Compeas
Swedish GRC platform for NIS2, ISO 27001 and GDPR with one fixed price per organisation
Quick Overview
| Company | Compeas AB |
|---|---|
| Category | Compliance Automation Tools |
| Headquarters | Köping, Sweden |
| Founded | 2026 |
| EU Presence | EU (Sweden) |
| Data Location | Platform and customer data hosted on Ploi Cloud (Ploi BV) in Sweden; customer data stays in the EEA (subprocessors page, privacy policy) |
| Open Source | No |
| Pricing | Compeas GRC costs SEK 240,000 per year per organisation, and SEK 120,000 the first year. No per-user fees and no tiers. Annual: SEK 240,000 per year, first contract year SEK 120,000. Three-year: SEK 180,000 per year (SEK 540,000 for the three years after the first, SEK 660,000 for four years in total). Group: quote based on scope, for several separate instances or more than three frameworks. Three frameworks included (GDPR always, plus two of ISO 27001, NIS2, SOC 2, NIST CSF 2.0 and the CRA), onboarding and training, one hour a month with the vendor's CISO, single sign-on and the Compeas Auditor Tool. All prices exclude VAT. Source: compeas.com/pricing, checked 1 November 2026. |
| Free Option | 14 days free, set up together with the vendor after a first conversation (not self-service) |
| Replaces | Vanta, Drata, Secureframe |
Detailed Review
Compeas is a governance, risk and compliance platform from Compeas AB in Köping, Sweden, founded on 16 June 2026 by former CISO Martin Karlsson.
It covers NIS2 (with the national law of ten EU countries), ISO 27001, SOC 2, NIST CSF 2.0, GDPR and the Cyber Resilience Act, with controls implemented once and mapped across frameworks. Risk management scores likelihood and impact, a policy library tracks versions and acknowledgements, and a separate Auditor Tool lets auditors and groups follow evidence in one view.
Automation runs through eleven integrations, among them Microsoft Entra ID, Intune, Google Workspace, GitHub, Slack, Zoom and Jira, with 73 automated tests that sync hourly according to the integrations page. Reporting deadlines for incidents and vulnerabilities under NIS2, GDPR and the CRA come with alerts before each report is due. The platform is hosted on Ploi Cloud in Sweden, and the subprocessors page lists where each vendor processes data.
Pricing is unusually open for this page: SEK 240,000 a year per organisation, SEK 120,000 in the first year, or SEK 180,000 a year on a three-year agreement, all users included and three frameworks per agreement. That is a high entry price next to Orbiq or Kopexa, and the company is only months old, with no customer list or own certification published. Ask for references and for the contract's data processing annex before signing.
What Compeas does well
- Fixed price published, with all users, onboarding and an Auditor Tool included
- NIS2 coverage for the national law of ten EU countries, plus the Cyber Resilience Act
- Hosted in Sweden with a public subprocessor list
- Single sign-on (Entra, Google Workspace) included in every agreement
- Reporting deadline alerts for NIS2, GDPR and CRA incidents
Where Compeas falls short
- Founded in June 2026, so no track record or published customer base
- SEK 240,000 a year is far above entry plans such as Orbiq or Kopexa, and aimed at mid-sized organisations
- No own ISO 27001 or SOC 2 certification found on the pages reviewed
- Three frameworks per agreement, more cost extra, and the trial is not self-service
Standout feature. Compeas is the only tool here that publishes one flat per-organisation price covering all users, three frameworks, onboarding and auditor access.
Pros and Cons
Pros
- Fixed price published, with all users, onboarding and an Auditor Tool included
- NIS2 coverage for the national law of ten EU countries, plus the Cyber Resilience Act
- Hosted in Sweden with a public subprocessor list
- Single sign-on (Entra, Google Workspace) included in every agreement
- Reporting deadline alerts for NIS2, GDPR and CRA incidents
Cons
- Founded in June 2026, so no track record or published customer base
- SEK 240,000 a year is far above entry plans such as Orbiq or Kopexa, and aimed at mid-sized organisations
- No own ISO 27001 or SOC 2 certification found on the pages reviewed
- Three frameworks per agreement, more cost extra, and the trial is not self-service
Alternatives to Compeas
Frequently Asked Questions
What is Compeas?
Compeas is a governance, risk and compliance platform from Compeas AB in Köping, Sweden, founded on 16 June 2026 by former CISO Martin Karlsson.
It covers NIS2 (with the national law of ten EU countries), ISO 27001, SOC 2, NIST CSF 2.0, GDPR and the Cyber Resilience Act, with controls implemented once and mapped across frameworks. Risk management scores likelihood and impact, a policy library tracks versions and acknowledgements, and a separate Auditor Tool lets auditors and groups follow evidence in one view.
Where is Compeas based?
Compeas operates from Köping, Sweden, which places it under EU (Sweden).
What does Compeas cost?
Compeas GRC costs SEK 240,000 per year per organisation, and SEK 120,000 the first year. No per-user fees and no tiers. Annual: SEK 240,000 per year, first contract year SEK 120,000.
Three-year: SEK 180,000 per year (SEK 540,000 for the three years after the first, SEK 660,000 for four years in total). Group: quote based on scope, for several separate instances or more than three frameworks.
Three frameworks included (GDPR always, plus two of ISO 27001, NIS2, SOC 2, NIST CSF 2.0 and the CRA), onboarding and training, one hour a month with the vendor's CISO, single sign-on and the Compeas Auditor Tool. All prices exclude VAT. Source: compeas.com/pricing, checked 1 November 2026.. 14 days free, set up together with the vendor after a first conversation (not self-service).
Who is Compeas best for?
Swedish and Nordic organisations needing NIS2 and ISO 27001. Compeas is the only tool here that publishes one flat per-organisation price covering all users, three frameworks, onboarding and auditor access.
What are the drawbacks of Compeas?
Founded in June 2026, so no track record or published customer base. SEK 240,000 a year is far above entry plans such as Orbiq or Kopexa, and aimed at mid-sized organisations. No own ISO 27001 or SOC 2 certification found on the pages reviewed. Three frameworks per agreement, more cost extra, and the trial is not self-service.
Is Compeas a good alternative to Vanta?
Compeas is built as a European alternative to Vanta: Swedish GRC platform for NIS2, ISO 27001 and GDPR with one fixed price per organisation. It will not be a like-for-like feature match in every respect, so check the review above for where the two genuinely differ before switching.
How does Compeas compare to other Compliance Automation Tools?
Compeas is one of several European Compliance Automation Tools we cover. It is most often compared with Vanta, Drata, Secureframe.