Information Security
Akitra
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Akitra, Inc. · www.akitra.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Akitra at a glance
- Vendor
- Akitra, Inc.
- Headquarters
- Not stated on the vendor’s pages as of 3 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 3 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 3 Nov 2026
- Panel verdict
- The AI panel rates Akitra 2.5/5, the mean of 6 judges. Akitra's Andromeda platform automates compliance and risk work. how scores are made
- As of
- Vendor pages captured 3 Nov 2026; evaluated by the panel 3 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Akitra's Andromeda platform automates compliance and risk work. Framework coverage is its strongest at 7 to 8: forty-plus regimes from SOC 2, ISO 27001 and NIS 2.0 through C5, CMMC and FedRAMP run simultaneously on one control basis, and a published crosswalk maps SOC 2 controls into ISO 27001:2022, HIPAA, GDPR, ISO 42001:2023 and PCI DSS v4.0 at stated overlap percentages. Sovereignty is the verdict's low point, at 2 to 3: the data processing addendum states hosting in AWS facilities in the USA and permits processing in the United States and 'anywhere else in the world' where Akitra, its affiliates or sub-processors operate, and judges found no public information on an EU hosting option. Scores spread across controls and audit readiness, at 4 to 6 each, and integrations at 5 to 7 — higher marks credit continuous control monitoring and automated evidence collection; lower ones note no public information on a generated statement of applicability, internal audit workflows, revision-safe change history or read-only auditor access. Information security management runs 4 to 5. No public prices appear; buying runs through demo requests.
Speaks for it
- Framework coverage scored 7 to 8, spanning forty-plus regimes from SOC 2 and ISO 27001 to NIS 2.0, C5, CMMC and FedRAMP on one simultaneous control basis.
- A published crosswalk maps SOC 2 controls into ISO 27001:2022, HIPAA, GDPR, ISO 42001:2023 and PCI DSS v4.0 at stated overlap percentages.
- The risk module documents registers built from standards templates, inherent and residual heat maps with trends, and treatment plans with named owners who receive notifications.
- Incident handling includes customizable approval workflows, per-incident reports with timelines, people and actions, and CAPA creation.
- The published data processing addendum includes Standard Contractual Clauses under the exporter's EU member-state law with Irish fallback, a UK Addendum, Swiss transfer provisions, a public sub-processor list and a five-day written objection right.
Held against it
- Sovereignty scored 2 to 3 — the addendum states hosting in AWS facilities in the USA and processing in the United States and 'anywhere else in the world' where Akitra, its affiliates or sub-processors operate.
- We found no public information on an EU hosting option, an EU contracting entity or an on-premises choice.
- We found no public information on a generated statement of applicability, internal audit workflows with findings and corrective actions, or measure tracking with delegation and escalation.
- We found no public information on revision-safe change history, on-demand evidence packs or read-only auditor access, while the '100% Audit-Ready Reports' figure appears as a marketing metric with no report artefact shown.
- The captured pages give different figures for the integration count, '270+' against '325+', and we found no public information on a documented API, webhooks, SCIM provisioning or named ticketing and CMDB connectors.
Best for
- You run several frameworks at once — SOC 2 alongside ISO 27001, PCI DSS and GDPR, say — and want one control basis with a published crosswalk.
- Your team wants agents collecting evidence and monitoring controls continuously instead of manual exports.
- You handle incidents and CAPAs in-house and need approval routing, owner notifications and per-incident reports in one platform.
- You are comfortable with US-based hosting and value a published DPA with SCCs, a UK Addendum and Swiss provisions.
Avoid if
- You need EU-resident hosting for your risk and compliance data — the published addendum states hosting in AWS facilities in the USA.
- Your certification cycle needs a generated statement of applicability and documented internal audit workflows — the controls criterion scored 4 to 6.
- You must reproduce records as they stood on a given date or give auditors read-only access — audit readiness scored 4 to 6.
- You must meet NIS2 24/72-hour authority-reporting deadlines — the documented incident workflows route approvals and CAPAs.
The scores
| Criterion | Panel median |
|---|---|
| Asset & risk management depth | 2 of 5 |
| Controls, SoA & measures | 2 of 5 |
| Framework & standard coverage | 4 of 5 |
| Audit readiness & evidence | 2.5 of 5 |
| Integrations & automation | 3 of 5 |
| European sovereignty | 1 of 5 |
Asset & risk management depth
Show reasoningHide reasoning
How this is scored
The ISMS core: asset inventory, risk methodology (identification, assessment, treatment), inheritance of protection needs (Schutzbedarf) across assets, and security incident handling with its reporting deadlines.
0 — Not an ISMS tool; the product has no asset or risk management.
3 — A risk register with likelihood and impact, and an asset list that can be imported.
5 — Asset inventory and risk management with a configurable risk matrix, risk treatment with owners and measures, and a register for security incidents.
8 — A documented risk methodology (ISO 27005, BSI 200-3 or equivalent), protection needs inherited across asset relations, incident workflows with the NIS2 reporting deadlines (24h/72h), and risk acceptance with named owners.
10 — Risk management a certifier works inside: the complete asset-risk-treatment chain with inheritance, business continuity planning (BIA, ISO 22301 or BSI 200-4), incident reporting with export for the authority, and risk reporting for the executive level.
The CISO
The risk module has real bones: risk registers built from standards templates, inherent and residual risk heat maps with trends, treatment plans, named risk owners who are notified, and an incident register with approval routing, CAPA and per-incident reports. But I found no public information on asset inventory, a named risk methodology, protection-need inheritance across asset relations, risk acceptance decisions, or the NIS2 24-hour/72-hour reporting clocks — the incident workflows route approvals, not notifications to an authority. 1 3 4
The GRC Consultant
The risk module builds registers from standards-based templates, offers customizable treatment plans with inherent and residual risk heat maps, assigns named risk owners who receive notifications, and the incident module routes approvals and spawns corrective actions — a usable register core. I found no public information on an asset inventory, a named risk methodology such as ISO 27005 or BSI 200-3, protection-need inheritance across asset relations, or NIS2's 24h/72h reporting deadlines built into incident handling. 3 4 1
The Drafted IT Officer
Pre-built threat events with inherent risk, likelihood and action methods, assignable risk owners with notifications, and inherent and residual risk heat maps give a drafted officer sane defaults to start from, and the incident module adds approval workflows, bulk upload and CAPA creation. We found no public information on an asset inventory, a named risk methodology, protection-need inheritance across assets, or NIS2 reporting deadlines in the incident workflows, so the ISMS core is only partly there. 3 4
The Lead Auditor
The risk module is real: registers from standard templates, inherent and residual heat maps with trends, treatment plans with assigned owners and notifications, continuous monitoring with alerts, and an incident register with approval workflows and CAPA escalation. I found no asset inventory, no documented methodology such as ISO 27005 or BSI 200-3, no inheritance of protection needs, and nothing on NIS2's 24/72-hour reporting deadlines, which holds it below the operable-ISMS level. 3 4 1
The Evidence Integrator
The Risk Assessment module builds risk registers from industry-standard templates with inherent and residual heat maps, customisable treatment plans, and named risk owners who receive notifications — a working register rather than a documented methodology. Incident handling exists with approval workflows and CAPA creation, but we found no public information on an asset inventory, protection-need inheritance across assets, or NIS2 24-hour/72-hour reporting deadlines built into incident workflows. 3 4
The Skeptic
The risk module shows registers built from standards templates, inherent and residual risk heat maps with trends, treatment plans with assigned owners and notifications, and an incident workflow with approvers, alerts and CAPA hand-off — treatment and incident handling are documented. We found no public information on an asset inventory, on a named risk methodology such as ISO 27005 or BSI 200-3, on inheritance of protection needs across asset relations, or on NIS2-style 24/72-hour reporting deadlines, which keeps this short of certifier grade. 3 4
Controls, SoA & measures
Show reasoningHide reasoning
How this is scored
Control catalogues, the statement of applicability, measure tracking and internal audit — whether the control side of the ISMS is operable or a checklist.
0 — No control catalogue or measures in the product.
3 — Control catalogues (such as ISO 27001 Annex A) with an implementation status per control.
5 — Controls linked to risks and to measures with owners and due dates, a statement of applicability generated from the control status, and internal audits supported with checklists.
8 — A statement of applicability always current from live control status, measure tracking with delegation and escalation, internal audit workflows with findings and corrective actions, and evidence attached to each control.
10 — The control fabric as a living system: catalogue updates versioned, audit programmes with recurring schedules, and every control answerable with linked, current evidence at any moment — all documented.
The CISO
Policy and control templates, continuous monitoring that alerts when a control goes out of compliance, a documented control mapping across five frameworks, and existing controls leveraged into automatic risk mitigation are all documented. We found no public information on a statement of applicability generated from control status, internal audit workflows with findings and corrective actions, or measure tracking with due dates and escalation — the control side reads closer to a monitored checklist than an operable control fabric. 1 3 7 8
The GRC Consultant
Controls are linked to risks through the interface between the risk and compliance modules, agents collect evidence and map it to controls automatically, and continuous monitoring flags controls that fall out of compliance — that is more than a checklist. I found no public information on a statement of applicability generated from live control status, measure tracking with delegation and escalation, or internal audit workflows with findings and corrective actions. 1 3 7
The Drafted IT Officer
Policy and control templates come with the platform, a risk can pull in an existing compliance control for automatic mitigation, and measures run as CAPAs with approvers and deadlines. We found no public information on a generated statement of applicability or a documented internal audit programme, so the control side reads as strong tracking rather than a certifier-ready fabric. 3 4 7
The Lead Auditor
Controls are linked to risks — the risk module pulls an existing control for automatic mitigation — with agents collecting evidence and mapping it to controls, continuous gap identification, and policy and control templates supplied. I found no statement of applicability generated from live control status, no internal-audit workflow with findings and corrective actions, and no measure tracking with delegation or escalation, so the control side reads as operable but not yet a living system. 1 3 7
The Evidence Integrator
Controls are treated as live state: the platform continuously monitors control status, alerts when a control goes out of compliance, and AI agents collect evidence and map it to controls automatically, with the risk module reusing existing controls for mitigation. That is more than a checklist, but we found no public information on a generated statement of applicability, internal audit workflows with findings, or measure tracking with delegation and escalation. 1 3 7
The Skeptic
Policy and control templates, continuous control monitoring with gap identification, and a documented interface from the risk module into the compliance module to reuse an existing control for mitigation are shown. We found no public information on a generated statement of applicability, on measures with owners and due dates, or on internal audit workflows with findings and corrective actions — and the two pages captured on control topics are academy lessons whose substantive content did not document product behaviour. 1 3 5 6 7
Framework & standard coverage
Show reasoningHide reasoning
How this is scored
Which regimes the product operationalises — ISO 27001, NIS2, TISAX/VDA ISA, DORA, BSI IT-Grundschutz, SOC 2 — and whether one control maps across them or each framework is a fresh island.
0 — No security framework built in; a generic task or document tool.
3 — One recognised framework (typically ISO 27001) delivered with its requirements and controls.
5 — Several named frameworks for its market (for example ISO 27001, NIS2, TISAX or BSI IT-Grundschutz), with controls mapped across at least two of them.
8 — Broad current coverage including NIS2, TISAX and DORA where relevant, one control satisfying many frameworks through a documented mapping, and updates published when a standard changes.
10 — Framework coverage as a living product: dozens of regimes, multi-compliance on one data basis, per-industry profiles, and a documented update cadence when the standard moves.
The CISO
More than thirty named regimes — NIS 2.0, ISO 27001, ISO 27701, BSI's C5, CIS, CMMC and FedRAMP among them — run simultaneously, and the SOC 2 crosswalk documents a real control mapping at current versions (ISO 27001:2022, PCI DSS v4.0, ISO 42001:2023) with overlap percentages. We found no public information on TISAX or DORA, and no documented cadence for publishing updates when a standard moves, which keeps it one tier below the broadest coverage for a European estate. 1 7 8
The GRC Consultant
Framework breadth is the strongest flank: forty-plus regimes from SOC 2 and ISO 27001 to NIS 2.0 and BSI C5, simultaneous multi-framework support, and a published SOC 2 crosswalk that estimates overlap per framework against current versions such as ISO 27001:2022 and PCI DSS v4.0 — answer a control once and it carries. I found no public information on TISAX or DORA coverage, or on a documented update cadence when a standard changes. 7 8 1
The Drafted IT Officer
More than forty regimes are on offer, among them SOC 2, ISO 27001:2022, PCI DSS v4.0, NIS 2.0 and the German C5, with a published crosswalk estimating how much of a SOC 2 control set carries into each added framework and multiple frameworks supported simultaneously on one basis. We found no public information on TISAX, DORA or BSI IT-Grundschutz, and no published cadence for updating when a standard changes, which caps this below the top band. 1 7 8
The Lead Auditor
Forty-plus regimes are named with descriptions — NIS 2.0, ISO 27001:2022, ISO 42001:2023, PCI DSS v4.0, FedRAMP, CMMC, C5 among them — run simultaneously, with a published crosswalk documenting how SOC 2 controls carry over to ISO 27001, HIPAA, GDPR, ISO 42001 and PCI DSS at stated overlap percentages. I found no TISAX or DORA in the list and no documented update cadence when a standard moves, which is what keeps it short of the top level. 7 8 1
The Evidence Integrator
Forty-plus frameworks are claimed with a published list running from SOC 2 and ISO 27001 through NIS 2.0, BSI C5, DPDPA and custom frameworks, operable simultaneously on one control basis. The multi-framework crosswalk documents which controls carry over, with estimated overlaps and current versions such as ISO 27001:2022 and PCI DSS v4.0; we found no public information on TISAX, DORA, or a published update cadence when a standard changes. 1 7 8
The Skeptic
The frameworks page names dozens of regimes — from SOC 2, ISO 27001 and NIS 2.0 through C5, ISO 27701, CMMC and FedRAMP — and a public crosswalk maps SOC 2 controls into ISO 27001:2022, HIPAA, GDPR, ISO 42001:2023 and PCI DSS v4.0 with stated overlap percentages, so the mapping is documented and version-current. We found no public information on TISAX or DORA, per-industry profiles, or a published cadence for updating mappings when a standard changes, which is what the top level asks for. 1 7 8
Audit readiness & evidence
Show reasoningHide reasoning
How this is scored
Whether the system produces defensible proof: change history, evidence collection, and reports for auditors, authorities and management.
0 — No reports, history or evidence; the product only stores the current state.
3 — PDF or Word reports of risks and controls, and documents attachable to records.
5 — Versioned records or a change history, standard report generators (SoA, risk report, management report), and evidence attached per control.
8 — A revision-safe change history, audit evidence packs generated on demand, management reports at a click, and read-only auditor access.
10 — Audit readiness as a standing state: evidence status shown continuously per framework and scope, proof packs an external auditor accepts as they are, and any record reproducible as it stood on a given date.
The CISO
Agents collecting evidence and mapping it to controls, real-time gap monitoring, board-ready dashboards, and complete per-incident reports with timelines and people are documented. We found no public information on revision-safe change history, on-demand audit evidence packs, read-only auditor access, or reproducing a record as it stood on a given date — the standing proof state an external certification audit demands is not demonstrated. 1 4 12
The GRC Consultant
Evidence is collected by agents and mapped to controls, control status is monitored continuously with alerts, board-ready dashboards update in real time, and incident reports carry timelines, people, actions and status — an auditor would see current state rather than assembled paperwork. I found no public information on a revision-safe change history, reproduction of records as they stood on a given date, or dedicated read-only access for auditors. 1 12 4
The Drafted IT Officer
AI agents collect evidence and map it to controls automatically, dashboards are described as board-ready and real-time, and each incident can be reported with timelines, people and actions. We found no public information on revision-safe change history, read-only auditor access or evidence packs produced on demand, so for my first external audit I would still be assembling the proof folder by hand. 1 4 12
The Lead Auditor
Evidence collection is automated and mapped to controls, incident reports carry timelines, people, actions and status, and dashboards are marketed as board-ready with a claimed one hundred percent audit-ready reports figure. What I do not see is what makes proof defensible: I found no revision-safe change history, no evidence packs generated on demand, no read-only auditor access, and no way shown to reproduce a record as it stood on a given date — an audit trail assembled on claims rather than documented history. 1 4 12
The Evidence Integrator
Automated evidence collection mapped to controls, real-time readiness monitoring, board-ready dashboards, and per-incident reports with timelines and people involved give a defensible current-state story for auditors and management. We found no public information on revision-safe change history, audit evidence packs generated on demand, read-only auditor access, or reproducing a record as it stood on a given date. 1 4 12
The Skeptic
Automated evidence collection mapped to controls and per-incident reports with timelines, people and actions are documented, and the '100% Audit-Ready Reports' figure appears as a marketing metric with no report artefact shown behind it. We found no public information on a revision-safe change history, on SoA or management report generators, on on-demand evidence packs, or on read-only auditor access — and the two captures positioned for audit readiness are academy lessons rather than product documentation. 1 4 9 10 12
Integrations & automation
Show reasoningHide reasoning
How this is scored
Whether the platform feeds from the real IT estate — directory import, CMDB, ticketing, scanners, SSO, API — and automates evidence collection instead of re-typing it.
0 — No import, export or integration; data is typed in and printed out.
3 — CSV or Excel import and export, and reminders for recurring reviews.
5 — Single sign-on, a documented API or a few named connectors (directory, ticketing or CMDB), and recurring tasks with reminders and assignment.
8 — A documented REST API for the core objects, a named connector set (Jira/ServiceNow-class ticketing, CMDB, cloud and endpoint sources), webhooks, SSO with SCIM provisioning, and automated evidence tests with human review.
10 — The platform behaves like infrastructure: API coverage of the whole data model, events or webhooks for every object, continuous control monitoring against the live estate, and recurring evidence collection automated and documented.
The CISO
Google Workspace login, a named AWS connector, pre-built connectors for all major cloud platforms, and automated evidence collection running on schedule are documented; the captured pages give different figures for the connector count, 270+ against 325+. We found no public information on a documented REST API, webhooks, SCIM provisioning, or named ticketing and CMDB connectors, which keeps this below infrastructure-grade automation. 1 2 7 11 12
The GRC Consultant
The captured pages give different figures for the connector count — 270-plus on one and 325-plus on another — but either way it is a large pre-built set with AWS named, custom integrations on request, Google Workspace login, and agents automating evidence collection. I found no public information on a documented API, webhooks, SCIM provisioning, or connectors to ticketing or CMDB sources. 7 12 1 2
The Drafted IT Officer
Hundreds of pre-built connectors are claimed — the captured pages give different figures, 270+ and 325+ — with AWS named explicitly, evidence gathering running on schedule, incident bulk upload from a spreadsheet and Google Workspace login. We found no public information on a documented API, webhooks, SCIM provisioning or named ticketing and CMDB connectors, so the estate feed looks broad but is thin on documentation an admin can verify. 1 2 4 7 12
The Lead Auditor
Hundreds of pre-built connectors are claimed — the captured pages give different figures for the count, 270-plus and 325-plus — covering major cloud platforms with AWS named, custom integrations on request, scheduled evidence gathering, and agentic AI collection with no manual exports. I found no documented API, no webhooks, no SCIM provisioning, and login shown only via Google Workspace, which keeps the estate feed short of full automation depth. 1 7 12 2
The Evidence Integrator
This is where the platform breathes: 325+ pre-built connectors for the major cloud platforms with AWS named, automated evidence collection running on schedule, continuous control monitoring, and cloud posture and identity governance built in — though the captured pages give different figures, 270+ versus 325+ integrations. Google Workspace login is the only identity integration shown, and we found no public information on a documented API, webhooks, SCIM provisioning, or Jira/ServiceNow-class ticketing and CMDB connectors. 1 2 7 12
The Skeptic
Login via Google Workspace, a named AWS connector, a claim of pre-built connectors for all major cloud platforms with scheduled monitoring and evidence gathering, and custom integrations on request are documented. We found no public information on a documented API, webhooks, SCIM provisioning, or named ticketing and CMDB connectors; and note the captured pages give different figures for the integration count — '270+' on the product brochure against '325+' on the homepage and frameworks page. 1 2 7 12
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where the security posture of the whole company actually lives and under whose law: contracting entity and parent company, hosting location, subprocessors (hosting, AI features, email, support tooling), DPA. The risk register is itself a target. Independently sourced by the sovereignty pipeline; describe what is proven, and treat what is not stated as unknown rather than non-EU.
0 — Proven non-EU end to end: non-EU entity and non-EU hosting with no EU option, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist; hosting location and subprocessors are not stated, or EU hosting is offered only on request or on top tiers.
5 — EU hosting stated as the default, a data processing agreement and a subprocessor list published; a parent company or a subprocessor may sit outside the EU.
8 — EU entity, EU hosting in named data centres, a subprocessor list with no non-EU processor touching customer content, and the DPA and TOMs published.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors, an on-premises or sovereign-cloud option, and the whole chain documented publicly.
The CISO
The data processing agreement is public, with a subprocessor list, SCCs governed by the law of the exporter's EU member state, UK and Swiss transfer provisions, and encryption and retention commitments. But hosting is stated as AWS facilities in the USA with processing permitted in the United States 'and anywhere else in the world' where Akitra or its sub-processors maintain operations — I found no public information on an EU hosting option, which puts a customer's risk register itself under US jurisdiction. 2 10
The GRC Consultant
Hosting is documented in AWS facilities in the USA, with processing permitted in the United States and anywhere the vendor, its affiliates or subprocessors maintain operations — a European client's ISMS would sit under US hosting. The data processing agreement with SCCs, UK Addendum and Swiss provisions, a published subprocessor list and an objection right show the transfer machinery is in order; I found no public information on an EU hosting option. 2 1
The Drafted IT Officer
The data processing addendum is public, with standard contractual clauses, a UK addendum, Swiss provisions, a published subprocessor list and stated encryption at rest and in transit. Hosting is stated as AWS facilities in the USA with processing permitted in the United States and "anywhere else in the world", and we found no public information on an EU hosting option, an EU contracting entity or an on-premises choice — as the person who now owns the risk register, that register itself would sit outside EU jurisdiction. 2 10
The Lead Auditor
The contracting entity is Akitra Inc. and the data processing addendum states that services and data are hosted in AWS facilities in the USA, with processing permitted in the United States and anywhere else in the world where Akitra, its affiliates or sub-processors maintain operations; I found no EU hosting option stated. The GDPR hygiene is genuine — published DPA with Standard Contractual Clauses, Irish fallback law, UK and Swiss coverage, a public sub-processor list and an objection right — but the customer's security posture demonstrably lives under US hosting. 2 10
The Evidence Integrator
The published data processing agreement is real contractual work — Standard Contractual Clauses governed by EU member-state law, a UK Addendum, Swiss coverage, a public subprocessor list, and an objection right. But the same document hosts the services in AWS facilities in the USA and permits processing in the United States and anywhere else in the world where Akitra or its subprocessors operate, and we found no public information on an EU hosting option. 2
The Skeptic
The data processing addendum states hosting in AWS facilities in the USA and permits processing in the United States and "anywhere else in the world" where Akitra or its sub-processors operate; we found no public information on an EU hosting option, and the contracting entity's jurisdiction is unstated beyond the Akitra Inc. name. The contractual GDPR machinery is real — Standard Contractual Clauses with EU member-state governing law, a UK Addendum, Swiss transfer terms, a published sub-processor list with a five-day objection right — but the physical posture is a stated non-EU default, so the European position rests on contract language alone. 2 10
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real invoice — per module, per entity, per year, with consulting unbundled — from public pages alone. Unpublished pricing is the B2B norm in this market, so this criterion describes rather than condemns; the benches weight it accordingly.
0 — No public prices at all; every configuration is a sales conversation.
3 — A public "from" price or one priced edition; the other editions, modules or scale steps are not public.
5 — Public prices per edition or tier with the billing period (monthly or annual) stated and the main inclusions listed.
8 — Every edition and module priced publicly with entity/user boundaries and setup fees stated, software separated from consulting, and VAT treatment given; only genuine corporate-group contracts are custom.
10 — Complete price computability: modules, scale steps, service packages and renewal rules public, so the invoice for a 100-employee company and a certification project is a two-minute exercise.
The CISO
The captured pages offer a free readiness assessment, free academy courses, and demo or gated-download requests; we found no public information on prices for editions, modules, users or consulting, so the real invoice can only come out of a sales conversation. 1 8 12
The GRC Consultant not rated — no public information
I found no public information on pricing, tiers, billing periods, entity or user boundaries, or setup and consulting fees on any page captured; engagement runs through a demo request and a free readiness assessment. 1 7 12
The Drafted IT Officer
We found no public prices on the captured pages — no editions, tiers, licence terms or setup fees — only a demo request, a free readiness assessment and free courses. Nothing in the public material lets a buyer compute an invoice before talking to sales, which is normal for this market but worth stating plainly. 1 8 12
The Lead Auditor not rated — no public information
We found no public information on pricing: no editions, tiers, module prices or billing periods appear on any captured page, including the homepage, the product brochure and the framework crosswalk, and the commercial path runs through demo requests, a free readiness assessment and a gated download form. This criterion is reported but does not count toward the verdict. 1 8 12
The Evidence Integrator not rated — no public information
We found no public information on pricing in any of the captured pages — no editions, tiers or figures appear. The pages instead route buyers to a free readiness assessment, downloadable guides, and demo requests. 1 8
The Skeptic
None of the captured pages carries a price, edition, or billing period for the product; the buying motion shown is a demo request form plus a free readiness assessment and free academy courses. A buyer cannot compute an invoice from what was captured — we found no public information on per-module, per-tier or per-user pricing, or on how software is separated from consulting services. 1 8
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Akitra
Is Akitra European?
Not determined: the vendor’s pages as captured do not say where Akitra is based.
Where does Akitra store data?
Not stated on the vendor’s pages as of 3 Nov 2026.
Does Akitra have a free plan?
Not stated on the vendor’s pages as of 3 Nov 2026.
What are the best alternatives to Akitra?
As of 3 Nov 2026, the panel rates preeco | informationssicherheit (3.5/5), Secfix (3.5/5) and 6clicks (3.5/5) highest among the other 29 Information Security products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is preeco | informationssicherheit (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Akitra alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 3 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We found no public information on pricing on the pages we read (akitra.com, akitra.com/data-processing-addendum, akitra.com/risk-management, akitra.com/incident-management, akitra.com/lesson/operationalizing-security-controls, akitra.com/lesson/creating-a-unified-control-framework and 6 more). If the vendor publishes it somewhere else, send us the page. Know more? Tell us
- 3 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
Sources (12)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page www.akitra.com Checked 3 Nov 2026 Details →
- 2 Data processing agreement (dpa) — found from the homepage akitra.com Checked 3 Nov 2026 Details →
- 3 Asset & risk management depth — found from sitemap akitra.com Checked 3 Nov 2026 Details →
- 4 Asset & risk management depth — found from sitemap akitra.com Checked 3 Nov 2026 Details →
- 5 Controls, SoA & measures — found from sitemap akitra.com Checked 3 Nov 2026 Details →
- 6 Controls, SoA & measures — found from sitemap akitra.com Checked 3 Nov 2026 Details →
- 7 Framework & standard coverage — found from sitemap akitra.com Checked 3 Nov 2026 Details →
- 8 Framework & standard coverage — found from sitemap akitra.com Checked 3 Nov 2026 Details →
- 9 Audit readiness & evidence — found from sitemap akitra.com Checked 3 Nov 2026 Details →
- 10 Audit readiness & evidence — found from sitemap akitra.com Checked 3 Nov 2026 Details →
- 11 Integrations & automation — found from sitemap akitra.com Checked 3 Nov 2026 Details →
- 12 Integrations & automation — found from sitemap akitra.com Checked 3 Nov 2026 Details →