In planning
Atlassian bridge (Jira & Confluence)
Two-way connection to Jira (incidents, actions, CAPA) and Confluence (policy mirroring). Issues, status changes and evidence flow without a media break.
Modules · platform overview
One platform. Everything included.
25 integrated modules — from cockpit and risk through GDPR, TPM and the EU AI Act to SBOM, CRA and ISO 9001 QMS. Each module is productive on its own.
Available now
Ready today
Available now
Cockpit & overview
Your CISO dashboard in 5 minutes — not 5 weeks of Excel tinkering.
All plans
Explore moduleAvailable now
Organisation & scope
Scope, stakeholders, obligations — in one place, and auditable.
All plans
Explore moduleAvailable now
IT risk management (ISO 27005)
From an Excel risk register to an auditable ISMS.
Starter+
Explore moduleAvailable now
Enterprise risk management (ISO 31000)
ISO 31000 and ISO 27005 on one platform — IT and business risk together.
Starter+
Explore moduleAvailable now
Action management
No action item falls through the cracks.
All plans
Explore moduleAvailable now
Asset management
An asset inventory auditors like — with CIA, lifecycle and dependencies.
Starter+
Explore moduleAvailable now
Control framework & compliance
One control set, every framework — crosswalks cover two audits.
Starter+
Explore moduleAvailable now
Policy management
Policies people actually read — with a policy centre.
Starter+
Explore moduleAvailable now
Audit programme
External auditors see only what they need — securely, and only for a limited time.
Starter+
Explore moduleAvailable now
GDPR / privacy
GDPR built into GRC — with AI for RoPA, DPIA and DPA.
Starter+
Explore moduleAvailable now
Incident management & BCM
From incident to notification in hours, not days.
Starter+
Explore moduleAvailable now
Whistleblower protection (HinSchG)
A protected reporting portal under the HinSchG — anonymous, encrypted, provable.
Growth+
Explore moduleAvailable now
SLA / OLA management
Spot SLA breaches before the customer does.
Professional+
Explore moduleAvailable now
Third-party management (TPM)
A compliant supply chain — from assessment to questionnaire.
Growth+
Explore moduleAvailable now
SBOM & vulnerability management
CRA-ready from day one — SBOM import, CVE scan and dependency graph.
Enterprise
Explore moduleAvailable now
CRA / CE conformity
Cyber Resilience Act — conformity documented, not interpreted.
Enterprise
Explore moduleAvailable now
EU AI Act (deployer)
EU AI Act deployer duties — classification and compliance in one module.
Growth+
Explore moduleAvailable now
ISO 9001 / QMS
ISO 9001 and ISO 27001 on one platform — one audit, two certificates.
Add-on
Explore moduleAvailable now
Process management
Model processes, don't just describe them — BPMN linked to GRC.
Growth+
Explore moduleAvailable now
Visitor management
Visitors documented, NDA confirmed — ready for ISO 27001 Annex A.7.
Growth+
Explore moduleAvailable now
Forms & requests
Request handling without SharePoint — with workflow and an audit trail.
Starter+
Explore moduleAvailable now
Training & awareness
Awareness campaigns with evidence — ISO 27001 clause 7.2 covered.
Starter+
Explore moduleAvailable now
Reports & export
Board-ready reports in minutes — not days of manual formatting.
Starter+
Explore moduleAvailable now
File management
All evidence in one place — tenant-isolated, versioned, auditable.
All plans
Explore moduleAvailable now
Dependency visualisation
See what is connected — risks, assets and controls as a graph.
All plans
Explore module In development
Roadmap
In planning
Vulnerability connectors (Greenbone, OpenVAS, Nessus)
Import scan results from Greenbone / OpenVAS, Tenable Nessus and OWASP Dependency-Check. Automatic CVE/CVSS matching onto assets and controls.
Research
CMDB sync (ServiceNow, i-doit)
Two-way sync with ServiceNow and i-doit: assets, owners and dependencies are imported automatically — deveca adds protection needs and control mapping.
Coming soon
DORA framework
Preconfigured control set for the Digital Operational Resilience Act in the financial sector.
Coming soon
SOC 2 Type II framework
Trust Services Criteria as a native mapping, with crosswalks to ISO 27001.
Coming soon
PCI DSS v4 framework
Payment Card Industry controls for payment service providers and merchants.