Kertos
Munich compliance platform with an AI agent and certified experts for ISO 27001, GDPR, NIS2 and C5
Quick Overview
| Company | Kertos GmbH |
|---|---|
| Category | Compliance Automation Software |
| Headquarters | Munich, Germany |
| Founded | Not stated |
| EU Presence | Yes - Germany (EU) |
| Data Location | European AWS infrastructure (per Kertos) |
| Open Source | No |
| GDPR Compliant | Yes |
| Self-Hosting | No |
| Main Features | Compliance automation platform, ISMS, AIMS, RoPA, DPIAs and TOMs, KAIA AI agent, AI trainings, certified expert support, appointed external DPO on higher plans |
| Pricing | Tailored pricing on request, three tiers (Essential, Pro, Premium) |
| Best For | Mid-sized European companies that want software plus expert support |
| Replaces | Vanta, Drata |
Detailed Review
Kertos is a German GmbH with offices in Munich and Berlin. Its own comparison page says it is made in Germany and hosted on European AWS infrastructure, and lists ISO 27001, ISO 27701, ISO 42001, GDPR, NIS2, the EU AI Act, SOC 2, TISAX and C5.
The plans page describes three tiers. Essential is the platform with agentic AI automation and customer success support, aimed at internal teams, DPOs and CISOs.
Platform and AI agent
The platform covers ISMS, AIMS, RoPA, DPIAs and TOMs. Kertos describes KAIA as an agent that drafts policies, checks evidence and shows gaps.
Business continuity management and an automated ISMS are listed among the features for information security frameworks.
Expert-backed tiers
Higher tiers add support from certified experts during implementation, ongoing expert support on demand, a yearly audit and compliance status report, incident report and response, and an appointed external DPO for data privacy frameworks.
Kertos calls this the virtual CISO experience.
European and German standards
C5, the BSI cloud security standard, and TISAX are on the framework list next to ISO 27001, which suits companies selling to German enterprises and automotive customers.
Limitations to Consider
Kertos pricing is available only as a tailored offer, so there is no price to compare against Cyberday or Conformio up front. The expert-heavy tiers cost more than a software-only tool. Hosting is described as European AWS infrastructure, so it is not a sovereign or self-hosted option.
Who Should Use Kertos
Mid-sized European companies that want a platform and certified experts, with ISO 27001, NIS2, GDPR and C5 in scope.
Pros and Cons
Pros
- Wide framework list including C5 and TISAX
- Certified experts and external DPO on higher tiers
- Hosted on European infrastructure
- German GmbH, public register entry
- AI agent for policies and evidence
Cons
- Pricing only on request
- No self-hosted option
- Expert tiers raise cost
- Hosted on a US-owned cloud provider's EU region (AWS)
Alternatives to Kertos
Other European compliance automation software worth comparing before you decide:
Secfix
Germany · German ISO 27001 and NIS2 platform with expert support
ISMS.online
United Kingdom · Established ISMS platform with a guided path to certification
Cyberday
Finland · Employee-based pricing and a very wide framework library
Hicomply
United Kingdom · UK ISMS platform with a customer success manager on every plan
See all European compliance automation software or compare them directly against Vanta on our alternatives page.
Frequently Asked Questions
Its site lists ISO 27001, ISO 27701, ISO 42001, GDPR, NIS2, the EU AI Act, SOC 2, TISAX and C5.
No. Higher tiers add certified expert support and an appointed external DPO for data privacy frameworks.
No. The plans page offers tailored pricing and a request-an-offer form.