Data Protection
Ethyca
Provenance unknown Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: 1 of 6 dimensions proven
0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Ethyca Inc. · ethyca.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Ethyca at a glance
- Vendor
- Ethyca Inc.
- Headquarters
- Not stated on the vendor’s pages as of 3 Nov 2026
- Data hosting
- Outside the EU by default source, captured 3 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 3 Nov 2026
- Panel verdict
- The AI panel rates Ethyca 2.5/5, the mean of 6 judges. Ethyca's strongest areas are rights and incidents and integrations and automation, both clustering at 6-7: a privacy center verifies requesters by email or phone with an MFA short code, and fulfilment runs programmatically across connected databases and SaaS applications. how scores are made
- As of
- Vendor pages captured 3 Nov 2026; evaluated by the panel 4 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Ethyca's strongest areas are rights and incidents and integrations and automation, both clustering at 6-7: a privacy center verifies requesters by email or phone with an MFA short code, and fulfilment runs programmatically across connected databases and SaaS applications. Sovereignty is weakest at 2-3: the privacy policy states that Data Privacy Solutions data is stored on a server on the east coast of the United States with Standard Contractual Clauses as the transfer mechanism, and we found no public information on the contracting entity's jurisdiction, a data processing agreement, a subprocessor list or an EU hosting option. The self-hosted alternative, open-source Fides under the Apache-2.0 licence on your own infrastructure, carries a caveat: the repository was archived on Aug 28, 2026 and is now read-only. Privacy management and audit readiness sit at 4-6, framework coverage at 5-6, with no public information found on processor and DPA records, technical and organisational measures tied to processing activities, breach registers or 72-hour clocks, or regimes such as BDSG, the nDSG or UK GDPR. Judges' scores cluster tightly; pricing is a sales conversation.
Speaks for it
- Data subject requests are handled end to end, from privacy center intake with MFA short-code identity verification to programmatic execution with per-request execution and audit logs.
- Integrations span ten named databases from PostgreSQL to Snowflake plus SaaS connectors such as HubSpot and Google Analytics, with a documented REST API.
- Okta and Microsoft Entra ID monitors surface discovered applications for approval into a system inventory with one privacy declaration per data use.
- Assessment answers export as a PDF suitable for submitting a DPIA to a supervisory authority, and per-request diagnostics exports contain no personal data.
- The open-source Fides tooling under the Apache-2.0 licence can run self-hosted on the customer's own infrastructure.
Held against it
- The privacy policy states that personal information from the Data Privacy Solutions is stored on a server on the east coast of the United States, with Standard Contractual Clauses as the transfer mechanism.
- The captured pages leave the contracting entity's jurisdiction, the data processing agreement and any subprocessor list unstated.
- We found no public information on processor and DPA records or on technical and organisational measures assigned to processing activities.
- We found no public information on a breach register or a 72-hour notification workflow.
- The open-source repository was archived by the owner on Aug 28, 2026 and is now read-only.
Best for
- You need to run GDPR, CCPA and Virginia (VCDPA) data subject requests programmatically across many connected systems, with per-request audit trails.
- Your team wants a system inventory built from live identity-provider data, approving discovered applications into records with privacy declarations.
- You are prepared to self-host the open-source Fides tooling on your own infrastructure under the Apache-2.0 licence.
- You need regulator-facing documentation — DPIA-style assessment PDFs and per-request diagnostics snapshots containing no personal data.
Avoid if
- You require EU-resident hosting for the hosted platform — the privacy policy states storage on a server on the east coast of the United States with Standard Contractual Clauses as the transfer mechanism.
- Your compliance scope includes national regimes such as BDSG, the Swiss nDSG or UK GDPR — the documented regulation pages cover GDPR, CCPA and Virginia's VCDPA.
- Your records of processing must capture processors with their data processing agreements and technical and organisational measures — the documented record here is a system inventory with one privacy declaration per data use.
- Your priority is breach and incident management — the documented strength is the rights request pipeline, and we found no public information on a breach register or a 72-hour notification workflow.
The scores
| Criterion | Panel median |
|---|---|
| Records & DPIA depth | 2 of 5 |
| Data subject rights & incidents | 3.5 of 5 |
| Privacy regime coverage | 3 of 5 |
| Audit readiness & evidence | 2.5 of 5 |
| Integrations & automation | 3.5 of 5 |
| European sovereignty | 1 of 5 |
Records & DPIA depth
Show reasoningHide reasoning
How this is scored
The DSMS core: records of processing activities (RoPA/VVT, Art. 30 DSGVO), data protection impact assessments (DSFA, Art. 35), processor and DPA management (AVV), and technical and organisational measures (TOMs) — how deeply the legal artefacts are modelled and connected.
0 — Not a privacy management tool; at most a set of document templates with no structured records.
3 — A structured record of processing activities with templates, and a DPIA questionnaire or checklist.
5 — Records of processing and DPIAs as modules with templates, processors and their DPAs recorded, and TOMs documented and assigned to processing activities.
8 — A connected data model — processing activities linked to systems, processors, TOMs and legal bases — with DPIA need derived from the record, reusable templates across companies, and outputs (Art. 30 register, DPIA report) ready for a supervisory authority.
10 — Privacy records as a system of record: the RoPA drives DPIAs, processor management and TOM coverage from one data model, multi-client capability for external data protection officers, and the documentation is audit-ready without manual assembly.
The External DPO
The data map and system inventory carry a privacy declaration per data use with assigned stewards, and assessments export as a DPIA PDF fit to submit to a supervisory authority — that part I can hand a client. But I found no public information on processor and DPA management, on TOMs tied to processing activities, or on reusable templates across companies, so the register stops well short of driving the rest of the programme. 8 9 11 13
The In-House Counsel
The evidence shows a structured record — applications approved into a system inventory with one privacy declaration per data use, built on a data map — and data protection assessments whose answers export as a PDF the vendor describes as suitable for submitting to a supervisory authority. RoPA automation is claimed on the GDPR platform page. What I cannot defend on this evidence: processors with their DPAs and TOMs assigned to processing activities — I found no public information on either. 4 8 9 11 13
The Drafted Generalist
The data mapping is real, not a template file: discovered applications are approved into a system inventory with a privacy declaration per data use, and assessments export as a clean PDF intended for a supervisory authority. The GDPR platform page promises automated RoPA, but I found no public information on processor and DPA records or on technical and organisational measures assigned to processing activities. 8 9 11 13
The Lead Auditor
The captured pages show a structured system inventory that creates systems with one privacy declaration per data use, a data map, GDPR guidance from mapping through assessments, and a data protection assessment module with question groups exportable as a regulator-ready PDF; RoPA automation is claimed on the GDPR platform page. We found no public information on processor and DPA management, and none on technical and organisational measures documented and assigned to processing activities, so the record stops short of a connected privacy data model. 4 8 9 11 13
The IT Integrator
A system inventory where each approved application gets a privacy declaration per data use, plus assessment question groups whose PDF is formatted for submission to a supervisory authority, is a real records-and-DPIA core fed by discovery scans rather than typing. I found no public information on processor and DPA records or on technical and organisational measures documented against processing activities, so the connected-record picture stops short of the higher levels. 4 8 9 11 13
The Skeptic
The pages document a system inventory built from discovered applications with one privacy declaration per data use, a data map, and data protection assessments exported as a question-and-answer PDF intended for supervisory authorities — so more than a template checklist. But we found no public information on recording processors and their data processing agreements or on technical and organisational measures assigned to processing activities, so the marketing claim of RoPA automation runs ahead of the documented depth. 8 9 11 13
Data subject rights & incidents
Show reasoningHide reasoning
How this is scored
The operational half of the DSMS: handling data subject requests within the Art. 12 deadline, a breach register with the 72-hour notification of Art. 33, and deletion concepts that are carried out.
0 — No handling of data subject requests or data breaches in the product.
3 — A log of data subject requests and a register of data breaches, with templates for the responses.
5 — Request workflows with the one-month Art. 12 deadline tracked and reminders, a breach register with the 72-hour clock and a risk assessment per breach, and deletion periods recorded per processing activity.
8 — An intake form or portal for requests with identity verification, deadline escalation, breach severity assessment producing the authority notification, and deletion rules tied to the RoPA with execution tracked.
10 — Rights and incidents as operations: end-to-end request handling an authority audit can walk through, breach workflows that produce the Art. 33 and Art. 34 notifications, and deletion automation with evidence that the deletion happened.
The External DPO
Rights handling is the strong suit: a privacy centre receives requests, identity is verified by email or phone with an MFA short code, and fulfilment runs programmatically across every connected database with statuses, audit logs and resumable pauses — an authority can walk a request through it. What I cannot find is any breach register or 72-hour workflow, and no deadline clocks, reminders or escalation on the requests themselves. 6 7 10 12
The In-House Counsel
Rights handling is the strong half: a privacy center receives requests, identity is verified by email or phone with an MFA short code, and access, correction, erasure and portability are executed programmatically across connected databases and SaaS applications, each request carrying lifecycle timestamps and audit logs an authority could walk through. The score sits mid-scale because the incident half of my job is dark here: I found no public information on a breach register, a 72-hour clock or a workflow that produces the Article 33 notification, and the deadline rules appear as legal guidance rather than a tracked clock in the product. 3 6 7 9 10 12
The Drafted Generalist
The request half is genuinely operational: a privacy center receives requests, identity is verified by email or phone with an MFA short code, and extraction, redaction and delivery run programmatically across connected systems with statuses, reviewers and full execution logs per request. I found no public information on a breach register, a 72-hour clock, or deadline reminders and escalation, so an incident would still live in my inbox. 6 7 9 10
The Lead Auditor
This is the strongest area: a privacy center receives requests, identity is verified by email or phone with an MFA short code, and fulfilment runs end-to-end across connected systems with per-request lifecycle timestamps, execution and audit logs, and a diagnostics export that contains no personal data — an authority audit can walk a single request from intake to completion. We found no public information on deadline tracking with escalation, a breach register, or the 72-hour notification workflow. 6 7 9 10
The IT Integrator
Rights handling is genuinely operational: a privacy center takes requests in, identity is verified by email or phone with an MFA short code, and fulfillment runs programmatically across connected systems including redaction determinations, with request statuses, execution logs and a shareable diagnostics export containing no PII. I found no public information on a breach register or 72-hour notification workflows, and no evidence of deadline escalation, which caps this below the top levels. 6 7 10
The Skeptic
Request handling is documented end to end: a privacy centre for intake, automated identity verification with MFA short codes, execution across connected systems with statuses, audit logs and per-request diagnostics. The one-month and 45-day deadlines appear as legal guide content rather than documented deadline tracking in the product, and we found no public information on breach or incident handling. 3 6 7 10
Privacy regime coverage
Show reasoningHide reasoning
How this is scored
Which privacy regimes the product operationalises — DSGVO/GDPR, BDSG, TTDSG/ePrivacy, Swiss nDSG, UK GDPR, EU AI Act privacy duties — and whether one record maps across them or each regime is a fresh island.
0 — No privacy regime built in; a generic task or document tool.
3 — GDPR implemented with its registers, templates and checklists.
5 — GDPR plus the national law of its market (BDSG, nDSG or UK GDPR) named and supported with their own templates or requirements.
8 — Several regimes on one record with requirements mapped across them, newer duties (AI Act, ePrivacy/TTDSG) covered as maintained content, and updates published when a regime changes.
10 — Regime coverage as a living product: many privacy regimes and per-country variants on one data basis, and a documented update cadence when the law moves.
The External DPO
GDPR, CCPA and Virginia's VCDPA are all operationalised on one orchestration layer that routes each request by jurisdiction — genuinely one record serving several regimes rather than separate islands. But I found no public information on national variants such as BDSG, nDSG or UK GDPR, no named EU AI Act duties despite the AI governance claims, and no published update cadence when a law moves. 5 6 7 9
The In-House Counsel
GDPR, CCPA and Virginia's VCDPA are each supported with dedicated guides and assessment content, and the orchestration layer is documented as fulfilling requests across different jurisdictions on one data basis. What decides it: I found no public information on BDSG, the Swiss nDSG, UK GDPR, ePrivacy/TTDSG or the EU AI Act as maintained product content, and no published update cadence when a regime changes — for a company operating in the DACH region, that gap matters. 5 6 7 8 9
The Drafted Generalist
GDPR comes with step-by-step guides from data map to portability to data protection assessments, and CCPA and Virginia law each have their own documentation pages; the orchestration layer is described as spanning jurisdictions and data categories. I found no public information on EU AI Act or ePrivacy duties, German or Swiss national law, or an update cadence when a law changes. 5 6 8 9
The Lead Auditor
GDPR, CCPA and the Virginia law are each operationalised with their own requirements — GDPR guides from data mapping to portability, CCPA deadlines, Virginia data protection assessments — and the orchestration layer is described as fulfilling requests differently across jurisdictions, data categories and system types. We found no public information on national variants such as BDSG, nDSG or UK GDPR, on ePrivacy duties, or on a published update cadence when a regime changes. 5 6 7 8 9
The IT Integrator
GDPR is served by a full guide set running from data mapping through data protection assessments, CCPA and Virginia's VCDPA have their own maintained regulation pages with deadlines and assessment triggers, and the orchestration layer is described as driving fulfillment across jurisdictions from one policy model. I found no public information on BDSG, Swiss nDSG, UK GDPR or AI Act privacy duties. 5 6 7 8 9
The Skeptic
GDPR has its own platform page and step-by-step guides, and CCPA and the Virginia law each have dedicated documentation with their own deadlines and assessment requirements, with the orchestration layer described as spanning jurisdictions on one pipeline. We found no public information on EU AI Act or ePrivacy duties or on a documented update cadence when a law changes. 5 6 7 8 9
Audit readiness & evidence
Show reasoningHide reasoning
How this is scored
Whether the system produces defensible proof: change history, evidence collection, and reports for auditors, authorities and management.
0 — No reports, history or evidence; the product only stores the current state.
3 — PDF or Word reports of the registers, and documents attachable to records.
5 — Versioned records or a change history, report generators for the core registers (RoPA, DPIA, TOMs), and evidence attached per processing activity or measure.
8 — A revision-safe change history, audit evidence packs generated on demand, management and data protection officer reports at a click, and read-only auditor access.
10 — Audit readiness as a standing state: documentation status shown continuously per regime and scope, proof packs an auditor accepts as they are, and any record reproducible as it stood on a given date.
The External DPO
Per-request evidence is real: CSV exports with reviewer and timestamps, and a diagnostics snapshot bundling lifecycle timestamps, execution and audit logs with no personal data in it — safe to attach to a client file. Beyond the DPIA PDF, though, I found no public information on versioned records or a change history, read-only auditor access, or management reports, so proof packs still need manual assembly. 10 11
The In-House Counsel
There is contemporaneous, defensible proof for the request pipeline: CSV export of all privacy requests with reviewer and approval timestamps, and a per-request diagnostics snapshot bundling lifecycle timestamps, execution logs and audit logs, plus assessment PDFs formatted for regulators. I found no public information on revision-safe change history for the registers, read-only auditor access, or management reporting — evidence of individual requests is not yet a standing audit state. 4 5 10 11
The Drafted Generalist
Assessment answers export as a formatted PDF intended for supervisory authorities, and every privacy request can produce a diagnostics export with lifecycle timestamps, execution and audit logs and no personal data — safe to hand to an auditor. I found no public information on change history for the records themselves, management reports, or read-only auditor access. 10 11
The Lead Auditor
Assessments export as a clean PDF aimed at supervisory authorities, and every privacy request carries a full trail — statuses, lifecycle timestamps, execution logs, approval and completion audit entries, plus a shareable diagnostics snapshot — which is genuine evidence generation. We found no public information on revision-safe change history, evidence packs across the register set, or read-only auditor access, and no way to reproduce a record as it stood on a given date. 10 11 5
The IT Integrator
Assessment answers export as a regulator-readable PDF, and every privacy request carries lifecycle timestamps, execution and audit logs retrievable through the API, a diagnostics snapshot and a CSV export. I found no public information on versioned records, revision-safe history, read-only auditor access, or a continuously shown documentation status per scope. 10 11
The Skeptic
Assessments export as a clean question-and-answer PDF aimed at supervisory authorities, and each privacy request can produce a diagnostics snapshot with lifecycle timestamps, execution logs and audit logs, uploaded to the customer's own storage with a pre-signed URL and explicitly no personal data in it. We found no public information on versioned records, a change history, management reports or read-only auditor access. 10 11
Integrations & automation
Show reasoningHide reasoning
How this is scored
Whether the platform feeds from the real IT estate — directory import, ticketing, SSO, API — and automates the recurring privacy work instead of re-typing it.
0 — No import, export or integration; data is typed in and printed out.
3 — CSV or Excel import and export, and reminders for recurring reviews.
5 — Single sign-on, a documented API or a few named connectors (directory, ticketing), and recurring tasks with reminders and assignment.
8 — A documented REST API for the core objects, a named connector set (directory, ticketing, HR or asset sources), webhooks, SSO with SCIM provisioning, workflow automation with delegation and escalation, and AI assistance with human review.
10 — The platform behaves like infrastructure: API coverage of the whole data model, events or webhooks for every object, two-way sync with the estate, and recurring work (reviews, attestations, evidence collection) automated and documented.
The External DPO
This is where the platform earns its keep across mandates: a documented REST API for privacy requests, connectors to ten named databases plus SaaS tools like HubSpot and Google Analytics, and identity-provider monitors for Okta and Microsoft Entra ID that discover applications and create systems with privacy declarations. The LLM classifier suggests vendor and data uses while a human approves — automation I can trust; I found no public information on webhooks or single sign-on with SCIM provisioning. 10 12 13
The In-House Counsel
The estate is genuinely connected: ten named databases including Snowflake, BigQuery and PostgreSQL, SaaS connectors such as Hubspot, identity-provider monitors for Okta and Microsoft Entra ID feeding discovered applications into an approval queue, and a documented REST API with scopes for privacy requests. I found no public information on webhooks, single sign-on with SCIM provisioning, or workflow escalation, which is what would move this from a strong connector set to infrastructure. 3 6 10 12 13
The Drafted Generalist
Ten named databases from PostgreSQL to Snowflake, SaaS connectors like HubSpot and Google Analytics, and monitors for Okta and Microsoft Entra ID that surface new applications for approval into the inventory, with a documented API for privacy request reporting. An LLM classifier suggests vendor and data uses while a human approves or ignores — the kind of assistance I can trust. I found no public information on single sign-on, automated user provisioning or webhooks. 10 12 13
The Lead Auditor
A documented REST API covers the core privacy request objects, integrations span ten named databases plus SaaS applications such as Hubspot and Google Analytics with UI-based connection testing, and identity provider monitors to Okta and Microsoft Entra ID discover registered applications automatically, with an LLM classifier whose suggestions are approved by a human in the Action Center. We found no public information on single sign-on with SCIM provisioning, webhooks, or HR and ticketing connectors. 10 12 13 6
The IT Integrator
This is the part I care about and it is real: identity provider monitors continuously discover app registrations from Microsoft Entra ID and Okta into an approval workflow that creates systems with privacy declarations, ten named databases plus SaaS connectors execute the requests against the estate, and a documented REST API with scopes covers the privacy-request objects. It stops short of the higher level where the pages are silent — I found no public information on single sign-on, SCIM provisioning, webhooks or a ticketing connector. 10 12 13
The Skeptic
The connector catalogue is concrete and checkable: ten named databases including PostgreSQL, BigQuery and Snowflake, named SaaS connectors, and Okta and Microsoft Entra ID monitors that feed discovered applications into a human approval workflow, backed by a documented REST API with access scopes for privacy requests. The AI assistance has real substance behind it — an LLM classifier suggesting vendor and data uses that a person approves — though we found no public information on single sign-on, SCIM provisioning or webhooks. 10 12 13
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where the compliance record of the whole company actually lives and under whose law: contracting entity and parent company, hosting location, subprocessors (hosting, AI features, email, support tooling), DPA. A platform that maps your processing is itself your most concentrated processing. Independently sourced by the sovereignty pipeline; describe what is proven, and treat what is not stated as unknown rather than non-EU.
0 — Proven non-EU end to end: non-EU entity and non-EU hosting with no EU option, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist; hosting location and subprocessors are not stated, or EU hosting is offered only on request or on top tiers.
5 — EU hosting stated as the default, a data processing agreement and a subprocessor list published; a parent company or a subprocessor may sit outside the EU.
8 — EU entity, EU hosting in named data centres, a subprocessor list with no non-EU processor touching customer content, and the DPA and TOMs published.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors, an on-premises or sovereign-cloud option, and the whole chain documented publicly.
The External DPO
The hosted solutions store customer personal information on servers on the east coast of the United States, with the European Commission's Standard Contractual Clauses named as the transfer mechanism; the open-source, self-hosted deployment on the customer's own infrastructure is the only EU-resident path the pages show. I found no public information on the contracting entity's jurisdiction, a data processing agreement, or a subprocessor list — for client mandates that is a diligence stop sign. 2 3
The In-House Counsel
The privacy policy states that personal information from the Data Privacy Solutions is stored on a server on the east coast of the United States, with the European Commission's Standard Contractual Clauses named as the transfer mechanism — the platform that would map our processing concentrates it in a third country. The one jurisdictional control in evidence is self-hosting the open-source Fides on our own infrastructure; the contracting entity's jurisdiction, the subprocessor list and a customer data processing agreement are unknown on the captured pages. 2 3
The Drafted Generalist
The vendor's own privacy policy states that Data Privacy Solutions data is stored on their server on the east coast of the United States, with Standard Contractual Clauses named as the transfer mechanism; the open-source Fides can instead run self-hosted on our own infrastructure. The captured pages leave the contracting entity's jurisdiction, the data processing agreement and any subprocessor list unstated. 2 3
The Lead Auditor
The privacy policy states that personal information collected for the Data Privacy Solutions and the newsletter is stored on servers on the east coast of the United States, with the European Commission's Standard Contractual Clauses as the transfer mechanism; the open-source Fides tooling can instead run on the customer's own infrastructure. The contracting entity's jurisdiction, the data processing agreement and the subprocessor list are not stated on the captured pages, so the chain a buyer would map is itself undocumented. 2 3
The IT Integrator
The hosted Data Privacy Solutions store personal information on a server on the east coast of the United States, with the European Commission's Standard Contractual Clauses as the published transfer mechanism, and the open-source Fides tooling can instead run on your own infrastructure. Contracting entity, data processing agreement and subprocessor chain are not stated on the captured pages, so the picture is US-hosted with a self-hosted escape hatch rather than a European chain. 2 3
The Skeptic
The vendor's own privacy policy states that personal information from the Data Privacy Solutions is stored on a server on the east coast of the United States, with the European Commission's Standard Contractual Clauses named as the transfer mechanism, and the open-source Fides can run self-hosted on the customer's infrastructure. We found no public information on the contracting entity's jurisdiction, an EU hosting option for the hosted platform, a data processing agreement or a subprocessor list. 2 3
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real invoice — per module, per entity, per year, with consulting unbundled — from public pages alone. Unpublished pricing is the B2B norm in this market, so this criterion describes rather than condemns; the benches weight it accordingly.
0 — No public prices at all; every configuration is a sales conversation.
3 — A public "from" price or one priced edition; the other editions, modules or entity counts are not public.
5 — Public prices per edition or tier with the billing period (monthly or annual) stated and the main inclusions listed.
8 — Every edition and module priced publicly with entity/user boundaries and setup fees stated, software separated from consulting, and VAT treatment given; only genuine corporate-group contracts are custom.
10 — Complete price computability: modules, scale steps, service packages and renewal rules public, so the invoice for a 100-employee company and a 10-client consultancy is a two-minute exercise.
The External DPO
The only public price point is the open-source tool under an Apache 2.0 licence — free, though the repository was archived and made read-only in August 2026 — and I found no public prices for the commercial platform, its modules or edition boundaries. Quoting a client engagement from public pages alone is not possible. 3
The In-House Counsel not rated — no public information
We found no public information on pricing: the homepage, the platform pages and the documentation captured here show no edition, module, per-user or per-year figure. On this evidence every configuration is a sales conversation. 1 4 8
The Drafted Generalist
The only public cost information I found is the open-source Fides tool under the Apache-2.0 license; the captured platform pages show no prices, editions, modules or billing terms for the hosted product, so the real invoice is a sales conversation. 1 3 4
The Lead Auditor not rated — no public information
We found no public information on pricing: no editions, prices, billing periods or setup fees appear on the vendor homepage, the privacy policy, or the open-source repository pages we captured, and the Apache-2.0 licence on the open-source tooling says nothing about the hosted platform's invoice. Reported for the reader's benefit; unevidenced criteria do not count toward the verdict. 1 2 3
The IT Integrator
The captured pages give no prices for the commercial platform — no editions, modules, billing periods or terms, so a real invoice is not computable from public material. The only public price signal is the Apache-2.0 licence under which the Fides tooling can be self-hosted at no software cost. 3
European sovereignty — proven facts
1 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Outside the EU ⚠ unverified | 0/4 pts | 2 Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Ethyca
Is Ethyca European?
Not determined: the vendor’s pages as captured do not say where Ethyca is based.
Where does Ethyca store data?
Ethyca stores customer data outside the EU by default, per the vendor’s page captured 3 Nov 2026.
Does Ethyca have a free plan?
Not stated on the vendor’s pages as of 3 Nov 2026.
What are the best alternatives to Ethyca?
As of 4 Nov 2026, the panel rates preeco | datenschutz (4/5), Dastra (3.5/5) and caralegal (3.5/5) highest among the other 43 Data Protection products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is preeco | datenschutz (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Ethyca alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 3 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Open source, Hosting options. Not confirmed on the vendor’s own pages as captured.
- Weak sourcing — Hosting location. This statement covers Ethyca's hosted Data Privacy Solutions, while the self-hosted Fides option runs on the customer's own infrastructure, so actual residency depends on the deployment chosen.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 51 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 8 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (13)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page ethyca.com Checked 3 Nov 2026 Details →
- 2 Privacy policy — found from the homepage www.ethyca.com Checked 3 Nov 2026 Details →
- 3 Code repository (open-source licence) — found from the homepage github.com Checked 3 Nov 2026 Details →
- 4 Records & DPIA depth — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →
- 5 Records & DPIA depth — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →
- 6 Data subject rights & incidents — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →
- 7 Data subject rights & incidents — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →
- 8 Privacy regime coverage — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →
- 9 Privacy regime coverage — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →
- 10 Audit readiness & evidence — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →
- 11 Audit readiness & evidence — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →
- 12 Integrations & automation — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →
- 13 Integrations & automation — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →