Every European GRC software tool reviewed
Stavanger, Norway
Founded 2000
Not shown on the pages we read; demo request only.
Demo on request
Best for: Medium and large organisations that want risk and compliance linked to performance management
Corporater is a governance, performance, risk and compliance platform from Corporater AS in Stavanger, Norway, founded in 2000. The company describes a digital twin of the organisation, configurable workflows, an AI assistant and separate audit and ESG solutions. In this directory it is the suite that ties risk and compliance to management reporting.
Norwegian law governs the Corporater AS terms, and Norway belongs to the EEA without being in the EU. Customers can take SaaS on Amazon Web Services, on-premise, or a public cloud. No AWS region is named, no price is published, and the contact page lists a US subsidiary. Data comes in through Excel, CSV, SQL and web services.
What Corporater does well
- Norwegian company and headquarters, inside the EEA
- One platform for governance, performance, risk and compliance
- Deployable as SaaS, on-premise or in a public cloud
- Terms under Norwegian law
- Imports and links through Excel, CSV, SQL and web services
Where Corporater falls short
- Prices are not published
- AWS hosts the SaaS and the region is not stated
- Scope suits medium and large organisations
- A US subsidiary appears on the contact page
Standout feature. Of the twelve, Corporater alone places performance management in the same platform as risk and compliance.
The Hague, Netherlands
Not shown on the pages we read; demo booking only.
Demo on request
Best for: Dutch and European insurers, banks and regulated firms with risk, compliance and audit teams
CERRIX is a GRC platform sold by CERRIX BV from The Hague, with VAT number NL854381351B01 on its privacy statement. The vendor says it has been active for over 10 years and serves more than 100 clients in over 20 countries. Those figures are vendor statements that we could not check.
Modules span risk and controls, compliance, third parties, audit, incidents, processes and GDPR, and a regulatory monitoring feature tracks DNB, AFM and EU publications. DORA and NIS2 lead the home page. Dutch law and Dutch courts appear in the terms. We found no prices, no hosting location and no self-hosted option.
What CERRIX does well
- Dutch contracting entity registered in The Hague
- Separate modules for risk, compliance, audit, incidents and third parties
- Regulatory monitoring covering DNB, AFM and EU sources
- DORA and NIS2 are the lead topics on the home page
- Terms under Dutch law with Dutch courts
Where CERRIX falls short
- Prices are not published
- No hosting location given
- Product examples are aimed at financial institutions
- No self-hosted deployment is shown
Standout feature. CERRIX alone names Dutch supervisors, DNB and AFM, as sources of its regulatory monitoring.
London, United Kingdom
Community free; Enterprise on-premises EUR 2,500/year; Enterprise SaaS EUR 5,000/year
Demo on request
Best for: Teams that already know GRC method and prefer a fixed yearly fee to a quote
eramba is a governance, risk and compliance tool from Eramba LTD, which has offices in London and Bratislava. The community edition is free and runs on your own servers. The enterprise editions cost EUR 2,500 a year on-premises and EUR 5,000 a year as SaaS, and the vendor states that users and data are unlimited.
Customers of the eramba SaaS select a hosting region, either EU or US, and the vendor runs a public forum next to its documentation. Eramba LTD is a British company, covered by an adequacy decision and outside the EEA. Larger suites gather more evidence automatically, and eramba assumes your own people can configure risk and control methodology.
What eramba does well
- A free community edition exists
- One yearly fee regardless of the number of users
- SaaS customers can pick EU hosting
- Runs on your own servers if you prefer
- Forum and documentation are public
Where eramba falls short
- Evidence gathering is mostly manual
- Setup depends on GRC know-how in your team
- US hosting is an option as well in the SaaS
- The company is small
Standout feature. eramba prices its enterprise editions as one yearly fee with unlimited users and keeps a free edition beside them.
Lucerne, Switzerland
Founded 2016
Not shown on the pages we read; demo request and free trial offered.
Demo on request
Best for: Organisations in Switzerland and the DACH region that want a broad GRC platform without per-user licence limits
Swiss GRC AG, based in Lucerne and entered in the Canton of Lucerne commercial register as CHE-145.606.205, sells the Swiss GRC platform. It states a founding year of 2016 and roots in Swiss Infosec AG from 1989. We treat both dates as vendor statements.
The module list runs from risk and RiskQuant quantification through compliance, ISMS, third-party risk, internal controls, data protection and business continuity to internal audit, BPM and contract management, with a Grace AI assistant. Customers choose SaaS, private cloud or on-prem and can try it free. Switzerland is not in the EU, and no hosting location is stated.
What Swiss GRC does well
- Swiss company with its register number published
- The vendor states that the number of users is unlimited
- Choice of SaaS, private cloud or on-prem
- A free trial and a demo environment are offered
- ISO 27001, 27017 and 27701 marks sit in the site footer
Where Swiss GRC falls short
- Prices are not published
- Hosting location is not given
- Switzerland is not an EU member
- The customer figures come from the vendor
Standout feature. Swiss GRC alone lists contract management next to risk quantification and internal audit.
Bochum, Germany
Not shown on the pages we read.
Demo on request
Best for: Teams that document business processes and want risk, architecture and workflows tied to them in a German product
GBTEC is a business transformation platform from GBTEC Software AG in Bochum, registered at the Amtsgericht Bochum. The brand was formerly sold as BIC. The homepage says more than 1,200 customers use it, a vendor claim.
The product grows from process design and enterprise architecture towards governance, risk and compliance modules. Workflows come from a low-code Work Orchestrator, and process mining is an add-on module. No price, free tier, trial or hosting region shows on the pages we read. Someone who just needs a risk register will find the scope wide.
What GBTEC does well
- German contracting entity based in Bochum
- Process design, architecture and GRC in a single platform
- Workflows are built in a low-code Work Orchestrator
- Process mining modules can be added
- The homepage claims more than 1,200 customers
Where GBTEC falls short
- Prices are absent from the pages we read
- No free tier or trial found
- Hosting region is not given
- The BIC name changed to GBTEC
Standout feature. GBTEC starts from process modeling and enterprise architecture, where the others start from risk.
Toulon, France
Not shown on the pages we read; demo request only.
Demo on request
Best for: French and European security teams that want cyber risk quantification together with compliance
EGERIE is a cyber GRC platform from EGERIE SOFTWARE SAS in Toulon, listed at the Toulon trade register under number 817 640 998. The legal notice also publishes VAT number FR04817640998. The terms of sale cover EGERIE Risk Manager and EGERIE Privacy Manager.
The EGERIE platform handles risk assessment, compliance, third-party management and the financial quantification of cyber risk. Listed frameworks are ISO 27001, NIS 2, DORA, SecNumCloud and GDPR, delivered as SaaS or on-premises. Where the platform runs is not stated. The legal notice and the English terms give different share capital figures.
What EGERIE does well
- French company with register and VAT numbers published
- Risk, compliance and third-party management are combined
- Delivered as SaaS or on-premises under the terms
- SecNumCloud and DORA appear in the framework list
Where EGERIE falls short
- Prices are not published
- The platform hosting location is not given
- Centred on cyber risk, not enterprise risk
- Two documents give different share capital
Standout feature. EGERIE alone lists SecNumCloud, the French cloud qualification, among its frameworks.
London, United Kingdom
Founded 2006
Pricing guide on request. SureCloud says plans are priced on requirements, not users or seats; no amounts are shown.
Demo on request
Best for: Buyers who want to start on a small plan, with a stated one-day setup, and add modules later
SureCloud Ltd runs the SureCloud platform and is registered in England and Wales as company 05703655, with an office at 1 Sherwood Street, London. According to the vendor it began in 2006. Modules include compliance, risk, third-party risk, data privacy, internal audit, business continuity, a trust center and AI governance.
SureCloud sells three plans, Assure, Automate and Orchestrate, with user limits and implementation timelines stated for each. Automate and Orchestrate allow unlimited named users. The vendor says plans are priced on requirements, not users or seats, but shows no amounts. The privacy statement allows transfers to the United States and the site terms name SureCloud Inc.
What SureCloud does well
- UK company number and registered office published
- Three plan tiers with user limits spelled out
- The two upper plans allow unlimited named users
- An implementation timeline is given for each plan
Where SureCloud falls short
- No price amounts shown
- Hosting location is not given
- Transfers to the United States are allowed in the privacy statement
- A US affiliate is named in the site terms
Standout feature. SureCloud states an implementation timeline for every plan, which none of the others do.
Vélizy-Villacoublay, France
Community free; Pro SaaS EUR 39 per contributor per month billed annually; Pro on-premises EUR 2,400 per instance per year (1-5 seats)
Demo on request
Best for: Security teams comfortable running Docker who prefer open code over a sales process
intuitem SARL of Vélizy-Villacoublay, France, develops CISO Assistant. Its free community edition carries the AGPLv3 licence and is installed with Docker on servers you control. Controls can be mapped to more than 220 frameworks, according to the vendor's site.
The paid Pro tier is EUR 39 for each contributor and month, billed annually, in the SaaS version. The on-premises Pro version is EUR 2,400 per instance and year for one to five seats. Automatic evidence gathering is thin, hosting it yourself requires administration skills, and we could not verify where the Pro SaaS is hosted.
What CISO Assistant does well
- Source code is open, with a free community edition
- The site cites more than 220 frameworks
- Runs self-hosted or as SaaS
- French contracting entity under EU law
- Prices for the Pro editions are public
Where CISO Assistant falls short
- Pro SaaS is billed per contributor
- Automated evidence collection is limited
- Running it yourself takes admin skills
- The Pro SaaS hosting region is unverified
Standout feature. CISO Assistant pairs an AGPLv3 community edition with a catalogue of more than 220 frameworks.
Göttingen, Germany
Founded 2007
See website (cloud and on-premises shops, quote on request)
Demo on request
Best for: Agencies and operators of critical infrastructure in Germany that must follow BSI IT-Grundschutz
SerNet GmbH of Göttingen publishes verinice, an ISMS and GRC tool produced as open source since 2007. Supported domains are BSI IT-Grundschutz, ISO 27001, VDA ISA/TISAX, GDPR, NIS 2 and business continuity management. Rollouts usually go through a network of partner firms.
verinice is available in cloud and on-premises forms, with separate shops and quotes on request, and the main pages do not show prices. Much of the material is in German. Automated evidence collection is limited, and the interface follows the structure of classic GRC methods.
What verinice does well
- Open source since 2007
- Covers IT-Grundschutz and the ISO 27001 domain
- Offered as cloud service or on-premises
- German contracting entity
- Implementation partners exist
Where verinice falls short
- Documentation and interface lean heavily on German
- Evidence is rarely collected automatically
- Prices are not on the main pages
- Built around classic GRC methods
Standout feature. verinice is built around BSI IT-Grundschutz, the German federal baseline.
Brighton, United Kingdom
Bespoke plans, quote on request
Demo on request
Best for: First-time ISO 27001 projects where a step-by-step method matters more than configurability
ISMS.online, now branded IO, is run by Alliantist Limited in Brighton, United Kingdom. The site lists ISO 27001, ISO 27701, ISO 42001, NIS 2, DORA, SOC 2 and further frameworks. Pre-configured templates and a guided path run from gap analysis to certification, backed by compliance specialists.
The trust centre names a UK primary hosting supplier, with more data centres in Europe, the USA and Australia. Plans are bespoke and quoted on request. The company is British, so an adequacy decision applies but EEA membership does not, and no self-hosted option is offered.
What ISMS.online does well
- A long-running ISMS platform
- Framework list includes NIS 2 and DORA
- Guided path towards certification
- Pre-configured templates for the main standards
- Compliance specialists answer support questions
Where ISMS.online falls short
- Pricing is quoted on request only
- The company is in the UK, outside the EU
- Further data centres are listed outside Europe
- It cannot be self-hosted
Standout feature. ISMS.online sells a guided route that runs from gap analysis to ISO 27001 certification.
Nailsea, United Kingdom
Founded 1999
Not shown on the pages we read; contact form only.
Demo on request
Best for: Organisations that need a configurable risk register and quantitative risk analysis more than a full GRC suite
riskHive is a risk management software vendor, riskHive Software Solutions Ltd, in Nailsea, North Somerset, which states that it was founded in 1999. The footer also names riskHive Technical Services Ltd. The main products are Enterprise Risk Manager, a risk database in a private cloud, and Arrisca Risk Analyser for Excel spreadsheets.
riskHive also offers business continuity, cost assurance and forecasting, and risk training and consulting. The pages list Cyber Essentials Plus and JOSCAR certificates. They show no prices, no hosting location and few integration details, and no audit, policy or compliance-framework modules.
What riskHive does well
- UK contracting entity
- The risk register can be configured
- Arrisca analyses risk inside Excel
- Cyber Essentials Plus and JOSCAR certificates are listed
- Training and consulting are sold by the same vendor
Where riskHive falls short
- Prices are not published
- The private cloud location is not given
- Only risk is covered, with no wider suite shown
- Integration details are thin
Standout feature. riskHive runs its quantitative risk analysis inside Excel workbooks through Arrisca.
London, United Kingdom
Not shown on the pages we read; demo request only.
Demo on request
Best for: Privacy officers who map personal data flows and assess processors from one UK product
Proteus-Cyber Ltd sells Proteus NextGen, a data privacy management platform. The company is registered in England and Wales as 07239733, with 20-22 Wenlock Road, London, as its address, and English law applies in the terms.
Proteus NextGen lists data mapping, PIA and DPIA, automated risk assessment, vendor risk with transfer impact assessments, consent management, DSAR handling, breach notification and continuous control testing. Prices and hosting location are not shown, audit and enterprise risk modules are absent, and the footer and the terms give different addresses.
What Proteus-Cyber does well
- UK contracting entity
- Company number is published
- Data mapping, DPIA and DSAR workflows are included
- Vendor risk covers transfer impact assessments
- Controls can be tested continuously
Where Proteus-Cyber falls short
- Prices are not published
- Hosting location is not given
- Privacy is the focus, not a full GRC suite
- Footer and terms list two addresses
Standout feature. Proteus-Cyber attaches transfer impact assessments to its vendor risk module.
