audatis MANAGER vs preeco | datenschutz

audatis MANAGER

The VVT is a real core: DSFA with risk management in-system, AVV management that auto-generates the processor register, TOM templates, group templates, delegation and export as an official-register format. I stop short of the top anchors because the evidence never shows activities linked to systems and legal bases, nor DPIA triggers derived from the record.

preeco | datenschutz

The register is a genuinely connected model: every Article 30 mandatory field is guided in the record, activities are intelligently linked to systems, TOMs and contracts, and data processing agreements are matched to data recipients automatically by name with uncovered recipients flagged as missing. The Article 35 necessity and screening assessment is proposed from the activity itself, deletion classes derive deletion rules with deadlines and responsibilities, and external DPOs and groups can run hundreds of mandates with cross-client inheritance plus one-click status reports, procedure files and the Bavarian authority questionnaire. I hold back the top mark because missing processor connections are closed by hand, and I found no public information on TOM coverage being computed and reported off the register.

audatis MANAGER

DSR handling with templates and workflows plus a Löschkonzept as documentation exists, but the evidence is completely silent on a breach register, a 72-hour clock or any Art. 33 notification output — for me that half of the operational DSMS is unevidenced and therefore absent. No statutory-clock automation is claimed either.

preeco | datenschutz

This is the operational half done to a standard I would defend: web-form intake, documented identity verification with time of request, all Article 15-22 request types under automatic deadline monitoring with proactive warnings, and replies sent only as a one-time link to an encrypted page. The breach workflow produces what I would actually file — nine ready templates covering the initial, follow-up and final reports to the authority under Article 33, the Article 34 notices and the German BSI reports, each with an unambiguous deadline state and a documented justification when a deadline is missed. Deletion classes tie to processing activities and derive rules with deadlines and owners, but I found no public information on execution tracking or evidence that a deletion was carried out.

audatis MANAGER

GDPR/BDSG/DSG/EKD/KDG with current statute texts, regular updates and a curated legal-update service genuinely covers the German mid-market, authority and church clientele they target. No UK GDPR, ePrivacy or AI Act duties, and no evidence that one record maps across regimes rather than being per-regime work.

preeco | datenschutz

Coverage is Germany-anchored but genuinely one-record-many-regimes: the GDPR record carries the EU AI Act conformity checks and risk classification in the same system, breach incidents emit both Article 33/34 notifications and the German NIS2 reports under a single deadline status, and Schrems II transfer impact assessments and the Bavarian supervisory questionnaire are generated from the same data. Roughly monthly, automatically distributed updates are visible maintenance of a living product. I found no public information on Swiss, UK or other national privacy regimes, so beyond the German-speaking EU this is partial coverage.

audatis MANAGER

Edit history for Eingabekontrolle, revision-safe attestations, reports pulling KPIs automatically and an official-register export are defensible material. Nothing in the evidence produces an audit-scoped evidence pack, auditor access roles, or a state-on-date-X reconstruction, so an audit file still gets assembled by hand.

preeco | datenschutz

Defensibility is engineered in: every approval freezes an immutable revision, SHA-256 checksums expose any later manipulation, and the vendor advertises a fixed state of the documentation for any point in time — the answer to 'show me the state on date X'. Status reports, procedure files per processing activity and the Bavarian authority questionnaire generate at the push of a button, a complete automatic activity log records every change and administrative action with user and timestamp, and a full audit module with prebuilt catalogs and permissions separating answering from managing sits on top. I found no public information on external auditor access roles or scope-assembled evidence packs, which is what separates this from the standing-state ideal.

audatis MANAGER

The entire estate interface is CSV/Word export and, on the whitelabel tier, an integrable ticket system; no API, directory import or SSO appears anywhere. Delegation and workflows are internal to the tool — nothing feeds the RoPA from AD or pushes evidence back into ticketing, which means records decay between reviews.

preeco | datenschutz

The vendor describes the application as a closed system with no public REST API, developing customer-specific endpoints only for Private Cloud and On-Premises; I found no public information on directory import, ticketing or HR connectors, webhooks or SCIM. What the pages do show: structured DOCX and XLSX import of existing registers, embeddable web forms via HTML snippet, a Model Context Protocol server that lets an AI assistant query activities and export revisions under application access rights, optional SAML2 single sign-on on the higher hosting tiers, and AI drafting that must pass review and approval before entering documentation. Automation is reminders, recurrence and scheduled reports rather than a live feed from the IT estate.

audatis MANAGER

A German GmbH at a German register court with German data centers and an own-server option is a jurisdiction I can defend. But no public DPA or subprocessor list exists for the platform itself, and the vendor's own pages run Elastic APM through an entity addressed in San Francisco, so the chain is not transparent end to end.

preeco | datenschutz

The compliance record lives under German law end to end: a German entity in Ulm, hosting exclusively in the named Hetzner data centers in Nuremberg and Falkenstein, the vendor stating no transfer of personal data to third countries, and a published data processing agreement with downloadable TOMs and two weeks' written notice of subprocessor changes. The hosting subprocessors named on the vendor's privacy policy are Hetzner in Germany and UpCloud in Finland, on-premises is available where data may never leave the customer's datacenter, and the AI functions are off by default and can run against the customer's own endpoint. I deduct for the undocumented ownership structure and because the same privacy policy concedes that transfers to the US parent companies of LinkedIn, Google and X are not excluded for the vendor's own website.

audatis MANAGER

Every figure — standard, group, whitelabel, extra users, storage, ISMS add-on, flatrate — is 'Auf Anfrage'; only the 30-day trial and the included tenant/user counts are public. No buyer can compute a real invoice from these pages, so this is the bottom anchor.

preeco | datenschutz

I found no public price figures at all; the license is described only as scaling with employees, modules and hosting variant — usefully never with the number of organizations managed, which matters to a group or a consultancy. The vendor does state there are no setup fees and no cancellation periods and that every GDPR obligation ships without add-on modules, but premium support, the DeepL integration, the optional audit catalogs and data migration are all optional and chargeable with no numbers anywhere, and even the FAQ treats premium support costs as an open question. The real invoice is therefore a sales conversation.