caralegal vs preeco | datenschutz

caralegal

The record is a connected model: processing activities synchronize automatically with the impact assessment, TOMs and service providers, impact assessments trigger from an automated threshold analysis on risky activities, and the deletion concept is generated from the record itself. With legal-basis, vendor and TOM templates created and reviewed by legal experts, more than 200 processing activity templates, and group structures scaling by legal entities per edition, this is the depth I expect; I found no public information on multi-client mandate handling, which is what would make it a full system of record.

preeco | datenschutz

The register is a genuinely connected model: every Article 30 mandatory field is guided in the record, activities are intelligently linked to systems, TOMs and contracts, and data processing agreements are matched to data recipients automatically by name with uncovered recipients flagged as missing. The Article 35 necessity and screening assessment is proposed from the activity itself, deletion classes derive deletion rules with deadlines and responsibilities, and external DPOs and groups can run hundreds of mandates with cross-client inheritance plus one-click status reports, procedure files and the Bavarian authority questionnaire. I hold back the top mark because missing processor connections are closed by hand, and I found no public information on TOM coverage being computed and reported off the register.

caralegal

Requests arrive in the system with the response deadline shown automatically, the relevant data locations looked up, and answers transmitted through a protected data room — the statutory clock is handled as workflow, not a note in a diary. The breach side is documented only as central documentation with a guided decision process: I found no public information on a 72-hour clock, a severity assessment producing the authority notification, or execution tracking for the deletion concepts generated from the register.

preeco | datenschutz

This is the operational half done to a standard I would defend: web-form intake, documented identity verification with time of request, all Article 15-22 request types under automatic deadline monitoring with proactive warnings, and replies sent only as a one-time link to an encrypted page. The breach workflow produces what I would actually file — nine ready templates covering the initial, follow-up and final reports to the authority under Article 33, the Article 34 notices and the German BSI reports, each with an unambiguous deadline state and a documented justification when a deadline is missed. Deletion classes tie to processing activities and derive rules with deadlines and owners, but I found no public information on execution tracking or evidence that a deletion was carried out.

caralegal

Coverage is the German core done seriously: GDPR records including the Art. 30(2) processor variant, the Standard-Datenschutzmodell 3.1 with guarantee goals and always-updated SDM modules linked to TOMs, cookie-compliance checks, and AI Act audit templates sitting on the same documentation as the privacy flow. That visible maintenance of the legal content is exactly what I insist on; I found no public information on Swiss or UK regimes or per-country variants, so the one-record-many-regimes story is GDPR-plus rather than broad.

preeco | datenschutz

Coverage is Germany-anchored but genuinely one-record-many-regimes: the GDPR record carries the EU AI Act conformity checks and risk classification in the same system, breach incidents emit both Article 33/34 notifications and the German NIS2 reports under a single deadline status, and Schrems II transfer impact assessments and the Bavarian supervisory questionnaire are generated from the same data. Roughly monthly, automatically distributed updates are visible maintenance of a living product. I found no public information on Swiss, UK or other national privacy regimes, so beyond the German-speaking EU this is partial coverage.

caralegal

The single-click submission to authorities covering everything from processor agreements to the records register, plus audit templates for ISO, GDPR and the AI Act and questionnaire-based gap analyses, is more than static PDFs. But I found no public information on revision-safe change history, audit-scoped evidence packs or auditor access roles — without those I cannot defensibly answer "show me the state on date X", so assembling the audit file remains unproven from these pages.

preeco | datenschutz

Defensibility is engineered in: every approval freezes an immutable revision, SHA-256 checksums expose any later manipulation, and the vendor advertises a fixed state of the documentation for any point in time — the answer to 'show me the state on date X'. Status reports, procedure files per processing activity and the Bavarian authority questionnaire generate at the push of a button, a complete automatic activity log records every change and administrative action with user and timestamp, and a full audit module with prebuilt catalogs and permissions separating answering from managing sits on top. I found no public information on external auditor access roles or scope-assembled evidence packs, which is what separates this from the standing-state ideal.

caralegal

What I can see feeding the platform is a website cookie scan by URL, automatic transfer of existing documentation into the system, and PDF/Excel export of the register, with AI assistants and agents advertised for recurring steps. I found no public information on a documented API, directory import, or ticketing and single-sign-on connectors, so the recurring privacy work appears to depend largely on manual entry rather than the real IT estate.

preeco | datenschutz

The vendor describes the application as a closed system with no public REST API, developing customer-specific endpoints only for Private Cloud and On-Premises; I found no public information on directory import, ticketing or HR connectors, webhooks or SCIM. What the pages do show: structured DOCX and XLSX import of existing registers, embeddable web forms via HTML snippet, a Model Context Protocol server that lets an AI assistant query activities and export revisions under application access rights, optional SAML2 single sign-on on the higher hosting tiers, and AI drafting that must pass review and approval before entering documentation. Automation is reminders, recurrence and scheduled reports rather than a live feed from the IT estate.

caralegal

The vendor is a German GmbH seated in Berlin with a German VAT number, which is the right jurisdiction for the system that will hold my register. But the captured pages give no hosting location, no subprocessor list and no data processing agreement for the product itself — the subprocessors actually documented belong to the marketing website, including a US provider running on AWS — so where my compliance record would live and under whose law is unverifiable from public information.

preeco | datenschutz

The compliance record lives under German law end to end: a German entity in Ulm, hosting exclusively in the named Hetzner data centers in Nuremberg and Falkenstein, the vendor stating no transfer of personal data to third countries, and a published data processing agreement with downloadable TOMs and two weeks' written notice of subprocessor changes. The hosting subprocessors named on the vendor's privacy policy are Hetzner in Germany and UpCloud in Finland, on-premises is available where data may never leave the customer's datacenter, and the AI functions are off by default and can run against the customer's own endpoint. I deduct for the undocumented ownership structure and because the same privacy policy concedes that transfers to the US parent companies of LinkedIn, Google and X are not excluded for the vendor's own website.

caralegal

The boundaries are unusually clear for this market: the entry edition at "ab 79€ pro Monat", legal entities per edition at 1, 3, 8 and unlimited, unlimited users and documents, and a public 50% nonprofit discount. But only the entry edition carries any figure, Enterprise is "auf Anfrage", and I found no public prices for the two middle editions, so the real invoice for a multi-entity group is not computable from the pricing page alone.

preeco | datenschutz

I found no public price figures at all; the license is described only as scaling with employees, modules and hosting variant — usefully never with the number of organizations managed, which matters to a group or a consultancy. The vendor does state there are no setup fees and no cancellation periods and that every GDPR obligation ships without add-on modules, but premium support, the DeepL integration, the optional audit catalogs and data migration are all optional and chargeable with no numbers anywhere, and even the FAQ treats premium support costs as an open question. The real invoice is therefore a sales conversation.