European Compliance Automation Tools

#1 Secfix

Munich, Germany Not published, see website Demo on request

Best for: European startups and SMEs aiming for ISO 27001, TISAX or NIS2

• Operating company. Secfix GmbH
• Jurisdiction. EU (Germany)
• Where the data sits. EU (European cloud infrastructure, per Secfix security page)
• Source code. Closed source
• Replaces. Vanta, Drata, Secureframe

Secfix is a Munich platform for ISO 27001, NIS2 and TISAX that generates a checklist of 250+ checks and runs it against connected AWS, Google Cloud, Azure, Microsoft 365, Azure AD, Google Workspace and Jira accounts.

Risk assessments link to more than 100 pre-mapped controls, policy management ships 20+ customisable templates with acceptance tracking, and vendor management can find new suppliers through Google Workspace or Office 365 single sign-on. Employee onboarding, offboarding and security training sit in the same workflow, so a joiner or leaver changes the evidence record without a separate spreadsheet.

Secfix GmbH is registered in the Munich commercial register, and the security page says customer data is stored and processed within the EU on exclusively European cloud infrastructure, with no transfer outside the EEA without a documented legal basis.

The about page describes auditors, engineers and customer success managers in Munich, Berlin, London and other cities. The framework list on the homepage runs from ISO 27001, SOC 2 and TISAX to DORA, ISO 42001 and ISO 9001. No price is published, and the pages do not state a founding year or named customers, so a demo is the only way to compare cost.

Standout feature. Secfix is the only tool here that combines a stated European-only hosting commitment with a 250+ check automation layer and in-house auditors in one German contract.

#2 Kertos

Munich, Germany Tailored pricing on request, three tiers (Essential, Pro, Premium) Demo on request

Best for: Mid-sized European companies that want software plus expert support

• Operating company. Kertos GmbH
• Jurisdiction. EU (Germany)
• Where the data sits. European AWS infrastructure (per Kertos)
• Source code. Closed source
• Replaces. Vanta, Drata

Kertos is a Munich and Berlin compliance platform whose pitch is software plus certified people, with an AI agent called KAIA that drafts policies, checks evidence and shows gaps.

The platform covers an ISMS, an AI management system, records of processing, DPIAs and technical and organisational measures, and the framework list includes ISO 27001, ISO 27701, ISO 42001, GDPR, NIS2, the EU AI Act, SOC 2, TISAX and C5. Business continuity management and an automated ISMS are named among the information security features.

Kertos GmbH is a German company, and its comparison page says the product is made in Germany and hosted on European AWS infrastructure, which means an EU region of a US-owned provider. Pricing is tailored with three tiers called Essential, Pro and Premium.

Essential is the platform with agentic automation and customer success support, and the higher tiers add certified experts during implementation, on-demand expert support, a yearly audit and compliance status report, incident response and an appointed external DPO. The pages do not state a founding year or named customers, and the expert tiers cost more than a software-only tool.

Standout feature. Kertos is the only tool here that lists both C5 and an appointed external data protection officer inside the same tiered offer.

#3 ISMS.online

Brighton, United Kingdom Bespoke plans, quote on request Demo on request

Best for: Organisations new to ISO 27001 that want a guided method

• Operating company. Alliantist Limited (ISMS.online)
• Jurisdiction. United Kingdom (adequacy decision, outside the EEA)
• Where the data sits. Primary data centre in the UK; further centres in Europe, USA and Australia
• Source code. Closed source
• Replaces. Vanta, Drata

ISMS.online is a Brighton-based platform, now branded IO on the site, that walks an organisation from gap analysis to certification using what it calls the ARM methodology and pre-configured templates for each major framework.

It supports ISO 27001, ISO 9001, NIS 2, ISO 42001, ISO 27701, DORA, ISO 22301 and SOC 2, and customer stories describe organisations running ISO 27001, ISO 9001 and ISO 45001 together by linking shared evidence, documents and corrective actions. The company says it used its own platform to maintain its ISO 27001 certification.

Contracting goes through Alliantist Limited, registered in England and Wales under company number 04922343 with its registered office in Brighton, so this is a UK entity under the adequacy decision and not an EU one.

The trust centre page names a primary UK hosting supplier and further data centres in Europe, the USA and Australia, which makes region selection a question to settle before signing. The plans page is a bespoke quote, and from the public pages the approach is built around the ISMS process rather than deep automated technical checks.

Standout feature. ISMS.online is the one tool here built around a named step-by-step certification method, with multi-standard evidence reuse across ISO 27001, 9001 and 45001.

#4 Cyberday

Tampere, Finland From EUR 3,200/year for under 20 employees (EUR 267/month billed annually); EUR 4,500/year for 20-49 Demo on request

Best for: Small and mid-sized companies wanting transparent per-company pricing

• Operating company. Cyberday Inc.
• Jurisdiction. EU (Finland)
• Where the data sits. EU data centers
• Source code. Closed source
• Replaces. Vanta, Drata, Secureframe

Cyberday is a Finnish ISMS platform that prices by employee count, arguing that security is a company-wide effort and not a seat-based one.

Published tiers are EUR 3,200 a year for fewer than 20 employees (EUR 267 a month billed annually), EUR 4,500 for 20 to 49 and EUR 6,800 for 50 to 99, with monthly billing about 20 percent higher. A 14-day free trial with all features needs no credit card, which makes it the easiest tool in this list to test without a sales call.

Cyberday Inc. is identified in its terms with a Finnish business ID and an address on Kalevantie in Tampere, and orders are governed by Finnish law. The security page states all data is stored in EU data centers.

The framework collection spans NIS2, GDPR, DORA, the Cyber Resilience Act and the CER directive on the EU side and ISO 27001, SOC 2, NIST CSF, CIS 18 and TISAX globally, with a comparison tool showing how the frameworks overlap. Security tasks, report automation, vendor assessments, internal audits and management reviews are included, but the public pages do not show the technical evidence collection of cloud-focused rivals, and there is no self-hosting.

Standout feature. Cyberday is the only tool here that publishes tiered prices by employee count, with all features open in a 14-day trial that needs no card.

#5 Hicomply

Durham, United Kingdom Founded 2019 Plans start from GBP 5,300 per year Demo on request

Best for: UK and European mid-size firms pursuing ISO 27001 and SOC 2

• Operating company. Hicomply Ltd
• Jurisdiction. United Kingdom (adequacy decision, outside the EEA)
• Where the data sits. Not stated on the pages reviewed
• Source code. Closed source
• Replaces. Vanta, Drata, Secureframe

Hicomply is a UK platform that includes a dedicated customer success manager on every plan. It connects 75+ tools to pull evidence, has an AI copilot that drafts, maps and checks, and runs cloud control monitoring across accounts. The Enterprise plan adds unlimited integrations and custom workflows, and the framework list includes ISO 27001, SOC 2, DORA, PCI DSS, NIST CSF, NHS DSPT and ISO 42001.

Hicomply Ltd is registered in England and Wales under company number 12364000, its terms are under English law, and the about page gives 2019 as the founding year with a global HQ in North Shields and a registered address in Durham.

Plans start from GBP 5,300 annually in Essentials, Professional and Enterprise tiers, though the plans page shows slightly inconsistent figures for the same tier. The company has opened a Denver office, the pages reviewed do not state a data location, and NIS2 framing is less central than at German vendors, so confirm the contracting entity and hosting region in writing.

Standout feature. Hicomply is the only tool here that lists NHS DSPT and CAF next to ISO 27001 and SOC 2, with a named human contact on every plan.

#6 secjur

Hamburg, Germany On request Demo on request

Best for: German-speaking SMEs that want a self-service ISMS with optional experts

• Operating company. secjur GmbH
• Jurisdiction. EU (Germany)
• Where the data sits. Germany
• Source code. Closed source
• Replaces. Vanta, Drata

secjur is a Hamburg-based Digital Compliance Office that guides customers through ISO 27001, TISAX, NIS2 and DORA with step-by-step assistants, so a company without a CISO can work through the process alone. More than ten standards are cross-mapped, custom frameworks can be built, and over 60 API connections let audits be partially automated and generate recommendations on demand. Adjacent modules cover data protection, whistleblower protection, quality and AI management.

secjur GmbH is registered in Hamburg under HRB 170383, and the homepage states the platform is hosted in Germany and is GDPR-compliant. It claims full coverage of NIS2 and DORA requirements, which is a vendor claim worth testing in a demo.

A certified expert can be added if wanted, but the assistants are designed for self-service. The site is primarily German with an English version, prices are not published, and a smaller international footprint than the larger platforms is likely though not verified.

Standout feature. secjur is the only tool here that lets you define a custom framework and also states plainly that hosting is in Germany.

#7 DataGuard

Munich, Germany Founded 2018 Base / Pro / Enterprise, quoted on request Demo on request

Best for: Mid-market and enterprise privacy teams that want one GDPR platform with optional expert support

• Operating company. DataCo GmbH (trading as DataGuard)
• Jurisdiction. EU (Germany)
• Source code. Closed source
• Replaces. OneTrust, TrustArc, Securiti

DataGuard is a Munich privacy and information-security platform that covers Records of Processing Activities for Article 30, DPIA and risk-assessment workflows, a data subject request tool, third-party risk and incident and breach management. Adjacent modules cover security-awareness training, asset management and cookie consent. It absorbed DPOrganizer, the Swedish privacy tool, and DPOrganizer's former customers now use the DataGuard platform directly, which is the clearest sign of consolidation among European privacy vendors.

The operating company is DataCo GmbH, trading as DataGuard, founded in 2018 and based in Munich.

It reports more than 4,000 client organisations in over 50 countries, a count that makes it the largest specifically European vendor in this category by that measure, though the figure is the vendor's own. Pricing is quote-based across Base (self-service SaaS), Pro (SaaS with hands-on expert support) and Enterprise, and no free tier is stated. ISO 27001 and TISAX are described as a security programme, not as a certificate, and OneTrust is the tool it is positioned against.

Standout feature. DataGuard is the only tool here that took over another privacy product's customer base, moving DPOrganizer users onto its platform.

#8 eramba

London, United Kingdom Community free; Enterprise on-premises EUR 2,500/year; Enterprise SaaS EUR 5,000/year Demo on request

Best for: Teams with in-house GRC skills who want flat pricing

• Operating company. Eramba LTD
• Jurisdiction. United Kingdom (adequacy decision, outside the EEA)
• Where the data sits. Choice of EU or US for SaaS; on-premises otherwise
• Source code. Closed source
• Replaces. Vanta, Drata, Hyperproof

eramba is a GRC toolkit with a free community edition and a flat annual fee for the enterprise editions, with unlimited users, unlimited data and all modules included.

Enterprise on-premises costs EUR 2,500 a year and Enterprise SaaS, with a choice of EU or US hosting, costs EUR 5,000 a year, while implementation workshops are EUR 800 each. Modules cover risk, compliance and incident management, data privacy, automated account reviews, awareness trainings, online assessments, an API and an AI assistant with MCP.

The legal name is Eramba LTD, with offices in London and Bratislava, so the contracting entity is British and the adequacy decision applies.

The product has been available since 2015 with a public forum, open documentation, a public changelog and free live training, and the company describes itself as a small team. The terms and about pages did not state a registration number. ISO 27001, ISO 27002, NIS2, DORA, GDPR and SOC 2 are listed with templates for policies, controls and questionnaires, but you configure risks, controls and workflows yourself, which assumes someone who knows GRC.

Standout feature. eramba is the only tool here that sets one flat fee for unlimited users and every module, and it prints the comparison against per-user pricing on its own site.

#9 CISO Assistant

Vélizy-Villacoublay, France Community free; Pro SaaS EUR 39 per contributor per month billed annually; Pro on-premises EUR 2,400 per instance per year (1-5 seats) Demo on request

Best for: Security teams that want an open-source GRC they can self-host

• Operating company. intuitem SARL
• Jurisdiction. EU (France)
• Where the data sits. Self-hosted community edition; Pro SaaS hosting region not verified
• Source code. Closed source
• Replaces. Vanta, Drata, OneTrust

CISO Assistant is an open-source GRC platform from intuitem that handles audit management across multiple frameworks, risk assessment that does not force one methodology, and centralised evidence, with work from earlier audits reusable against mapped controls. The site cites 202 frameworks, 27 languages, 128 contributors and 4.5k GitHub stars, and deployment is self-hosted or in the vendor's cloud. The community edition is EUR 0 under AGPLv3, hosted and managed by you, with unlimited users and community support.

intuitem SARL is a French company with a share capital of EUR 100,000, registered in Versailles.

Pro SaaS costs EUR 39 per contributor per month billed annually, and Pro on-premises is EUR 2,400 per instance per year for 1 to 5 contributors, with custom quotes for specific deployments. The focus is GRC process and not automated evidence collection from cloud accounts, self-hosting means you run and secure the system yourself, and the Pro SaaS hosting region was not stated on the pages reviewed.

Standout feature. CISO Assistant is the only tool here whose full framework library ships in a free AGPLv3 edition that a security team can run on its own servers.

#10 heyData

Berlin, Germany Founded 2020 Data Privacy Starter from EUR 65 per month (EUR 59 billed annually) / Professional from EUR 120 (EUR 99 annually) / Enterprise from EUR 178 (EUR 169 annually); final price depends on company size and modules Demo on request

Best for: Small and growing companies that want GDPR software with an appointed data protection officer included

• Operating company. heyData GmbH, HRB 242016 B Amtsgericht Charlottenburg
• Jurisdiction. EU (Germany)
• Where the data sits. EU, on an ISO 27001-certified host the vendor does not name
• Source code. Closed source
• Replaces. OneTrust, TrustArc

heyData is a Berlin platform that bundles the appointment of a data protection officer, a data protection audit and documentation into every published plan, with TUEV-certified officers behind it. DPIA, training and a data protection seal start at the Professional tier, and vendor risk management is limited. Beyond privacy, the same platform sells information security, ISO 27001, NIS2, EU AI Act and whistleblower modules, and it reports a rating of 4.5 out of 5 on G2.

heyData GmbH is registered at the district court of Charlottenburg under HRB 242016 B, was founded in 2020 and reports more than 2,500 customers and a team of over 70.

Data Privacy plans are published: Starter from EUR 65 a month (EUR 59 billed annually), Professional from EUR 120 (EUR 99) and Enterprise from EUR 178 (EUR 169), with the final price set by company size and modules. Hosting is on an ISO 27001-certified host in the EU that the vendor does not name, and liability caps per tier run from EUR 50,000 to EUR 250,000, which belongs in the contract review.

Standout feature. heyData is the only tool here that includes an appointed data protection officer in every published monthly plan at a price under EUR 100 a month on annual billing.

#11 verinice

Göttingen, Germany Founded 2007 See website (cloud and on-premises shops, quote on request) Demo on request

Best for: German public sector and critical infrastructure organisations using IT-Grundschutz

• Operating company. SerNet GmbH
• Jurisdiction. EU (Germany)
• Where the data sits. Not stated on the pages reviewed
• Source code. Closed source
• Replaces. Vanta, Drata, GRC suites

verinice is an open-source information security management tool from SerNet that covers BSI IT-Grundschutz, ISO 27001, VDA ISA/TISAX, GDPR and NIS 2, with business continuity domains for BSI 200-4 and ISO 22301 added recently.

It is sold as verinice.cloud on subscription and as verinice.onprem for purchase, and the vendor calls it a sovereign tool, supported by a partner network for certified help. A public forum, roadmap and release notes are on the site, and a verinice.XP user event is announced for 2027.

The producer is SerNet GmbH, registered in Göttingen as HR B 2816, and it says verinice has been developed fully open source since 2007 and used across German and European public and private sectors, including critical infrastructure. It is a classic GRC tool with little integration-driven automation, the site and documentation are mainly German, and prices are not shown on the main pages. The data location was not stated on the pages reviewed.

Standout feature. verinice is the only tool here built around BSI IT-Grundschutz and developed in the open since 2007.

#12 Conformio

Zagreb, Croatia Starter EUR 145/month; Professional EUR 245/month (monthly billing) Demo on request

Best for: Small businesses preparing for ISO 27001 with limited budgets

• Operating company. Advisera Expert Solutions Ltd
• Jurisdiction. EU (Croatia)
• Where the data sits. Not stated on the pages reviewed
• Source code. Closed source
• Replaces. Vanta, Drata

Conformio is Advisera's ISO 27001 software, built around the mandatory documents, a risk register and a project management module. Starter is EUR 145 a month with 3 user accounts, all mandatory documents and up to 100 risks, while Professional is EUR 245 a month with 5 users, unlimited risks and security awareness training for up to 20 employees. Annual billing saves four months, prices appear in EUR or USD, and a 14-day free trial is offered.

The seller is Advisera Expert Solutions Ltd, and its Terms of Use apply Croatian law with exclusive jurisdiction of Croatian courts, naming an EU office in Zagreb and a US office in New York, so confirm which entity contracts with you.

Advisera also lists toolkits and training for NIS2, DORA, ISO 42001 and EU GDPR, plus its Experta AI copilot. The product is organised around documents and projects and not around automated evidence collection from cloud accounts, which suits a small business doing ISO 27001 step by step.

Standout feature. Conformio is the only tool here whose entry price (EUR 145 a month) comes with every mandatory ISO 27001 document already included.

#13 Orbiq

Hamburg, Germany Trust Center plans Free, Team €85/month, Business from €190/month; Vendor Assurance by demo Demo on request

Best for: SaaS companies and small teams that answer customer security questionnaires and assess a few suppliers

• Operating company. Orbiq GmbH
• Jurisdiction. EU (Germany)
• Where the data sits. Not stated on the pages reviewed
• Source code. Closed source
• Replaces. Vanta Trust Center, Whistic, SafeBase, spreadsheet questionnaires

Orbiq is a Hamburg trust center platform with a vendor assurance module, built around the NIS2, DORA and ISO 27001 requests that buyers now send to their suppliers. The trust center is the page a supplier shows its customers, with an NDA flow. The vendor assurance side adds AI-supported questionnaires, automated scoring evaluations and continuous monitoring of vendor security over time, so a small team can answer its own customers and assess its own suppliers in one tool.

Orbiq GmbH sells from Hamburg, which places it under German law. Trust Center plans are Free, Team at EUR 85 a month and Business from EUR 190 a month, with Vendor Assurance sold by demo.

The pages reviewed give no founding year, customer count or hosting location, and the module is lighter than enterprise third-party risk platforms, with no coverage of due diligence law or operational disruption. Treat it as security assurance and ask for a reference from a company of your size before moving beyond the free plan.

Standout feature. Orbiq is the only tool here that covers both sides of the questionnaire exchange, with a free tier on the side where you answer your customers.