Akarion GRC Cloud vs caralegal

Akarion GRC Cloud

The VVT is sold as a dynamic system where changes to processes and assets update automatically, with DSFA incl. in-system data-flow visualization, central processor management, TOMs with authority-customizable reports and TIA, plus template-tenant inheritance for group reuse. That is a genuinely connected model, but legal-basis linkage and DPIA triggers derived from the record appear nowhere in the evidence, so I stop below the 8 anchor.

caralegal

The captured pages show a connected model: processing records synchronize automatically with impact assessments, technical measures and vendors, the DPIA threshold analysis is derived from the record, and legal bases under Art. 6 and 9 sit in legally reviewed templates alongside SDM-linked technical measures. A one-click package to the authority spanning processor agreements through records suggests authority-usable outputs. We found no public information on reusable group templates or multi-client mandate handling; entity counts per plan are the only group signal.

Akarion GRC Cloud

The breach half is real: a workflow that guides assessment and monitors the 72-hour deadline, with incident steps documented revision-safe. The data-subject half does not exist in this sheet — no intake channel, no Art. 12 clock, no deletion concept, no evidence a deletion ever executed — and half a criterion absent is a mid-table score, not charity.

caralegal

Requests arrive as cases with owner, status and ID, deadlines and data locations are determined automatically, responses go out through a protected data room, and the deletion concept is generated from the record itself; incidents are documented centrally with a guided decision process. We found no public information on intake portals or forms, identity checks, deadline escalation, a 72-hour clock, or evidence that a deletion actually executed.

Akarion GRC Cloud

On privacy regimes this is GDPR-only: 'SDM (DSGVO)' is the single privacy entry in a list otherwise made of security standards — no BDSG, no Swiss nDSG, no UK GDPR, no ePrivacy, and no AI Act duties despite the vendor shipping generative AI. 217 updates in 2024 prove the platform moves, but privacy-regime breadth and one-record-many-regimes mapping are unevidenced.

caralegal

GDPR depth is real, the German Standard Data Protection Model 3.1 is built in with always-updated building blocks and seven guarantee goals, and AI Act duties run as an AI Flow that builds on the same documentation as the privacy module — one record serving two regimes. We found no public information on Swiss, UK or other national privacy regimes.

Akarion GRC Cloud

An Audit-Trail sits in the security feature list, incident handling is documented 'revisionssicher', TOMs produce customizable authority reports, and management/auditor reports are generated at a click under multi-stage approvals. What keeps it from 8: no evidence of audit-scoped evidence packs on demand, and nothing that answers 'show me the state on date X' — revision safety is claimed, point-in-time proof is not.

caralegal

Evidenced: register exports in PDF and Excel, a one-click package to the authority spanning processor agreements through records, audit templates for ISO, GDPR and the AI Act, gap-analysis questionnaires and PDCA planning. We found no public information on revision-safe change history, evidence attachments per activity, or auditor access roles; how a record looked on a given date is the question nothing captured answers.

Akarion GRC Cloud

Thirteen named connectors including Jira, ServiceNow, Matrix42 and Fabasoft, custom connectors on request, SSO/MFA/autoprovisioning, and AI that generates content then submits it for human review — a real connector set with defensible AI assistance. But the evidence documents no API and no webhooks, so this is connector-mediated, not infrastructure: I cannot verify access to the data model from outside the product.

caralegal

Shown: automatic migration of existing documentation into the platform, a live website cookie check by URL, approval workflows with follow-up reminders, and an AI assistant with agents taking over recurring steps. We found no public information on a documented API, directory import, ticketing connectors, SSO or webhooks, so the automation on show is guided workflow and reminders rather than the platform feeding from the live estate.

Akarion GRC Cloud

The chain is as clean as paper gets: GmbH in Linz under a Munich parent AG, registers and VAT IDs published, ICT infrastructure explicitly under German and partially Austrian jurisdiction, hosting on STACKIT in DE/AT with 100% development in AT/DE. It misses the 8 only because the captured evidence publishes no DPA, no TOMs and no subprocessor list — the last link of the chain rests on trust.

caralegal

The imprint establishes a GmbH seated in Berlin with a German VAT ID and named managing directors, which settles the entity question cleanly. Beyond that we found no public information on where the platform itself is hosted, on a customer data processing agreement, or on a platform subprocessor list; the captured privacy policy documents the website chain only, which includes a US provider in Delaware with AWS hosting and Google LLC and Microsoft Corporation transfers under the Data Privacy Framework. For the system that would hold a customer's register of processing, that silence is not a small thing.

Akarion GRC Cloud

Nothing: no price, no edition boundary, no billing period appears on any captured page even though the modules are enumerable. Per the anchors, silence is zero — every invoice is a sales conversation.

caralegal

The Essential tier carries a public starting price quoted as ab 79€ pro Monat, with one legal entity, unlimited users and unlimited documents stated. The captured pricing page gives entity counts for Professional, Corporate and Enterprise but shows a figure only for Essential, with Enterprise priced auf Anfrage, so the real invoice for a multi-entity group is not computable from public pages; we found no public information on setup fees or how software and services are separated.