heyData

The Drafted Generalist

The GDPR pages show a structured Art. 30 RoPA with templates and export, a guided DSFA that derives measures directly, TOM documentation with gap visibility, and Art. 28 AVV/vendor management with status, deadlines and a 4,000+ vendor database — that's genuinely more than shallow checklists. But nothing evidences legal bases linked in the record, reusable group templates or authority-accepted outputs, so it stops short of the connected data model an 8 would require. 1 3 4

Report an error

The Drafted Generalist

Breach handling is described reasonably well — structured documentation, the 72-hour Meldefrist kept in view, workflows, reminders and prepared notification steps — which sits at the anchor-5 level on its own. But data subject request handling appears nowhere in the evidence: no intake channel, no Art. 12 clock, no identity checks, no deletion workflow, and half the operational DSMS missing is half a pass. 3

Report an error

The Drafted Generalist

GDSR/DSGVO, UK GDPR, Swiss revDSG and an EU AI Act module cover the regimes an 80-person firm would realistically face, with ISO 27001 and NIS2 beyond privacy. What's absent is any evidence that one processing record maps across regimes or that the content is maintained as the law moves — so content packs of varying depth, not a living regime product. 1 4

Report an error

The Drafted Generalist

There is an explicit promise that evidence, risk reports, policies and ISMS documentation get assembled into a 'prüffähiges Paket', plus centrally documented training certificates and an exportable RoPA. But that sentence reads like the expert services team assembling files for me, and the evidence shows no revision-safe change history, no auditor access roles and no answer to 'show me the state on date X' — assembling an audit file would still be a project. 3 4

Report an error

The Drafted Generalist

Integrations with Microsoft 365, Jira and Slack get one marketing line, and training assignment with reminders is automated — that's the extent of it. No documented API, no directory import, no SSO/SCIM, no webhooks anywhere in the evidence, so the platform can't feed from my real IT estate and I'd be re-typing it. 3 4

Report an error

The Drafted Generalist

The entity is a confirmed Berlin GmbH with a commercial register entry, hosting is claimed 'in Germany' with an ISO 27001-certified hoster, and a customer DPA is referenced — that clears the anchor-5 bar. But the data centers aren't named, the platform's own subprocessor chain isn't published, and the privacy policy shows a marketing stack firmly in US jurisdictional reach (Webflow, Google LLC, AWS CloudFront, Taboola, Reddit) while the product page claims 'kein Zugriff durch Nicht-EU-Behörden' — those two facts don't sit together. 3 5 6

Report an error

The Drafted Generalist

There's a 'PROFESSIONAL ab 99 €/Monat*' whose asterisk footnote never appears on the page, a final price 'nach Unternehmensgröße', and an explicit 'Du erhältst ein Angebot' custom-quote model — with the Art. 37 DSB appointment and annual DSFA bundled into the plan, my real invoice is incomputable from public pages. Freemium and the -10% annual discount are the only hard numbers I could find. 2 3 6

Report an error