# Ethyca — Data Protection

Ethyca by Ethyca Inc. holds a panel rating of 2.5/5 from 6 AI judges (category median 2.5/5), as of 2026-11-04. Provenance: provenance unknown; sovereignty: 1 of 6 dimensions proven.

- Vendor: Ethyca Inc. (https://ethyca.com)
- Category: [Data Protection](https://whats-best.ai/software/data-protection.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/data-protection/ethyca
- Alternatives: https://whats-best.ai/software/data-protection/ethyca/alternatives ([markdown](https://whats-best.ai/software/data-protection/ethyca/alternatives.md))
- Data as of: 2026-11-04 · evaluated 2026-11-04 · oldest source captured 2026-11-03

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Ethyca Inc.
- Headquarters: Not stated on the vendor’s pages as of 3 Nov 2026
- Data hosting: Outside the EU by default [S2]
- Free plan: Not stated on the vendor’s pages as of 3 Nov 2026

## The panel's verdict

Ethyca's strongest areas are rights and incidents and integrations and automation, both clustering at 6-7: a privacy center verifies requesters by email or phone with an MFA short code, and fulfilment runs programmatically across connected databases and SaaS applications. Sovereignty is weakest at 2-3: the privacy policy states that Data Privacy Solutions data is stored on a server on the east coast of the United States with Standard Contractual Clauses as the transfer mechanism, and we found no public information on the contracting entity's jurisdiction, a data processing agreement, a subprocessor list or an EU hosting option. The self-hosted alternative, open-source Fides under the Apache-2.0 licence on your own infrastructure, carries a caveat: the repository was archived on Aug 28, 2026 and is now read-only. Privacy management and audit readiness sit at 4-6, framework coverage at 5-6, with no public information found on processor and DPA records, technical and organisational measures tied to processing activities, breach registers or 72-hour clocks, or regimes such as BDSG, the nDSG or UK GDPR. Judges' scores cluster tightly; pricing is a sales conversation.

**Speaks for it:**
- Data subject requests are handled end to end, from privacy center intake with MFA short-code identity verification to programmatic execution with per-request execution and audit logs.
- Integrations span ten named databases from PostgreSQL to Snowflake plus SaaS connectors such as HubSpot and Google Analytics, with a documented REST API.
- Okta and Microsoft Entra ID monitors surface discovered applications for approval into a system inventory with one privacy declaration per data use.
- Assessment answers export as a PDF suitable for submitting a DPIA to a supervisory authority, and per-request diagnostics exports contain no personal data.
- The open-source Fides tooling under the Apache-2.0 licence can run self-hosted on the customer's own infrastructure.

**Held against it:**
- The privacy policy states that personal information from the Data Privacy Solutions is stored on a server on the east coast of the United States, with Standard Contractual Clauses as the transfer mechanism.
- The captured pages leave the contracting entity's jurisdiction, the data processing agreement and any subprocessor list unstated.
- We found no public information on processor and DPA records or on technical and organisational measures assigned to processing activities.
- We found no public information on a breach register or a 72-hour notification workflow.
- The open-source repository was archived by the owner on Aug 28, 2026 and is now read-only.

**Best for:**
- You need to run GDPR, CCPA and Virginia (VCDPA) data subject requests programmatically across many connected systems, with per-request audit trails.
- Your team wants a system inventory built from live identity-provider data, approving discovered applications into records with privacy declarations.
- You are prepared to self-host the open-source Fides tooling on your own infrastructure under the Apache-2.0 licence.
- You need regulator-facing documentation — DPIA-style assessment PDFs and per-request diagnostics snapshots containing no personal data.

**Avoid if:**
- You require EU-resident hosting for the hosted platform — the privacy policy states storage on a server on the east coast of the United States with Standard Contractual Clauses as the transfer mechanism.
- Your compliance scope includes national regimes such as BDSG, the Swiss nDSG or UK GDPR — the documented regulation pages cover GDPR, CCPA and Virginia's VCDPA.
- Your records of processing must capture processors with their data processing agreements and technical and organisational measures — the documented record here is a system inventory with one privacy declaration per data use.
- Your priority is breach and incident management — the documented strength is the rights request pipeline, and we found no public information on a breach register or a 72-hour notification workflow.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v3). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The External DPO | The In-House Counsel | The Drafted Generalist | The Lead Auditor | The IT Integrator | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Records & DPIA depth | 2/5 | 2/5 | 3/5 | 2/5 | 2/5 | 2/5 |
| Data subject rights & incidents | 3.5/5 | 3/5 | 3.5/5 | 3.5/5 | 3/5 | 3/5 |
| Privacy regime coverage | 3/5 | 2.5/5 | 3/5 | 3/5 | 2.5/5 | 2.5/5 |
| Audit readiness & evidence | 2.5/5 | 2.5/5 | 3/5 | 2/5 | 2/5 | 2/5 |
| Integrations & automation | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 | 3.5/5 |
| European sovereignty | 1/5 | 1/5 | 1/5 | 1/5 | 1.5/5 | 1/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **2.5/5** | **2.5/5** | **3/5** | **2.5/5** | **2.5/5** | **2/5** |

### The judges

- **The External DPO** (v2.0): Carries thirty client mandates and bills by the hour they save. Optimizes for multi-client capability, reusable templates, a RoPA that drives the rest, and client-ready reports. Rejects single-tenant tools that treat the consultancy as thirty separate customers.
- **The In-House Counsel** (v2.0): Answers personally when the authority writes. Optimizes for defensibility: request clocks that never slip, a breach workflow that produces the Art. 33 notification, regime coverage that matches where the company actually operates. Rejects tools whose legal content nobody maintains.
- **The Drafted Generalist** (v2.1): Office manager at an 80-employee firm who got compliance added to her job title, not her calendar. Optimizes for guided workflows in plain language and software that knows the law so she does not have to. Rejects consultant-shaped platforms that assume a compliance department.
- **The Lead Auditor** (v2.0): Audits management systems for a living and has seen every folder of screenshots. Optimizes for revision-safe history, evidence packs on demand, and a defensible answer to "show me the state on date X". Rejects systems where the audit trail is assembled the week before the audit.
- **The IT Integrator** (v2.0): Has to feed the compliance platform from the estate that already exists: Entra ID, Jira, the CMDB. Optimizes for directory import, a real API, webhooks and SSO — compliance data that stays current because it syncs, not because someone retypes it. Rejects data islands with a CSV drawbridge.
- **The Skeptic** (v2.1): Hunts certification logos that link nowhere, "AI-powered" features with no substance behind them, consulting bundled as software, legal-update promises with no named lawyer, and customer counts that disagree between pages. Exists to keep the rest of the bench honest.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: 1 of 6 dimensions proven.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Outside the EU | 0/4 | [S2] |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Consent tool: yes [S8]
- International transfers: EU Standard Contractual Clauses (SCCs) [S2]
- Repository archived: yes · 2026-08-28 [S3]
- Vcdpa ag DPA request: Virginia Attorney General may request a company submit a DPA to determine compliance [S5]
- Vcdpa no standard form: No single standard form exists for VCDPA risk evaluations [S5]

**Data**
- Collected identity verification: unique identifier (email, phone, device ID, possibly government-issued ID) for identity verification [S2]
- Cookie data use: site analytics · Ethyca advertising [S2]
- Retention cookies: 24 · yes [S2]
- Retention solutions: duration of customer's subscription unless law requires longer [S2]

**Hosting**
- Newsletter region: east coast of the United States [S2]
- Solutions region: east coast of the United States [S2]

**Integrations**
- Credentials required: Each vendor requires unique connection credentials [S12]
- Custom integration: yes · yes [S12]
- Databases supported: Amazon DynamoDB · Amazon Redshift · Google BigQuery · MariaDB · MongoDB · Microsoft SQL Server · MySQL · PostgreSQL · Redshift · Snowflake [S12]
- Dataset linking required for databases: yes [S12]
- Definition: Integrations connect Astralis to databases and third-party SaaS applications to execute privacy requests [S12]
- New integrations added: yes [S12]
- Open source: https://github.com/ethyca/fideslog [S2]
- Specific named examples: Hubspot · Google Analytics · PostgreSQL · BigQuery · Snowflake [S12]
- UI configuration: yes [S12]

**Legal**
- CCPA deadline: CCPA: acknowledge within 10 business days, substantive response within 45 calendar days, 45-day extension available. [S6]
- CCPA decline: CCPA allows declining unverified requests and requests made more than twice in twelve months. [S6]
- Children: 13 [S2]
- Data sale: no · no [S2]
- GDPR deadline: GDPR DSAR deadline: one calendar month, extendable by two additional months for complex/numerous requests. [S6]
- GDPR decline: GDPR Article 12(5): DSAR may be declined only when manifestly unfounded or excessive, controller bears burden of proof. [S6]
- Newsletter sharing: no [S2]
- Sponsor: Ethyca [S3]

**Pricing**
- License: Apache-2.0 · CC BY 4 [S3]

**Product**
- Action center triage statuses: New · Known systems · Unknown systems · Ignored [S13]
- AI governance: Enforces usage limits, retention rules, and audit trails for data entering AI pipelines [S4]
- Approve creates system: Approving adds application to system inventory with one privacy declaration per data use [S13]
- Astralis access automation: Astralis automates access requests end-to-end: privacy center for receiving requests, automated identity verification, programmatic secure data extraction across business systems [S7]
- Astralis AI enforcement: Astralis applies AI-powered policy enforcement directly to AI systems in real time, including DSAR disclosure/redaction determinations. [S6]
- Audit trail recommendation: Regularly answering the assessment questions and recording the evaluation as part of an audit trail is recommended for VCDPA compliance [S5]
- Automated classification: Offers automated classification, real-time observability, and integrated policy enforcement [S4]
- Automated governance: Automates consent, requests, and policy enforcement [S4]
- Bulk actions: Bulk approve, ignore, or restore applications [S13]
- CCPA access deadline: 45 · 45 [S7]
- CCPA access methods: form or privacy center · email address or customer support system · 2 [S7]
- Components: Admin UI, Privacy Center, sample eCommerce site, DSR Directory (./fides_uploads) [S3]
- Consent banner: Ethyca powers its own site consent management ("Consent powered by Ethyca") [S4]
- Consent platform claim: Consent tooling on the page is powered by Ethyca [S1]
- Demo project: Sample 'Cookie House' e-commerce project via fides deploy up; includes Admin UI, Privacy Center, sample app, DSR Directory [S3]
- Description: Open-source privacy engineering platform for fulfilling data privacy requests and enforcing privacy regulations in code [S3]
- Duplicate name linking: Duplicate-named systems are linked instead of created [S13]
- Fides analytics disable: analytics_opt_out [S2]
- Fides opt out: press 'n' during setup to opt out [S2]
- Fides orchestration: Fides is Ethyca's open-source privacy engineering framework providing the policy-driven orchestration layer for DSAR fulfillment across jurisdictions, data categories and system types. [S6]
- Filter by data use: Results can be filtered by data use [S13]
- GDPR automation: Ethyca automates GDPR obligations including data rights, RoPA and consent [S8]
- GDPR capabilities: data mapping · access requests · correction requests · erasure requests · portability requests · data protection assessments [S9]
- GDPR guides: Vendor provides step-by-step GDPR compliance guides [S9]
- Governance enforcement points: Enforces data governance at access, use, and retention [S4]
- Helios discovery: Helios provides continuous automated data discovery and classification across the organization's data systems, detecting new data stores, schema changes and data flows in real time. [S6]
- Identity verification: Identity verification via email or phone number, with MFA short code sent by email or SMS; businesses should not request data they do not already hold [S7]
- Identity verification: Automated identity verification uses a proportionality model based on data sensitivity and request channel. [S6]
- Idp monitors purpose: IDP monitors connect to identity platforms to discover registered applications, which appear in the Action Center for approval into system inventory [S13]
- Ignore restore: Ignored applications can be restored to New before approval [S13]
- Install command: uv pip install ethyca-fides [S3]
- Languages: 0.4 · 0.3 · 57.4 · 41.1 [S3]
- Lethe fulfillment: Lethe automates DSAR fulfillment including data extraction, redaction, and de-identification across connected systems, packaging responses in the regulation-mandated format. [S6]
- Microsoft entra id support: yes [S13]
- Monitor steward inheritance: Monitor's stewards become system data stewards if none set on application [S13]
- Newsletter unsubscribe: yes · yes [S2]
- Okta support: yes [S13]
- Pdf export available: yes [S11]
- Pdf export contents: PDF contains all questions and their current answers, formatted for readability by external parties [S11]
- Pdf export disabled condition: yes [S11]
- Pdf export generation: Generate report button on assessment detail page, enabled only with at least one completed question group [S11]
- Pdf export use cases: submitting a DPIA to a supervisory authority, sharing with a data processor or joint controller, distributing to stakeholders [S11]
- Platform modules: AI Policy Enforcement · Governance taxonomy · Data inventory · Consent orchestration · Automated DSR [S2]
- Platform scale: Ethyca's platform handles DSAR fulfillment at enterprise scale via an automated pipeline: discover, extract, classify, redact, package, deliver. [S6]
- Reporting audit logs: Request approved · Request finished [S10]
- Reporting CSV columns: Time received · Subject identity · Policy key · Request status · Reviewer · Time approved/denied [S10]
- Reporting CSV export: download_csv · yes [S10]
- Reporting diagnostics contents: Privacy request status and lifecycle timestamps · Execution logs, audit logs, and request task statuses · Dataset and storage configuration metadata · Manual task state and submission history · Attachment and comment reference metadata [S10]
- Reporting diagnostics export: /api/v1/privacy-request/{privacy_request_id}/diagnostics · yes [S10]
- Reporting diagnostics no pii: yes [S10]
- Reporting diagnostics scope required: privacy_request:read [S10]
- Reporting diagnostics storage: Report uploaded to configured storage backend (e.g. s3, gcs, local); response includes pre-signed download URL [S10]
- Reporting external id tracking: Privacy requests can be tracked by external_id via query param [S10]
- Reporting filter params: created_lt · created_gt · started_lt · started_gt · completed_lt · completed_gt · errored_lt · errored_gt [S10]
- Reporting identity data ttl: Identity data expires automatically per FIDES__REDIS__DEFAULT_TTL_SECONDS config [S10]
- Reporting include identities: yes [S10]
- Reporting logs endpoint: /api/v1/privacy-request/{privacy_request_id}/logs · 50 [S10]
- Reporting overview: Reporting feature fetches high-level or detailed per-collection status information about privacy requests [S10]
- Reporting paused requests: Requests can pause awaiting manual input or fail on a specific collection; stopped_collection_details and resume_endpoint provided [S10]
- Reporting request statuses: in_processing · pending · paused · complete · error [S10]
- Reporting verbose param: in_processing · retrying · complete · error [S10]
- Requirements: yes · >=20.10.11 · 3.13 [S3]
- Rights: access · deletion · consent_management · withdraw_consent · erase_or_correct · complaint_to_DPA [S2]
- Runtime governance: Runtime governance controlling how models, agents, and systems use enterprise data in real time [S1]
- Scan refresh: Unacted applications leave results once removed from the identity provider [S13]
- Unknown systems llm classifier: For unknown systems, LLM classifier setting suggests vendor, description, and data uses [S13]
- Vcdpa dpia requirement: VCDPA requires businesses to perform data protection assessments (DPAs) evaluating business benefits of processing personal data against risks to users [S5]
- Vcdpa dpia trigger activities: targeted advertising · sale of personal data · profiling · sensitive data processing · processing presenting heightened risk of harm [S5]

**Support**
- Channels: Slack · X · Discussions [S3]
- Docs URL: https://ethyca.com/docs [S3]
- Slack community: Astralis Slack Community for questions [S7]

## Questions

### Is Ethyca European?

Not determined: the vendor’s pages as captured do not say where Ethyca is based.

### Where does Ethyca store data?

Ethyca stores customer data outside the EU by default, per [the vendor’s page captured 3 Nov 2026](https://whats-best.ai/evidence/17075).

### Does Ethyca have a free plan?

Not stated on the vendor’s pages as of 3 Nov 2026.

### What are the best alternatives to Ethyca?

As of 4 Nov 2026, the panel rates [preeco | datenschutz (4/5)](https://whats-best.ai/software/data-protection/preeco), [Dastra (3.5/5)](https://whats-best.ai/software/data-protection/dastra) and [caralegal (3.5/5)](https://whats-best.ai/software/data-protection/caralegal) highest among the other 43 Data Protection products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [preeco | datenschutz](https://whats-best.ai/software/data-protection/preeco) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Ethyca alternatives](https://whats-best.ai/software/data-protection/ethyca/alternatives).

## What this page leaves out

- 51 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 8 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor page: https://ethyca.com (checked 2026-11-03)
- [S2] Privacy policy — found from the homepage: https://www.ethyca.com/privacy-policy (checked 2026-11-03)
- [S3] Code repository (open-source licence) — found from the homepage: https://github.com/ethyca/fides (checked 2026-11-03)
- [S4] Records & DPIA depth — found from sitemap: https://www.ethyca.com/privacy-management (checked 2026-11-03)
- [S5] Records & DPIA depth — found from sitemap: https://www.ethyca.com/docs/regulations/vcdpa/dpa_vcdpa (checked 2026-11-03)
- [S6] Data subject rights & incidents — found from sitemap: https://www.ethyca.com/guides/dsar-automation-architecture-at-scale (checked 2026-11-03)
- [S7] Data subject rights & incidents — found from sitemap: https://www.ethyca.com/docs/regulations/ccpa/dsar_ccpa (checked 2026-11-03)
- [S8] Privacy regime coverage — found from sitemap: https://www.ethyca.com/gdpr-compliance-platform (checked 2026-11-03)
- [S9] Privacy regime coverage — found from sitemap: https://www.ethyca.com/docs/regulations/gdpr (checked 2026-11-03)
- [S10] Audit readiness & evidence — found from sitemap: https://www.ethyca.com/docs/privacy-requests/guides/reporting (checked 2026-11-03)
- [S11] Audit readiness & evidence — found from sitemap: https://www.ethyca.com/docs/privacy-assessments/guides/exporting-pdf (checked 2026-11-03)
- [S12] Integrations & automation — found from sitemap: https://www.ethyca.com/docs/integrations (checked 2026-11-03)
- [S13] Integrations & automation — found from sitemap: https://www.ethyca.com/docs/integrations/identity-providers (checked 2026-11-03)

---

Cite as: whats-best.ai, "Ethyca — Data Protection", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/data-protection/ethyca

Corrections: https://whats-best.ai/correct/1399?target=page