Data Protection
Didomi
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Didomi SAS · didomi.io
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Didomi at a glance
- Vendor
- Didomi SAS
- Headquarters
- Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 13 Oct 2026
- Panel verdict
- The AI panel rates Didomi 1.5/5, the mean of 6 judges. Didomi presents as a privacy platform for consent and preference management, and the scores follow that shape: strongest on framework coverage and audit readiness (both 5 to 6), weakest on privacy management (0 to 1). how scores are made
- As of
- Vendor pages captured 13 Oct 2026; evaluated by the panel 15 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Didomi presents as a privacy platform for consent and preference management, and the scores follow that shape: strongest on framework coverage and audit readiness (both 5 to 6), weakest on privacy management (0 to 1). The credit sits in consent mechanics — up to 21 regulations (GDPR, noted Law-25 compliant, plus 20 US state laws) configurable on a single notice with per-territory settings and GPP mapping, and consent proofs stored five years, retrievable within 24 hours of collection for an end-user's request or a supervisory audit, with the full consent base and notice versions exportable via API. The weakness is the legal core: we found no public information on records of processing, DPIA workflows, processor and DPA management, or TOMs, and the captured incident pages describe the vendor's own uptime monitoring rather than client-side breach handling. The one-point spreads on framework coverage and audit readiness reflect how far to credit consent-shaped breadth; rights and incidents and sovereignty each scored a uniform 2. Pricing shows only as a demo request and a monthly report allotment.
Speaks for it
- Up to 21 regulations — GDPR (Law-25 Compliant) plus 20 US state laws — configurable on a single notice with per-territory settings, vendors, GPP mapping, and purposes and categories
- Consent proofs stored five years and retrievable within 24 hours of collection, individually for an end-user's request or a supervisory audit
- Full consent-base export via API, notice versions retrievable via API, and a daily batch export of end-user consent information
- Vendor support can supply individual proofs of consent for all of an organization's end-users plus the notice configurations for a domain under supervisory review
- Consent-signal frameworks documented by vendor (IAB TCF, Google Consent Mode, Microsoft Consent Mode, Amazon Consent Signal, WordPress Consent API) and by country/region (GPP, Google Consent Mode, GPC)
Held against it
- We found no public information on records of processing, DPIA workflows, processor and DPA management, or TOMs — the lowest-scoring area at 0 to 1
- We found no public information on request workflows with statutory clocks, a breach register, or deletion execution; the captured incident pages describe the vendor's own uptime and response-time monitoring
- We found no public information on hosting region, a published DPA, or a subprocessor list for a system holding five years of consent proofs; monitoring tools named include AWS CloudFront and New Relic
- We found no public information on directory import, SSO/SCIM, webhooks, or ticketing and asset connectors — the documented automation surface is consent export
- We found no public information on European regimes beyond GDPR — UK GDPR, Swiss nDSG, ePrivacy, AI Act duties — or on a documented update cadence when the law moves
Best for
- You operate consent notices under the GDPR and multiple US state privacy laws and want one notice carrying up to 21 regulations with per-territory settings and GPP mapping
- You must answer a supervisory authority with individual consent proofs for your end-users plus the notice configurations for the domain under review
- You need long-hold, exportable consent evidence — five-year retention, retrieval within 24 hours of collection, full consent-base export via API and a daily batch export
- Your records of processing, DPIAs and TOMs already live elsewhere and you are buying a consent and preference platform rather than a full data protection management system
Avoid if
- You expect one tool to keep your records of processing, DPIA workflows, processor management and TOMs — the captured pages present Didomi throughout as a consent and preference platform
- Your rights program needs request intake with statutory clocks, a breach register and deletion execution — the incident pages captured describe Didomi's own uptime and response-time monitoring
- You must verify hosting region, a published DPA and the subprocessor list before signing — ask the vendor: the public pages we read do not show it
- Your automation plan depends on directory import, SSO/SCIM, webhooks or ticketing connectors — the documented surface is a consent API, notice-version retrieval and a daily batch export
The scores
| Criterion | Panel median |
|---|---|
| Records & DPIA depth | 0 of 5 |
| Data subject rights & incidents | 1 of 5 |
| Privacy regime coverage | 3 of 5 |
| Audit readiness & evidence | 2.5 of 5 |
| Integrations & automation | 2 of 5 |
| European sovereignty | 1 of 5 |
Records & DPIA depth
Show reasoningHide reasoning
How this is scored
The DSMS core: records of processing (RoPA/VVT), data protection impact assessments, processor/DPA management and TOMs — how deeply the legal artifacts are modeled and connected.
0 — Document templates in a folder tree; the "register" is a Word file with version numbers in the filename.
3 — A structured RoPA with basic fields and a DPIA questionnaire, but processors, TOMs and legal bases live outside the system.
5 — RoPA and DPIA as linked modules with templates; processor management and TOM assignment exist but are shallow, and group reuse is copy-paste.
8 — A connected data model — processing activities linked to systems, processors, TOMs and legal bases — with DPIA triggers derived from the record, reusable group templates, and outputs a supervisory authority accepts.
10 — Privacy records as a system of record: the RoPA drives DPIAs, processor management and TOM coverage from one data model, multi-client/mandate capability included, and the documentation is audit-ready without manual assembly.
The External DPO
The captured pages model regulations with purposes, categories and vendor lists, but that is notice configuration serving the consent platform, not a register of processing; we found no public information on records of processing, DPIAs, processor/DPA management or TOMs, so there is no RoPA here to drive anything else for a mandate. 1 5 6
The In-House Counsel
We found no public information on records of processing, DPIA workflows, processor and DPA management, or TOMs; the product is presented throughout as a consent and preference platform. For Article 30 documentation there is nothing here I could put in front of an authority. 1
The Drafted Generalist
Every page I can see is about consent capture and preference management; we found no public information on records of processing, impact assessments, processor management, or technical and organizational measures. For someone like me who needs the register itself kept in order, the legal-artifact work would apparently still live in my own files. 1 6
The Lead Auditor
I found no public information on records of processing, DPIAs, processor and DPA management, or TOMs as modeled, linked artifacts. The structured records that are evidenced — consent proofs and notice versions — belong to a different artifact class than the register-and-assessment core this lens weighs. 1 6
The IT Integrator
Everything captured describes a consent and preference platform: notices, regulations, frameworks, consent proofs. We found no public information on records of processing, DPIA workflows, processor and DPA management or TOMs — nothing in the captures speaks to the legal core of a DSMS. 1 5 6
The Skeptic
The captured product story is consent and preference capture; we found no public information on a records-of-processing register, DPIA functionality, processor/DPA management or TOMs. The deepest legal artifact described is a "regulation", which the documentation itself defines as a set of settings applied to a consent notice. 1 5
Data subject rights & incidents
Show reasoningHide reasoning
How this is scored
The operational half of the DSMS: data subject request handling with statutory clocks, breach register and authority notification, deletion concepts that actually delete.
0 — Requests arrive by email and live there; breaches are a phone call and a memo.
3 — A request log and a breach list exist, but deadlines are manual, intake is unstructured, and deletion rules are documentation rather than workflow.
5 — DSR workflows with the Art. 12 clock tracked, structured breach register with the 72-hour clock, deletion concepts assignable to records; automation is reminders.
8 — Intake channels for requests (portal/form), identity-check support, deadline automation with escalation, breach severity assessment and authority-report output, deletion rules tied to the RoPA with execution tracking.
10 — Rights and incidents as operations: end-to-end request handling an authority audit walks through, breach workflows that produce the Art. 33 notification, and deletion automation with evidence that the deletion happened.
The External DPO
The one rights-relevant capability is real: consent proofs stored five years and retrievable per end-user for individual requests and supervisory audits. Beyond that we found no public information on request workflows, statutory clocks, breach registers or deletion execution — the only incident pages captured describe the vendor's own uptime management, not a client-facing module. 2 3 6
The In-House Counsel
Consent proofs are stored five years and individually retrievable to answer a data subject's request or a supervisory inquiry, with a full export of the consent base available via API — genuine evidence support. We found no public information on statutory-clock tracking, structured breach registers, or authority-notification output; the incident pages describe Didomi's own uptime monitoring, not a client's 72-hour breach workflow. 2 6
The Drafted Generalist
The one real bright spot is consent evidence for requests: proofs kept five years, retrievable within a day, a full consent-base export via API, daily batch files, and vendor help assembling proofs and notice settings for a supervisory review. We found no public information on request intake or statutory deadlines, a breach register with the 72-hour clock, or deletion workflows — the incident pages I can see describe server uptime and response-time monitoring rather than data-breach handling. 2 6 7
The Lead Auditor
Consent proofs are retrievable to answer an individual request or a supervisory audit, and the vendor states it can supply individual proofs plus domain notice configurations when an authority asks — genuine but narrow rights support. I found no public information on request workflows with statutory clocks, a breach register with the 72-hour clock, or deletion execution tracking; the incident pages captured describe the vendor's own service monitoring, not customer-side breach handling. 2 3 6
The IT Integrator
Consent proofs are retained five years and are retrievable for an individual request or a supervisory audit, which genuinely helps answer a rights request about consent. The incident pages, however, document Didomi's own uptime monitoring and SLA — 24/7 infrastructure alerts, 99.9th-percentile consent read/write latency — and we found no public information on DSR intake, statutory clocks, a breach register or deletion execution. 2 3 6
The Skeptic
The one rights-adjacent capability is real: a stored consent proof retrievable "as a response to an individual request or supervisory audit", with a full consent-base export on offer. Everything else in this space is uptime incident management — 24/7 server monitoring and response-time percentiles — and we found no public information on request workflows, statutory deadlines, a breach register or deletion execution. 2 6
Privacy regime coverage
Show reasoningHide reasoning
How this is scored
Which privacy regimes the product actually operationalizes — GDPR, BDSG, Swiss nDSG, UK GDPR, ePrivacy, EU AI Act privacy duties — and whether one record maps across them or each regime is a fresh island.
0 — One regime, hard-coded; anything else is "on the roadmap".
3 — GDPR plus one national law as separate checklists; the same processing activity is documented once per regime.
5 — The major regimes for its market with partial cross-mapping; newer duties (AI Act, ePrivacy changes) present as content packs of varying depth.
8 — Broad current coverage with one-record-many-regimes mapping and visible maintenance as regimes evolve.
10 — Regime coverage as a living product: multiple privacy regimes on one data basis, per-country variants, and documented update cadence when the law moves.
The External DPO
Twenty-one regulations configurable in a single notice — GDPR noted as Law-25 compliant plus twenty US state laws — with territories, GPP mapping and vendor frameworks like IAB TCF is genuine one-notice-many-regimes work I could template across clients. For European mandates the captured pages name GDPR only; we found no public information on UK GDPR, Swiss nDSG or AI Act duties, and no documented update cadence. 4 5
The In-House Counsel
Twenty-one consent regulations including GDPR and the major US state laws can be configured on a single notice with territory-scoped settings, which is a real one-notice-many-regimes construction. Coverage is consent-side only: we found no public information on BDSG, Swiss nDSG, UK GDPR, ePrivacy or AI Act privacy duties, and no documented update cadence when the law moves. 4 5
The Drafted Generalist
Twenty-one regulations — GDPR plus a long list of US state privacy laws — can be configured into a single notice with per-territory settings, vendor lists, GPP mapping and national-specific requirements, which is genuinely one record serving many regimes. Frameworks for IAB TCF and the Google, Microsoft and Amazon consent signals are documented too. I found no public information on European regimes beyond GDPR, so UK GDPR, Swiss law and AI Act duties are beyond what these pages show. 4 5
The Lead Auditor
Twenty-one regulations — GDPR and the US state privacy laws — can sit on one notice with per-territory settings and shared consent frameworks, which is real one-record-many-regimes behavior at the consent layer, and the inclusion of recent state laws suggests upkeep. Beyond GDPR I found no public information on BDSG, Swiss nDSG, UK GDPR, ePrivacy or AI Act duties, so the breadth is consent-shaped rather than regime-wide. 4 5
The IT Integrator
A single notice can carry up to 21 regulations — GDPR plus the US state privacy laws — with per-territory settings, GPP mapping and vendor consent frameworks like IAB TCF, Google and Microsoft consent modes in one configuration; that is real one-record-many-regimes mapping. It is consent-scope coverage: the captured list shows GDPR and US state laws, and we found no public information on UK GDPR, ePrivacy, Swiss nDSG or EU AI Act duties, nor on a documented update cadence. 4 5
The Skeptic
Twenty-one regulations configurable in a single notice, each with its own territories, vendors, purposes and GPP mapping, plus TCF, Consent Mode and GPC frameworks, is genuine one-notice-many-regimes work for consent. But a "regulation" here governs notice settings, and we found no public information on UK GDPR, Swiss nDSG, ePrivacy or any EU AI Act duties. 4 5
Audit readiness & evidence
Show reasoningHide reasoning
How this is scored
Whether the system produces defensible proof: revision-safe history, evidence collection, reports for auditors, authorities and management.
0 — Exports are screenshots; history is overwritten in place.
3 — PDF reports exist but evidence is attached ad hoc and changes leave no reliable trail.
5 — Versioned records, standard report generators for the core registers, evidence attachments per activity; assembling a full audit file still takes days.
8 — Revision-safe change history, audit-scoped evidence packs on demand, management and authority reports current at a click, auditor access roles.
10 — Audit readiness as a standing state: continuous documentation status per regime and scope, exportable proof packs an auditor accepts as-is, and a defensible answer to "show me the state on date X".
The External DPO
Five-year proof retention, per-end-user proof retrieval for supervisory authorities, notice versions via API and a daily batch export give a defensible answer for the consent record specifically. For client-ready audit files more broadly we found no public information on revision-safe change history, on auditor access beyond a reports viewer, or on management-level reporting. 6 7
The In-House Counsel
The consent evidence chain is defensible in its scope: proofs retained five years, retrievable per end-user within 24 hours, produced on request for a supervisory authority together with the notice configurations, under a dedicated reports-viewer access type with API export. We found no public information on revision-safe change history, management reports, or an answer to "show me the state on date X". 6 7
The Drafted Generalist
Within its consent lane the proof system is solid: five-year retention, retrieval within 24 hours, complete consent-base export via API, retrievable notice versions, a viewer role just for proof reports, and vendor support producing proofs plus domain notice configurations for a supervisory audit — that is a pack I could hand an auditor for consent. Beyond consent — processing registers, impact assessments, a privacy-wide change history — we found no public information, and reports run against a monthly allotment I would need sized before an audit month. 6 7
The Lead Auditor
Five-year retention of consent proofs, retrieval of proofs and notice versions via API, and a stated service producing all proofs plus notice configurations for a domain under supervisory review amount to an evidence pull rather than assembly the week before. I found no public information on revision-safe change history beyond notice versions, management reporting, or proof packs extending past the consent domain, and the monthly report allotment caps how much can be pulled. 6 7
The IT Integrator
Notice versions are retrievable via API, consent proofs are stored five years and retrievable within 24 hours of collection, and Didomi can produce individual proofs plus the notice configuration for a domain under supervisory review — defensible, machine-retrievable evidence for the consent register. We found no public information on revision-safe change history beyond notice versions, auditor access roles, or reconstructing a dated state of the wider program. 6 7
The Skeptic
Consent proofs stored for five years and retrievable within 24 hours, notice versions retrievable via API, and supervisory-authority support that can produce proofs for every end-user plus the notice configurations for the domain under review — that is defensible evidence for a consent audit. It stops there: report generation draws against a monthly allotment, and we found no public information on revision-safe change history, on-demand evidence packs or auditor access beyond a "Consent Proof Reports - Viewer" access type. 6 7
Integrations & automation
Show reasoningHide reasoning
How this is scored
Whether the platform feeds from the real IT estate — directory import, ticketing, API — and automates the recurring privacy work instead of re-typing it.
0 — A closed island: manual entry in, PDF out, no API.
3 — CSV/Excel import and export; no live connections, no API worth the name.
5 — Directory import (AD/Entra), a documented REST API for core objects, a handful of native connectors (ticketing or SSO); automation is reminders and recurrence.
8 — Real connector set (ticketing, HR or asset sources), webhooks, SSO/SCIM, workflow automation with delegation and escalation, useful AI assistance with human review.
10 — The platform behaves like infrastructure: API parity for the data model, event streams, bidirectional sync with the estate, and automation that measurably removes the recurring toil (reviews, attestations, evidence pulls) rather than renaming it.
The External DPO
A documented API for the consent base and notice versions, daily batch export, and consent signals flowing to vendor frameworks like Google and Microsoft Consent Mode are the beginnings of estate integration. We found no public information on directory import, ticketing, SSO/SCIM or delegated workflow automation, so recurring review and attestation toil across mandates stays manual. 4 6 7 8 9
The In-House Counsel
There is an API for the core consent objects, a daily batch export, and consent-signal integrations with the major advertising and platform vendors through frameworks like TCF, GPP and Google Consent Mode. We found no public information on directory import, ticketing or HR connectors, SSO/SCIM, or workflow automation with delegation and escalation, so the recurring privacy work would be re-keyed elsewhere. 4 6 7
The Drafted Generalist
There is a documented API for exporting the consent base and retrieving notice versions, plus daily batch export and consent-signal integrations with the major platforms (IAB TCF, Google, Microsoft, Amazon, WordPress). We found no public information on directory import, ticketing or HR connectors, SSO, or webhooks — the automation that would stop me re-typing things into the system is invisible on these pages. 4 6 7
The Lead Auditor
API export of the full consent base, daily batch export, and consent-signal integrations with IAB TCF, Google, Microsoft and Amazon show the platform wired into the consent estate. I found no public information on directory import, ticketing, SSO/SCIM, webhooks or workflow automation, so everything outside consent management looks like manual entry. 4 6 7
The IT Integrator
There is a real production API here — consent read/write requests are monitored at the 99.9th percentile, the full consent base exports via API, and a daily batch export plus developer integration pages and tutorials exist. But that is a consent-data pipe, not an estate feed: we found no public information on directory import from Entra ID or AD, SSO/SCIM, webhooks, or ticketing and asset-source connectors, and I will not credit integrations the pages do not name. 2 6 7 8 9
The Skeptic
The documented automation surface is an API: full consent-base export via API, notice versions via API, and a daily batch export of consent information. We found no public information on connectors, SSO, directory import or workflow automation, so what is captured reads as export plumbing rather than estate integration. 6 7
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where the compliance record of the whole company actually lives and under whose law — entity, hosting, subprocessors, DPA. A platform that maps your processing is itself your most concentrated processing.
0 — Non-EU entity, non-EU-default hosting, no public DPA or subprocessor list — for the system holding your RoPA.
3 — A DPA exists and an EU region is available on request or on top tiers; subprocessor exposure to US CLOUD Act reach is broad or undocumented.
5 — EU hosting is the default, DPA and subprocessor list published; the vendor or a critical subprocessor is still within non-European jurisdictional reach.
8 — EU entity, EU hosting with named data centers, published subprocessor list free of content-touching non-EU processors, DPA and TOMs public.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors, on-premises or sovereign-cloud options, and the whole chain documented publicly.
The External DPO
The vendor is a French société par actions simplifiée, which is an EU entity, but the captured sovereignty facts are otherwise empty: we found no public information on hosting locations, a public DPA or a subprocessor list, and the vendor's own incident page names AWS CloudFront and New Relic among its monitoring tools. 2
The In-House Counsel
The vendor is a French société par actions simplifiée, the right starting point, but we found no public information on hosting location, a published DPA, or a subprocessor list; the only infrastructure signal is monitoring through AWS CloudFront and New Relic. For the system holding five years of consent proofs, I cannot assess the jurisdictional exposure of the chain from the captured material. 1 2
The Drafted Generalist
The vendor is a French company and the monitoring page mentions AWS CloudFront in the stack, but we found no public information on hosting regions, a subprocessor list, or a published data processing agreement. For the system holding my consent records, that is homework I would have to do by email before signing. 2
The Lead Auditor
The vendor presents as a French société, but the captured incident-management page names AWS CloudFront among its monitoring tools, pointing to a US-headquartered cloud provider in the operational chain. I found no public information on hosting location, a published DPA, or a subprocessor list, so for the system holding your consent record I cannot verify where it lives or under whose law. 1 2
The IT Integrator
The vendor operates as Didomi SAS on a stack that includes AWS CloudFront, but no sovereignty attributes were captured — we found no public information on hosting region and named data centers, a published DPA, or a subprocessor list, for a service that stores five years of consent proofs. For the platform holding that concentrated personal data, the undocumented chain decides it. 1 2 6
The Skeptic
For a system storing five years of end-user consent proofs, we found no public information on hosting location, a published DPA, or a subprocessor list — the sovereignty record is simply absent. The only stack detail captured puts AWS CloudFront and New Relic in the monitoring chain. 1 2
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real invoice — per module, per entity, per year, with consulting unbundled — from public pages alone. Unpublished pricing is the B2B norm in this market, so this criterion describes rather than condemns; the benches weight it accordingly.
0 — No public prices at all; every configuration is a sales conversation.
3 — An entry price exists, but module add-ons, entity counts or bundled consulting make the real total incomputable.
5 — Most editions carry real numbers with billing period stated and software separated from services; at least one commonly needed module or scale step is unpriced.
8 — Every edition and module priced publicly with entity/user boundaries and setup fees stated; only genuine corporate-group contracts are custom.
10 — Complete price computability: modules, scale steps, service packages and renewal rules public, so the invoice for a 100-employee company and a 10-client consultancy is a two-minute exercise.
The External DPO
The only pricing-adjacent facts captured are a "Request a demo" call to action and a monthly report allotment counter under the notice-versions view. We found no public information on prices for any edition, module or service, so the real invoice — for a hundred-employee client or a ten-client practice — is a sales conversation. 1 7
The In-House Counsel
The only commercial signals on the captured pages are a request-a-demo call to action and an in-console monthly report allotment with no stated rates; we found no public price figures at all, so no invoice can be computed without a sales conversation. That is the norm in this market, and it sits at the bottom of this measure. 1 7
The Drafted Generalist
We found no public pricing on these pages — the entry point is a demo request, and the only commercial shape visible is a monthly allotment of consent-proof reports tracked in a tab. Computing a real invoice for my firm from public material is not possible here. 1 7
The Lead Auditor
The only commercial gesture captured is a demo request alongside the client-count claim. I found no public prices, editions, modules or billing periods, so from public pages alone the invoice is entirely a sales conversation. 1
The IT Integrator
The only commercial artifact in the captures is a monthly allotment for consent-proof reports, tracked in the console behind a "Request a demo" gate; we found no public prices for any edition, module or scale. A buyer can see the meter but never the rate, so no invoice is computable from these pages. 1 7
The Skeptic
No price appears in the captured pages; the only commercial gesture is "Request a demo" beside a "+2000 clients worldwide" banner. The single pricing-relevant mechanic is an in-console monthly allotment for consent-proof reports — a meter with no published rate, so the real invoice stays a sales conversation. 1 7
Questions about Didomi
Is Didomi European?
Not determined: the vendor’s pages as captured do not say where Didomi is based.
Where does Didomi store data?
Not stated on the vendor’s pages as of 13 Oct 2026.
Does Didomi have a free plan?
Not stated on the vendor’s pages as of 13 Oct 2026.
What are the best alternatives to Didomi?
As of 21 Oct 2026, the panel rates preeco | datenschutz (4/5), Dastra (3/5) and caralegal (3/5) highest among the other 41 Data Protection products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is preeco | datenschutz (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Didomi alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 13 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We could not confirm any compliance information on the vendor’s own pages as captured, so this page shows none rather than a statement we cannot stand behind. Know more? Tell us
- 15 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (9)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page didomi.io Checked 13 Oct 2026 Details →
- 2 Data subject rights & incidents — found from sitemap support.didomi.io Checked 13 Oct 2026 Details →
- 3 Data subject rights & incidents — found from sitemap docs.didomi.io Checked 13 Oct 2026 Details →
- 4 Privacy regime coverage — found from sitemap docs.didomi.io Checked 13 Oct 2026 Details →
- 5 Privacy regime coverage — found from sitemap docs.didomi.io Checked 13 Oct 2026 Details →
- 6 Audit readiness & evidence — found from sitemap docs.didomi.io Checked 13 Oct 2026 Details →
- 7 Audit readiness & evidence — found from sitemap docs.didomi.io Checked 13 Oct 2026 Details →
- 8 Integrations & automation — found from sitemap docs.didomi.io Checked 13 Oct 2026 Details →
- 9 Integrations & automation — found from sitemap developers.didomi.io Checked 13 Oct 2026 Details →