Akarion GRC Cloud vs caralegal

Akarion GRC Cloud

The DSMS page claims a genuinely connected model — a dynamic VVT that updates from processes and assets, DSFA with data-flow visualization, central Auftragsverarbeiter management with contract/audit tracking, TOMs with authority-facing reports, and TIA documentation — plus mandate inheritance with template tenants that looks like real group reuse. It falls short of an 8 because nothing evidences legal bases living in the system, DPIA triggers derived from the RoPA, or authority-accepted outputs; this is one polished marketing page, not proof of depth.

caralegal

The record side is genuinely connected: processing activities run in a workflow with approval steps, the DPIA is triggered by automated threshold analysis linked to risky activities, and vendors and TOMs synchronize automatically with the register, with legally reviewed, editable templates throughout. We found no public information on multi-client or mandate capability, which is what separates the top anchors. Note also that the captured pages give different figures for the total function count (26 and 27).

Akarion GRC Cloud

The breach half reaches the level-5 claim — a workflow that guides assessment and monitors the 72-hour GDPR clock — but the data-subject half is completely silent: no intake form, no Art. 12 clock, no identity check, no deletion concept, no Art. 33 report output anywhere in the captured pages. Half a criterion with no evidence is information, so this lands between the breach-5 and DSR-absence.

caralegal

Requests arrive in the system with automatic data-location lookup, automatic deadlines and a secure data room for the response, and the deletion concept is generated from the record itself. The breach module is described only as central documentation with a guided decision process — we found no public information on a 72-hour clock, severity assessment, authority notification output or identity verification, which is why this sits below the stronger anchors.

Akarion GRC Cloud

The framework list is deep on the security side (BSI Grundschutz, NIS-2, DORA, ISO family) but the privacy-regime column is one entry: SDM (DSGVO) — no Swiss nDSG, no UK GDPR, no ePrivacy, no AI Act privacy duties, and no evidence of one-record-many-regimes mapping. '217 updates in 2024' is platform velocity, not a documented legal-content cadence, so I can't credit maintenance of regimes that aren't listed.

caralegal

Beyond GDPR the product carries the German Standard-Datenschutzmodell 3.1 with always-updated building blocks, audit templates for the AI Act, and a website cookie check, and the vendor states privacy and AI documentation build on the same basis. We found no public information on Swiss or UK coverage or per-country variants, so the breadth of a top score is not evidenced.

Akarion GRC Cloud

The claims overshoot rubric level 5 — revisionssichere incident documentation, on-click reports for management and auditors, TOMs with customizable reports for Behörden, an audit trail, multi-stage approvals and a dedicated Audit module. But nothing evidences audit-scoped evidence packs, auditor access roles, or point-in-time reconstruction ('state on date X'), so it stays below 8 on claim-not-proof.

caralegal

An Audit & Vendor Flow, audit templates for ISO, GDPR and AI Act, gap-analysis questionnaires, PDF/Excel register export and submission to authorities with a single click are all evidenced. But we found no public information on revision-safe change history, auditor access roles or reconstructing the state on a given date, so the audit file may still take manual assembly even if the outputs are fast.

Akarion GRC Cloud

The connector list is the hardest fact here — 13 native integrations spanning ticketing (Jira, ServiceNow, omnitracker), ECM and collaboration, plus custom connectors, SSO/MFA and real automation in top-down mandate inheritance and automated Schutzbedarfsvererbung. But 'Autoprovisioning' is a bare word with no SCIM named, and no documented REST API or webhook appears anywhere — the AI claims at least admit human review, but infrastructure this is not.

caralegal

The only connections to the outside estate evidenced are a one-time automatic transfer of existing documentation and PDF/Excel export; we found no public information on an API, directory import, ticketing or HR connectors, or SSO. The AI assistant and agents appear once in a webinar description with no detail on what they actually do, and I do not credit that as automation.

Akarion GRC Cloud

What keeps this at 4 rather than 5+ is that no public DPA, no subprocessor list, and no TOMs publication are captured — for the system holding your RoPA, that's the missing half of the chain.

caralegal

A German entity with a Berlin seat and VAT number is confirmed in the imprint, and the privacy policy discloses the website's processors — including US-based ones such as Supademo on AWS and Google and Microsoft under the Data Privacy Framework. For the platform holding the customer's register itself, we found no public information on hosting location, product subprocessors or a product data processing agreement, and the captured security page confirmed nothing on certifications either.

Akarion GRC Cloud

Five modules 'for your individual needs' and a module lineup are described across four captured pages, and not one number, edition, billing period or setup fee appears anywhere. Every configuration is evidently a sales conversation, which is the anchor-0 definition, however normal that is in this market.

caralegal

Essential carries a published starting price of "ab 79€ pro Monat" with entity counts per tier, unlimited users and documents, a stated trial condition and a 50% nonprofit discount. Enterprise is "auf Anfrage" and we found no public prices for the Professional and Corporate tiers, so the real invoice for anything above one entity is not computable from the captured pages.