RGPD.COM
Security awareness training for organisations in Europe.
- Transparency
- Data processing agreement, publishedList of data processors, publishedSecurity measures, publishedPrivacy policy, published
- Data processors
- 2 EU-owned companies
GRC software made in Europe
GRC stands for governance, risk and compliance. If your organisation has to comply with several laws and IT security frameworks at once, such as the GDPR, ISO 27001, NIS2 and DORA, GRC software brings them all into one tool, so one risk or one control can serve every requirement.
One tool for all your compliance also means one place that holds a large part of your company’s information. In this guide, we have made a list of the European GRC software vendors and checked which data processors they use, and whether those are European companies.
GRC software providers and their data processors
We have researched each GRC software provider’s data processing agreement, privacy policy and its list of data processors on its own website, whenever available.
The companies on the map are the GRC software providers and the data processors they have hired to process your data on your behalf.
HiScout
ISMS software installed on your own servers, for large organisations and public authorities.
- Transparency
- Data processing agreement, not found on its websiteList of data processors, not found on its websiteSecurity measures, not found on its websitePrivacy policy, published
- Data processors
- Runs on your own servers
Granite
GRC software for risk, information security, NIS2 and DORA, with a tool for impact assessments.
- Transparency
- Data processing agreement, not found on its websiteList of data processors, publishedSecurity measures, publishedPrivacy policy, published
- Data processors
- 2 US-owned companies2 EU-owned companies
Legiscope
GDPR and NIS2 software for privacy teams that manage several organisations.
- Transparency
- Data processing agreement, publishedList of data processors, publishedSecurity measures, publishedPrivacy policy, published
- Data processors
- 5 US-owned companies
heyData
Privacy and information security software for small and mid-sized companies, with a free version to start.
- Transparency
- Data processing agreement, not found on its websiteList of data processors, publishedSecurity measures, publishedPrivacy policy, published
- Data processors
- 1 US-owned companyThe rest not public
Secjur
Privacy and information security software for start-ups and mid-sized companies.
- Transparency
- Data processing agreement, publishedList of data processors, publishedSecurity measures, publishedPrivacy policy, published
- Data processors
- 6 US-owned companies7 EU-owned companies2 companies in Ukraine and the UK
GBTEC
GRC software for risk, compliance and information security.
- Transparency
- Data processing agreement, publishedList of data processors, publishedSecurity measures, publishedPrivacy policy, published
- Data processors
- 3 US-owned companies1 EU-owned company1 company in Saudi Arabia
Mavim
Process and GRC software built on Microsoft.
- Transparency
- Data processing agreement, not found on its websiteList of data processors, publishedSecurity measures, publishedPrivacy policy, published
- Data processors
- 1 US-owned company1 EU-owned companyThe rest not public
DataGuard
Privacy and information security software from DataGuard, which bought the Swedish DPOrganizer in 2024.
- Transparency
- Data processing agreement, publishedList of data processors, publishedSecurity measures, publishedPrivacy policy, published
- Data processors
- 3 US-owned companies3 EU-owned companies
Kertos
GDPR and information security software for scale-ups and mid-sized companies.
- Transparency
- Data processing agreement, not found on its websiteList of data processors, publishedSecurity measures, publishedPrivacy policy, published
- Data processors
- 8 US-owned companies5 EU-owned companies1 company in AustraliaThe rest not public
Akarion
GRC software for data protection and information security.
- Transparency
- Data processing agreement, not found on its websiteList of data processors, publishedSecurity measures, not found on its websitePrivacy policy, published
- Data processors
- 1 EU-owned companyThe rest not public
Smart Global Governance
GRC software for ESG, cybersecurity, privacy and third-party risk.
- Transparency
- Data processing agreement, not found on its websiteList of data processors, publishedSecurity measures, not found on its websitePrivacy policy, published
- Data processors
- 1 US-owned companyThe rest not public
Egerie
Cyber risk and privacy software used by large French organisations.
- Transparency
- Data processing agreement, publishedList of data processors, publishedSecurity measures, not found on its websitePrivacy policy, published
- Data processors
- 1 EU-owned companyThe rest not public
GlobalSuite
GRC software for GDPR, Spain's ENS, ISO 27001 and NIS2, used in more than 30 countries.
- Transparency
- Data processing agreement, not found on its websiteList of data processors, publishedSecurity measures, publishedPrivacy policy, published
- Data processors
- 6 US-owned companies4 EU-owned companies
CalQRisk
GRC software for GDPR, NIS2 and DORA, used by many Irish credit unions.
- Transparency
- Data processing agreement, not found on its websiteList of data processors, publishedSecurity measures, publishedPrivacy policy, published
- Data processors
- 1 US-owned companyThe rest not public
Formalize
Compliance software for GDPR and information security, used by compliance teams, auditors and consultants.
- Transparency
- Data processing agreement, publishedList of data processors, publishedSecurity measures, publishedPrivacy policy, published
- Data processors
- 7 US-owned companies4 EU-owned companies
RISMA Systems
GRC software for information security, GDPR and ISO 27701, part of the Cerivo group.
- Transparency
- Data processing agreement, publishedList of data processors, publishedSecurity measures, publishedPrivacy policy, published
- Data processors
- 1 US-owned company3 EU-owned companies
ComplyCloud
GDPR and information security software for Nordic companies, part of the Cerivo group.
- Transparency
- Data processing agreement, publishedList of data processors, publishedSecurity measures, publishedPrivacy policy, published
- Data processors
- 2 US-owned companies5 EU-owned companies1 company in Canada1 UK-owned company
Wired Relations
Privacy and information security software, part of the Cerivo group.
- Transparency
- Data processing agreement, publishedList of data processors, publishedSecurity measures, publishedPrivacy policy, published
- Data processors
- 2 US-owned companies2 EU-owned companies
NorthGRC
GRC software for ISO 27001, NIS2 and GDPR, made in Denmark since 2002.
- Transparency
- Data processing agreement, not found on its websiteList of data processors, publishedSecurity measures, publishedPrivacy policy, published
- Data processors
- 1 US-owned companyThe rest not public
Stratsys
Strategy and governance software with a module for information security and privacy: GDPR, ISO 27001 and NIS2.
- Transparency
- Data processing agreement, not found on its websiteList of data processors, not found on its websiteSecurity measures, publishedPrivacy policy, published
- Data processors
- Not found on its website (October 2026)
Kryptos72
Software for GDPR, ISO 27001 and Poland's KRI rules.
- Transparency
- Data processing agreement, publishedList of data processors, not found on its websiteSecurity measures, publishedPrivacy policy, published
- Data processors
- Not found on its website (October 2026)
Intervalid
Software for data protection and information security management.
- Transparency
- Data processing agreement, not found on its websiteList of data processors, not found on its websiteSecurity measures, publishedPrivacy policy, published
- Data processors
- Not found on its website (October 2026)
HITGuard
GRC software for data protection, information security and risk.
- Transparency
- Data processing agreement, not found on its websiteList of data processors, not found on its websiteSecurity measures, not found on its websitePrivacy policy, published
- Data processors
- Not found on its website (October 2026)
GO GRC
GRC software for data protection, IT security and DORA, sold to banks and insurers.
- Transparency
- Data processing agreement, not found on its websiteList of data processors, not found on its websiteSecurity measures, not found on its websitePrivacy policy, published
- Data processors
- Not found on its website (October 2026)
ePULPO
Software for GDPR, Spain's ENS and ISO 27001, from the Babel group.
- Transparency
- Data processing agreement, not found on its websiteList of data processors, not found on its websiteSecurity measures, publishedPrivacy policy, published
- Data processors
- Not found on its website (October 2026)
Not on the list?
Do you make GRC software in Europe and are not on this list? Send us your list of data processors through our contact page, and you will be added in the next update.