulnerability alerts and NVD sync.
Product register for CRA-covered products, conformity assessment, technical documentation and automatic SBOM linking.
Visitor registration, invitation links, reception mode (tablet) and policy-centre integration for visitor information.
Your CISO dashboard in 5 minutes — not 5 weeks of Excel tinkering.
Configurable dashboard with KPI widgets, approval inbox, global search and a dependency graph. Everyone sees their priorities — with a complete audit log.
All plans
Explore moduleScope, stakeholders, obligations — in one place, and auditable.
ISO-aligned management-system scope with PDF export, org structure, sites, obligations and interested parties as the foundation for risk and controls.
All plans
Explore moduleFrom an Excel risk register to an auditable ISMS.
Full risk lifecycle: identification, assessment, treatment, review. Configurable matrix, escalation routes and mapping to ISO 27001, TISAX, NIS2 and BSI.
Starter+
Explore moduleISO 31000 and ISO 27005 on one platform — IT and business risk together.
Strategic and operational business risks with KRIs, your own risk criteria and management reporting for the board and executive team.
Starter+
Explore moduleNo action item falls through the cracks.
Central action register with status tracking and links to risks, controls, audits and incidents — including owners, due dates and escalation.
All plans
Explore moduleAn asset inventory auditors like — with CIA, lifecycle and dependencies.
IT assets, information, applications and infrastructure with CIA ratings, lifecycle, dependencies and confidentiality classes — visualised as a graph.
Starter+
Explore moduleOne control set, every framework — crosswalks cover two audits.
Preconfigured control sets, statement of applicability, crosswalks between frameworks, evidence attachments, maturity ratings and a compliance dashboard.
Starter+
Explore modulePolicies people actually read — with a policy centre.
Policy register with versioning, multi-step approval, a policy centre for end users, PDF export and optional SharePoint synchronisation.
Starter+
Explore moduleExternal auditors see only what they need — securely, and only for a limited time.
Audit planning, calendar, findings management, evidence per finding and a dedicated auditor portal with scope grants and time-boxed access.
Starter+
Explore moduleGDPR built into GRC — with AI for RoPA, DPIA and DPA.
Complete GDPR module: records of processing, TOMs, DPIA, LIA, data-subject requests, DSR portal, DPA generator, consents, deletion concept and a DPO dashboard.
Starter+
Explore moduleFrom incident to notification in hours, not days.
Incident register with RCA (fault tree and more), notification assessment for NIS2/GDPR, incident portal, BCM plans with a flow editor and PDF reports.
Starter+
Explore moduleA protected reporting portal under the HinSchG — anonymous, encrypted, provable.
Dedicated HinSchG portal with a shareable link, anonymous two-way communication, a case file and deadline monitoring. Included from Growth, otherwise an add-on.
Growth+
Explore moduleSpot SLA breaches before the customer does.
SLA dashboard, policies, agreements, a calendar with automatic escalation on breach, and OLA tracking for internal service agreements.
Professional+
Explore moduleA compliant supply chain — from assessment to questionnaire.
Supplier register, risk rating, contracts and DPAs, supplier ratings, assessment catalogues, external assessments via token link and automatic review reminders.
Growth+
Explore moduleCRA-ready from day one — SBOM import, CVE scan and dependency graph.
SBOM upload (SPDX, CycloneDX), component inventory, dependency graph, NVD vulnerability scan, vulnerability alerts and NVD sync.
Group
Explore moduleCyber Resilience Act — conformity documented, not interpreted.
Product register for CRA-covered products, conformity assessment, technical documentation and automatic SBOM linking.
Group
Explore moduleEU AI Act deployer duties — classification and compliance in one module.
AI system register, automatic risk classification, compliance status and deployer duties under Art. 26 EU AI Act.
Growth+
Explore moduleISO 9001 and ISO 27001 on one platform — one audit, two certificates.
QMS overview, quality instruments, quality objectives, customer feedback, change requests and management reviews under ISO 9001 clause 9.3.
Add-on
Explore moduleModel processes, don't just describe them — BPMN linked to GRC.
Process register, BPMN editor, interactive process map (React Flow) and policy-centre integration for staff.
Growth+
Explore moduleVisitors documented, NDA confirmed — ready for ISO 27001 Annex A.7.
Visitor registration, invitation links, reception mode (tablet) and policy-centre integration for visitor information.
Growth+
Explore moduleRequest handling without SharePoint — with workflow and an audit trail.
Form builder, categories, submissions with an approval workflow, public forms by link and bulk import from Excel/CSV.
Starter+
Explore moduleAwareness campaigns with evidence — ISO 27001 clause 7.2 covered.
Training campaigns for security and compliance courses with attendance tracking as auditable evidence.
Starter+
Explore moduleBoard-ready reports in minutes — not days of manual formatting.
Report builder for individual GRC reports, PDF export (SoA, scope, incidents, BCM, DPA, DPIA) and audit-trail export.
Starter+
Explore moduleAll evidence in one place — tenant-isolated, versioned, auditable.
Tenant-isolated S3 storage with folder structure, attachments on every GRC entity and branding assets for portals.
All plans
Explore moduleSee what is connected — risks, assets and controls as a graph.
Interactive force-directed graph for asset, risk and control relationships, with drill-downs and filters by site, protection need or owner.
All plans
Explore modulePlanned — not live. Connectors and extra frameworks (DORA, SOC 2, PCI DSS, HIPAA).
Two-way connection to Jira (incidents, actions, CAPA) and Confluence (policy mirroring). Issues, status changes and evidence flow without a media break.
Import scan results from Greenbone / OpenVAS, Tenable Nessus and OWASP Dependency-Check. Automatic CVE/CVSS matching onto assets and controls.
Two-way sync with ServiceNow and i-doit: assets, owners and dependencies are imported automatically — deveca adds protection needs and control mapping.
Preconfigured control set for the Digital Operational Resilience Act in the financial sector.
Trust Services Criteria as a native mapping, with crosswalks to ISO 27001.
Payment Card Industry controls for payment service providers and merchants.
US health-data privacy framework — planned, not live.