Akarion GRC Cloud vs caralegal

Akarion GRC Cloud

The VVT is a 'dynamisches System' where changes to processes and assets update automatically, and processors (AVV), TOMs with authority-ready reports, DSFA with data-flow visualization and TIAs all sit in the module — that is a genuinely connected model with mandate inheritance for groups. But legal-basis modeling and DPIA triggers derived from the record are unevidenced, so I stop short of the 8 anchor.

caralegal

The record is a connected model: processing activities synchronize automatically with the impact assessment, TOMs and service providers, impact assessments trigger from an automated threshold analysis on risky activities, and the deletion concept is generated from the record itself. With legal-basis, vendor and TOM templates created and reviewed by legal experts, more than 200 processing activity templates, and group structures scaling by legal entities per edition, this is the depth I expect; I found no public information on multi-client mandate handling, which is what would make it a full system of record.

Akarion GRC Cloud

The breach side holds up: a workflow that 'führt Sie durch die Bewertung und überwacht die kritische 72-Stunden-Meldefrist' with revision-safe documentation. The rights side is silent — no intake channel, no Art. 12 clock, no identity check, no deletion workflow, and no evidence the workflow produces the Art. 33 notification itself; missing evidence is information.

caralegal

Requests arrive in the system with the response deadline shown automatically, the relevant data locations looked up, and answers transmitted through a protected data room — the statutory clock is handled as workflow, not a note in a diary. The breach side is documented only as central documentation with a guided decision process: I found no public information on a 72-hour clock, a severity assessment producing the authority notification, or execution tracking for the deletion concepts generated from the register.

Akarion GRC Cloud

The framework list is long but privacy-thin: GDPR via SDM and ISO 27701 are the only privacy regimes operationalized; no Swiss nDSG despite an Austrian entity and AT hosting, no UK GDPR, no ePrivacy, no AI Act duties — only ISMS frameworks like NIS-2, DORA and BSI fill the list. There is a visible maintenance cadence (217 updates in 2024), but nothing evidences one-record-many-regimes privacy mapping, so this does not reach the 5 anchor for my multi-jurisdiction exposure.

caralegal

Coverage is the German core done seriously: GDPR records including the Art. 30(2) processor variant, the Standard-Datenschutzmodell 3.1 with guarantee goals and always-updated SDM modules linked to TOMs, cookie-compliance checks, and AI Act audit templates sitting on the same documentation as the privacy flow. That visible maintenance of the legal content is exactly what I insist on; I found no public information on Swiss or UK regimes or per-country variants, so the one-record-many-regimes story is GDPR-plus rather than broad.

Akarion GRC Cloud

Reports 'auf Knopfdruck' for management and auditors, TOMs with 'anpassbaren Reports für Behörden', revision-safe incident documentation and a named audit-trail plus a dedicated Audit module give me a defensible baseline. What keeps it from 8: no evidence of audit-scoped evidence packs on demand, auditor access roles, or an answer to 'show me the state on date X'.

caralegal

The single-click submission to authorities covering everything from processor agreements to the records register, plus audit templates for ISO, GDPR and the AI Act and questionnaire-based gap analyses, is more than static PDFs. But I found no public information on revision-safe change history, audit-scoped evidence packs or auditor access roles — without those I cannot defensibly answer "show me the state on date X", so assembling the audit file remains unproven from these pages.

Akarion GRC Cloud

Thirteen named connectors including ticketing (Jira, ServiceNow), asset sources (Matrix42) and process modeling (Signavio), plus SSO, autoprovisioning and generative AI with explicit human review is a real estate feed, not an island. But no documented REST API and no webhooks appear anywhere in the evidence, and escalation is only implied by the multi-stage approval workflow.

caralegal

What I can see feeding the platform is a website cookie scan by URL, automatic transfer of existing documentation into the system, and PDF/Excel export of the register, with AI assistants and agents advertised for recurring steps. I found no public information on a documented API, directory import, or ticketing and single-sign-on connectors, so the recurring privacy work appears to depend largely on manual entry rather than the real IT estate.

Akarion GRC Cloud

The chain is European where I can see it: Akarion GmbH (Linz) under a Munich AG, hosting on STACKIT in DE/AT, infrastructure expressly under German and partially Austrian jurisdiction, 100% development in AT/DE. But no DPA, no published subprocessor list and no TOMs are evidenced anywhere — for the system holding my RoPA I cannot certify jurisdictional cleanliness without that paper.

caralegal

The vendor is a German GmbH seated in Berlin with a German VAT number, which is the right jurisdiction for the system that will hold my register. But the captured pages give no hosting location, no subprocessor list and no data processing agreement for the product itself — the subprocessors actually documented belong to the marketing website, including a US provider running on AWS — so where my compliance record would live and under whose law is unverifiable from public information.

Akarion GRC Cloud

Not one price appears in the captured pages; the offering is modular ('5 Module für Ihren individuellen Bedarf') with AI features and custom connectors 'auf Anfrage', so every real invoice is a sales conversation. This matches the 0 anchor — describing the market norm, but nothing is computable here.

caralegal

The boundaries are unusually clear for this market: the entry edition at "ab 79€ pro Monat", legal entities per edition at 1, 3, 8 and unlimited, unlimited users and documents, and a public 50% nonprofit discount. But only the entry edition carries any figure, Enterprise is "auf Anfrage", and I found no public prices for the two middle editions, so the real invoice for a multi-entity group is not computable from the pricing page alone.