whats-best.ai
Search Sign in

Data Protection

Ethyca

Provenance unknown Report an error

Panel rating · 6 judges · How to read the stars

Category median

Sovereignty: 1 of 6 dimensions proven

0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.

by Ethyca Inc. · ethyca.com

Report an error on this page Is this your product? →

Link to this page

Ethyca: AI-assisted analysis on whats-best.ai Ethyca: AI-assisted analysis on whats-best.ai (dark)

Add ?theme=dark to the image address for dark backgrounds. The badge shows the category and the month of the latest evaluation, and EU-Made where that is the product’s provenance. It never shows a score.

Ethyca at a glance

Vendor
Ethyca Inc.
Headquarters
Not stated on the vendor’s pages as of 3 Nov 2026
Data hosting
Outside the EU by default source, captured 3 Nov 2026
Free plan
Not stated on the vendor’s pages as of 3 Nov 2026
Panel verdict
The AI panel rates Ethyca 2.5/5, the mean of 6 judges. Ethyca's strongest areas are rights and incidents and integrations and automation, both clustering at 6-7: a privacy center verifies requesters by email or phone with an MFA short code, and fulfilment runs programmatically across connected databases and SaaS applications. how scores are made
As of
Vendor pages captured 3 Nov 2026; evaluated by the panel 4 Nov 2026. all sources

Ethyca alternatives, European ones first →

Read this page as one judge. Each weighs the same scores by what they care about.

The In-House Counsel

Weighted verdict

Answers personally when the authority writes. Optimizes for defensibility: request clocks that never slip, a breach workflow that produces the Art. 33 notification, regime coverage that matches where the company actually operates. Rejects tools whose legal content nobody maintains.

Same scores as the panel view — this lens weights them the way this judge cares.

Scored by The In-House Counsel

Panel median The In-House Counsel This judge’s scores over the panel median. Each label opens its reasoning below.
Scores per criterion, in stars out of 5
Criterion Panel median The In-House Counsel
Records & DPIA depth 2 of 5 2 of 5
Data subject rights & incidents 3.5 of 5 3 of 5
Privacy regime coverage 3 of 5 2.5 of 5
Audit readiness & evidence 2.5 of 5 2.5 of 5
Integrations & automation 3.5 of 5 3.5 of 5
European sovereignty 1 of 5 1 of 5

Records & DPIA depth

How this is scored

The DSMS core: records of processing activities (RoPA/VVT, Art. 30 DSGVO), data protection impact assessments (DSFA, Art. 35), processor and DPA management (AVV), and technical and organisational measures (TOMs) — how deeply the legal artefacts are modelled and connected.

0 — Not a privacy management tool; at most a set of document templates with no structured records.

3 — A structured record of processing activities with templates, and a DPIA questionnaire or checklist.

5 — Records of processing and DPIAs as modules with templates, processors and their DPAs recorded, and TOMs documented and assigned to processing activities.

8 — A connected data model — processing activities linked to systems, processors, TOMs and legal bases — with DPIA need derived from the record, reusable templates across companies, and outputs (Art. 30 register, DPIA report) ready for a supervisory authority.

10 — Privacy records as a system of record: the RoPA drives DPIAs, processor management and TOM coverage from one data model, multi-client capability for external data protection officers, and the documentation is audit-ready without manual assembly.

Report an error

The In-House Counsel

The evidence shows a structured record — applications approved into a system inventory with one privacy declaration per data use, built on a data map — and data protection assessments whose answers export as a PDF the vendor describes as suitable for submitting to a supervisory authority. RoPA automation is claimed on the GDPR platform page. What I cannot defend on this evidence: processors with their DPAs and TOMs assigned to processing activities — I found no public information on either. 4 8 9 11 13

Report an error

Data subject rights & incidents

How this is scored

The operational half of the DSMS: handling data subject requests within the Art. 12 deadline, a breach register with the 72-hour notification of Art. 33, and deletion concepts that are carried out.

0 — No handling of data subject requests or data breaches in the product.

3 — A log of data subject requests and a register of data breaches, with templates for the responses.

5 — Request workflows with the one-month Art. 12 deadline tracked and reminders, a breach register with the 72-hour clock and a risk assessment per breach, and deletion periods recorded per processing activity.

8 — An intake form or portal for requests with identity verification, deadline escalation, breach severity assessment producing the authority notification, and deletion rules tied to the RoPA with execution tracked.

10 — Rights and incidents as operations: end-to-end request handling an authority audit can walk through, breach workflows that produce the Art. 33 and Art. 34 notifications, and deletion automation with evidence that the deletion happened.

Report an error

The In-House Counsel

Rights handling is the strong half: a privacy center receives requests, identity is verified by email or phone with an MFA short code, and access, correction, erasure and portability are executed programmatically across connected databases and SaaS applications, each request carrying lifecycle timestamps and audit logs an authority could walk through. The score sits mid-scale because the incident half of my job is dark here: I found no public information on a breach register, a 72-hour clock or a workflow that produces the Article 33 notification, and the deadline rules appear as legal guidance rather than a tracked clock in the product. 3 6 7 9 10 12

Report an error

Privacy regime coverage

How this is scored

Which privacy regimes the product operationalises — DSGVO/GDPR, BDSG, TTDSG/ePrivacy, Swiss nDSG, UK GDPR, EU AI Act privacy duties — and whether one record maps across them or each regime is a fresh island.

0 — No privacy regime built in; a generic task or document tool.

3 — GDPR implemented with its registers, templates and checklists.

5 — GDPR plus the national law of its market (BDSG, nDSG or UK GDPR) named and supported with their own templates or requirements.

8 — Several regimes on one record with requirements mapped across them, newer duties (AI Act, ePrivacy/TTDSG) covered as maintained content, and updates published when a regime changes.

10 — Regime coverage as a living product: many privacy regimes and per-country variants on one data basis, and a documented update cadence when the law moves.

Report an error

The In-House Counsel

GDPR, CCPA and Virginia's VCDPA are each supported with dedicated guides and assessment content, and the orchestration layer is documented as fulfilling requests across different jurisdictions on one data basis. What decides it: I found no public information on BDSG, the Swiss nDSG, UK GDPR, ePrivacy/TTDSG or the EU AI Act as maintained product content, and no published update cadence when a regime changes — for a company operating in the DACH region, that gap matters. 5 6 7 8 9

Report an error

Audit readiness & evidence

How this is scored

Whether the system produces defensible proof: change history, evidence collection, and reports for auditors, authorities and management.

0 — No reports, history or evidence; the product only stores the current state.

3 — PDF or Word reports of the registers, and documents attachable to records.

5 — Versioned records or a change history, report generators for the core registers (RoPA, DPIA, TOMs), and evidence attached per processing activity or measure.

8 — A revision-safe change history, audit evidence packs generated on demand, management and data protection officer reports at a click, and read-only auditor access.

10 — Audit readiness as a standing state: documentation status shown continuously per regime and scope, proof packs an auditor accepts as they are, and any record reproducible as it stood on a given date.

Report an error

The In-House Counsel

There is contemporaneous, defensible proof for the request pipeline: CSV export of all privacy requests with reviewer and approval timestamps, and a per-request diagnostics snapshot bundling lifecycle timestamps, execution logs and audit logs, plus assessment PDFs formatted for regulators. I found no public information on revision-safe change history for the registers, read-only auditor access, or management reporting — evidence of individual requests is not yet a standing audit state. 4 5 10 11

Report an error

Integrations & automation

How this is scored

Whether the platform feeds from the real IT estate — directory import, ticketing, SSO, API — and automates the recurring privacy work instead of re-typing it.

0 — No import, export or integration; data is typed in and printed out.

3 — CSV or Excel import and export, and reminders for recurring reviews.

5 — Single sign-on, a documented API or a few named connectors (directory, ticketing), and recurring tasks with reminders and assignment.

8 — A documented REST API for the core objects, a named connector set (directory, ticketing, HR or asset sources), webhooks, SSO with SCIM provisioning, workflow automation with delegation and escalation, and AI assistance with human review.

10 — The platform behaves like infrastructure: API coverage of the whole data model, events or webhooks for every object, two-way sync with the estate, and recurring work (reviews, attestations, evidence collection) automated and documented.

Report an error

The In-House Counsel

The estate is genuinely connected: ten named databases including Snowflake, BigQuery and PostgreSQL, SaaS connectors such as Hubspot, identity-provider monitors for Okta and Microsoft Entra ID feeding discovered applications into an approval queue, and a documented REST API with scopes for privacy requests. I found no public information on webhooks, single sign-on with SCIM provisioning, or workflow escalation, which is what would move this from a strong connector set to infrastructure. 3 6 10 12 13

Report an error

European sovereignty

How this is scored

Where the compliance record of the whole company actually lives and under whose law: contracting entity and parent company, hosting location, subprocessors (hosting, AI features, email, support tooling), DPA. A platform that maps your processing is itself your most concentrated processing. Independently sourced by the sovereignty pipeline; describe what is proven, and treat what is not stated as unknown rather than non-EU.

0 — Proven non-EU end to end: non-EU entity and non-EU hosting with no EU option, and no data processing agreement offered.

3 — A privacy policy and a data processing agreement exist; hosting location and subprocessors are not stated, or EU hosting is offered only on request or on top tiers.

5 — EU hosting stated as the default, a data processing agreement and a subprocessor list published; a parent company or a subprocessor may sit outside the EU.

8 — EU entity, EU hosting in named data centres, a subprocessor list with no non-EU processor touching customer content, and the DPA and TOMs published.

10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors, an on-premises or sovereign-cloud option, and the whole chain documented publicly.

Report an error

The In-House Counsel

The privacy policy states that personal information from the Data Privacy Solutions is stored on a server on the east coast of the United States, with the European Commission's Standard Contractual Clauses named as the transfer mechanism — the platform that would map our processing concentrates it in a third country. The one jurisdictional control in evidence is self-hosting the open-source Fides on our own infrastructure; the contracting entity's jurisdiction, the subprocessor list and a customer data processing agreement are unknown on the captured pages. 2 3

Report an error

Pricing transparency not rated — the vendor publishes no price

How this is scored

Whether a buyer can compute the real invoice — per module, per entity, per year, with consulting unbundled — from public pages alone. Unpublished pricing is the B2B norm in this market, so this criterion describes rather than condemns; the benches weight it accordingly.

0 — No public prices at all; every configuration is a sales conversation.

3 — A public "from" price or one priced edition; the other editions, modules or entity counts are not public.

5 — Public prices per edition or tier with the billing period (monthly or annual) stated and the main inclusions listed.

8 — Every edition and module priced publicly with entity/user boundaries and setup fees stated, software separated from consulting, and VAT treatment given; only genuine corporate-group contracts are custom.

10 — Complete price computability: modules, scale steps, service packages and renewal rules public, so the invoice for a 100-employee company and a 10-client consultancy is a two-minute exercise.

Report an error

The In-House Counsel not rated — no public information

We found no public information on pricing: the homepage, the platform pages and the documentation captured here show no edition, module, per-user or per-year figure. On this evidence every configuration is a sales conversation. 1 4 8

Report an error

European sovereignty — proven facts

1 of 6 dimensions proven

Built only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.

Hosting location Outside the EU ⚠ unverified 0/4 pts 2 Report an error
Hosting options Not determined ⚠ unverified — uncited Report an error
Open source Not determined ⚠ unverified — uncited Report an error
Data processing agreement Not determined — uncited Report an error
Transfer impact assessment Not determined — uncited Report an error

Questions about Ethyca

Is Ethyca European?

Not determined: the vendor’s pages as captured do not say where Ethyca is based.

Where does Ethyca store data?

Ethyca stores customer data outside the EU by default, per the vendor’s page captured 3 Nov 2026.

Does Ethyca have a free plan?

Not stated on the vendor’s pages as of 3 Nov 2026.

What are the best alternatives to Ethyca?

As of 4 Nov 2026, the panel rates preeco | datenschutz (4/5), Dastra (3.5/5) and caralegal (3.5/5) highest among the other 43 Data Protection products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is preeco | datenschutz (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Ethyca alternatives.

Where this could be wrong

What we left out

A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.

Do you know more about Ethyca? Tell us Report an error on this page

Sources (13)

The pages every claim on this page was read from — each one checked, dated, and kept verifiable.

  1. 1 Vendor page ethyca.com Checked 3 Nov 2026 Details →
  2. 2 Privacy policy — found from the homepage www.ethyca.com Checked 3 Nov 2026 Details →
  3. 3 Code repository (open-source licence) — found from the homepage github.com Checked 3 Nov 2026 Details →
  4. 4 Records & DPIA depth — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →
  5. 5 Records & DPIA depth — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →
  6. 6 Data subject rights & incidents — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →
  7. 7 Data subject rights & incidents — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →
  8. 8 Privacy regime coverage — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →
  9. 9 Privacy regime coverage — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →
  10. 10 Audit readiness & evidence — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →
  11. 11 Audit readiness & evidence — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →
  12. 12 Integrations & automation — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →
  13. 13 Integrations & automation — found from sitemap www.ethyca.com Checked 3 Nov 2026 Details →