Information Security
Centraleyes
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Centraleyes Inc. · www.centraleyes.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Centraleyes at a glance
- Vendor
- Centraleyes Inc.
- Headquarters
- Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 13 Oct 2026
- Panel verdict
- The AI panel rates Centraleyes 2.5/5, the mean of 6 judges. Centraleyes is an AI-powered risk and compliance platform built around four modules — 1st Party, 3rd Party, Boardview and an AI Risk Register. how scores are made
- As of
- Vendor pages captured 13 Oct 2026; evaluated by the panel 16 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Centraleyes is an AI-powered risk and compliance platform built around four modules — 1st Party, 3rd Party, Boardview and an AI Risk Register. Its strongest showing is framework coverage at 7-8, on dedicated TISAX content with assessment levels and control domains, Smart Mapping across NIS2, NIST CSF and the ISO editions, and current ISO 27001:2022 support; the captured pages nonetheless give different figures for the library itself, from more than fifty pre-loaded to over 180+ frameworks. Integrations and automation scored 6-7 on bidirectional Jira and ServiceNow integration and API-driven evidence collection. Information security management sits at 4: risk identification, scoring, treatment planning and monitoring are described, but we found no public information on asset inventory or incident workflows with statutory reporting clocks. Audit readiness spans 4-6, the bench's widest range — the lead auditor scored it 4 for want of revision-safe change history and point-in-time reconstruction. Sovereignty runs 0-1, with no public information on legal entity jurisdiction, ownership, data residency or subprocessor exposure. The only pricing signal anywhere is the 'Start Getting Value With Centraleyes for Free' claim.
Speaks for it
- Framework coverage scored 7-8, with dedicated TISAX content down to assessment levels and control domains
- Controls, requirements and evidence are mapped once and applied across frameworks, including NIS2, NIST CSF and ISO 27001
- Bidirectional Jira and ServiceNow integration pushes tasks out and pulls updates back
- Evidence is collected automatically via APIs and stored under custom roles and permissions
- Remediation tasks are assigned to people with severity-tagged workflows and progress tracking and reminders
Held against it
- Sovereignty scored 0-1, with no public information on legal entity jurisdiction, ownership, data residency or subprocessor exposure
- Information security management scored 4, with no public information on asset inventory, protection-needs inheritance or incident workflows with statutory reporting clocks
- The Statement of Applicability appears only as an educational step-by-step guide and policy templates rather than generation from live control status
- The captured pages give different figures for the framework library: over 180+, over a hundred pre-populated, more than fifty pre-loaded
- We found no public information on revision-safe change history, point-in-time reconstruction or a dedicated auditor access role
Best for
- You need one control answered once across frameworks such as ISO 27001, NIS2 and NIST CSF instead of re-assembling evidence per audit
- You are preparing for TISAX and need assessment levels and control domains supported in-platform
- Your team already runs Jira or ServiceNow and wants remediation tasks to flow out to them and updates to flow back
- You need centralized, API-collected evidence stored under custom roles and permissions with consolidated audit-trail reporting
Avoid if
- You must be able to document where your risk register will be hosted, under whose law, and which subprocessors touch it before purchase — sovereignty scored 0-1 on the bench
- Your audits depend on revision-safe change history and reconstruction of the state on a past date — audit readiness spread 4-6 over exactly this gap
- You need an ISMS core beyond risk management, such as asset inventory or incident workflows with statutory reporting clocks
- You expect to generate a Statement of Applicability from live control status rather than assemble it from a guide and templates
The scores
| Criterion | Panel median |
|---|---|
| Asset & risk management depth | 2 of 5 |
| Controls, SoA & measures | 2 of 5 |
| Framework & standard coverage | 4 of 5 |
| Audit readiness & evidence | 3 of 5 |
| Integrations & automation | 3 of 5 |
| European sovereignty | 0 of 5 |
Asset & risk management depth
Show reasoningHide reasoning
How this is scored
The ISMS core: asset inventory, risk methodology (identification, assessment, treatment), protection-needs inheritance, incident handling with statutory clocks.
0 — No ISMS substance; "information security" is a chapter in the marketing site.
3 — A flat risk list and an asset spreadsheet import; no treatment tracking, no inheritance, incidents live in the ticket system.
5 — Asset and risk management with configurable matrices and treatment tracking; basic incident handling; inheritance and aggregation need manual work.
8 — A real risk backbone: documented methodology (ISO 27005 or equivalent), inherited protection needs across asset relations, incident workflows with statutory reporting clocks (NIS2 24h/72h), risk acceptance with ownership.
10 — Risk management a certifier works inside: complete asset-risk-treatment chain with inheritance, continuity planning, incident reporting with authority export, and risk reporting the executive level actually reads.
The CISO
Risk identification, scoring, treatment planning and monitoring, plus a proprietary ticketing system with remediate/accept/assign workflows and executive risk reporting, is a real core — but not yet a risk backbone: we found no public information on an asset inventory with inherited protection needs, a documented risk methodology, or incident handling with NIS2 24h/72h reporting clocks. 1 6 7 10
The GRC Consultant
Risk identification, scoring, treatment planning and monitoring are evidenced, alongside an AI risk register and executive reporting on business impact, but I found no public information on asset inventory, a documented risk methodology, inherited protection needs, or incident workflows with statutory reporting clocks. 1 6 7
The Drafted IT Officer
Risk identification, scoring, treatment planning and monitoring are described, with a risk register module and a proprietary ticketing system whose remediate/accept/assign/ignore workflows give me treatment tracking and genuine risk acceptance. I found no public information on an asset inventory with protection-needs inheritance or incident workflows carrying statutory reporting clocks, and without those the ISMS core is only half a backbone. 2 6 7 10
The Lead Auditor
Risk identification, scoring, treatment planning and monitoring are described, with an AI risk register and executive reporting, but everything captured concerns the risk side; we found no public information on asset inventory, protection-needs inheritance, or incident handling with statutory reporting clocks. Treatment appears as ticketing workflows (remediate, accept, assign, ignore) rather than a documented methodology. That sits between a flat register and a real backbone. 1 6 7 10
The Evidence Integrator
Risk identification, scoring, treatment planning and monitoring are evidenced, with remediation tasks assigned, tracked and reminded and an AI risk register behind the first-party module. But we found no public information on asset inventory, protection-needs inheritance across asset relations, a documented risk methodology, or incident workflows with statutory reporting clocks. 1 2 6 7 10
The Skeptic
Risk identification, scoring, treatment planning and monitoring are claimed, an AI Risk Register sits among the platform modules, and ticketing workflows cover remediate, accept, assign or ignore — but all of it is stated at brochure depth. We found no public information on asset inventory, a documented risk methodology, protection-needs inheritance, or incident handling with statutory reporting clocks. 2 6 10
Controls, SoA & measures
Show reasoningHide reasoning
How this is scored
Control catalogs, statement of applicability, measure tracking and internal audit — whether the control side of the ISMS is operable or a checklist.
0 — A static control checklist; applicability, implementation status and evidence are the consultant's spreadsheet.
3 — Control catalogs with status fields, but no SoA generation, no measure ownership, no link between controls and risks.
5 — Controls linked to risks and measures with owners and due dates; SoA producible with manual assembly; internal audit supported by checklists.
8 — SoA on demand from live control status, measure tracking with delegation and escalation, internal audit workflows with findings management, controls carrying their own evidence.
10 — The control fabric as a living system: catalog updates versioned, SoA always current, audit programs with recurring schedules, and every control answerable with linked evidence at any moment.
The CISO
Ready-made ISMS policy templates, a revamped ISO 27001 questionnaire, controls mapped once across frameworks, and remediation tasks assigned to named people give the control side substance. The Statement of Applicability, however, appears only as an educational step-by-step guide; we found no public information on generating a SoA from live control status, internal audit findings workflows, or escalation on overdue measures. 2 4 6 7
The GRC Consultant
Remediation tasks with assignment, progress tracking and reminders, plus automated gap analysis and evidence mapped to requirements, lift this above a status-field catalog, but the Statement of Applicability appears only as an educational how-to guide rather than a generation feature, and I found no public information on internal audit workflows or findings management. 4 6 7 10
The Drafted IT Officer
Controls, requirements and evidence are described as mapped once and applied across frameworks, and remediation tasks get assigned to people with tracking and reminders, which reads as operable rather than a consultant's spreadsheet. The Statement of Applicability shows up as a step-by-step educational guide plus ready-made policy templates rather than a described on-demand generation feature, and I found no public information on internal audit workflows with findings management. 2 4 5 7
The Lead Auditor
Controls, requirements and evidence are described as mapped once and applied across frameworks, with automated task assignment and progress tracking — but the Statement of Applicability material captured is an educational step-by-step guide plus ISMS policy templates, not a SoA generated from live control status. We found no public information on internal audit workflows or findings management. SoA production therefore looks like manual assembly on top of genuine control mapping. 1 2 4 7
The Evidence Integrator
Controls, requirements and evidence are mapped once and applied across frameworks, and the platform assigns remediation tasks to people and tracks progress with reminders — genuine measure ownership. The Statement of Applicability material captured is a step-by-step educational guide alongside an ISO 27001 questionnaire rather than on-demand SoA generation, and we found no public information on internal audit workflows or findings management. 2 4 6 7 10
The Skeptic
The Statement of Applicability footprint in the captured pages is an educational step-by-step guide plus ready-made ISMS policy templates — content, not a demonstrated SoA generated from live control status. Controls, requirements and evidence are described as mapped once and applied across frameworks, with automated task assignment, progress tracking and reminders. We found no public information on measure ownership with delegation and escalation, or internal audit workflows with findings management. 2 4 7
Framework & standard coverage
Show reasoningHide reasoning
How this is scored
Which regimes the product actually operationalizes — ISO 27001, NIS2, TISAX/VDA ISA, DORA, BSI IT-Grundschutz, SOC 2 — and whether one control maps across them or each framework is a fresh island.
0 — One framework, hard-coded; anything else is "on the roadmap".
3 — Two or three frameworks as separate checklists; the same control is answered once per framework.
5 — The major regimes for its market with partial cross-mapping; newer regimes (NIS2, DORA) present as content packs of varying depth.
8 — Broad current coverage including NIS2/TISAX/DORA where relevant, one-control-many-frameworks mapping, and visible maintenance as regimes evolve.
10 — Framework coverage as a living product: dozens of regimes, genuine multi-compliance mapping on one data basis, per-industry profiles, and documented update cadence when the standard moves.
The CISO
NIS2 in smart mapping, a deep TISAX readiness content set with assessment levels and control domains, current ISO 27001:2022 and ISO 27002:2022 editions, one-control-many-frameworks mapping and real-time change alerts show visible maintenance as regimes evolve. The captured pages give different figures for the framework library (over 180+, over a hundred pre-populated, more than fifty pre-loaded), and we found no public information on DORA or BSI IT-Grundschutz. 1 4 5 6 7 10
The GRC Consultant
Answering a control once is genuinely evidenced through smart mapping, a single standardized assessment across frameworks and crosswalking automation, with a dedicated TISAX platform, NIS2 in the mapping set and an ISO 27001:2022 update showing live maintenance; the captured pages give different figures for the framework count, and I found no public information on DORA or BSI IT-Grundschutz coverage. 1 4 5 6 7
The Drafted IT Officer
The catalog is claimed broad, with deep TISAX content including assessment levels and control domains, smart mapping of one control across regimes like NIS2, NIST CSF and ISO 27001, and an ISO 27001:2022 update that shows the library is actually maintained. The captured pages give different figures for the framework count — over a hundred pre-populated on one page, more than fifty on another — and I found no public information on DORA or BSI IT-Grundschutz. 1 4 5 6 10
The Lead Auditor
Broad and demonstrably maintained: 180+ frameworks claimed, deep TISAX content with assessment levels and control domains, NIS2 and ISO 27701 cross-mapped via Smart Mapping, and the ISO 27001:2022/27002:2022 update captured. The captured pages give different framework counts (180+, over a hundred pre-populated, more than fifty pre-loaded), so I read the breadth as strong rather than exact. We found no public information on DORA content. 1 4 5 6 7 10
The Evidence Integrator
TISAX is operationalized down to the AL1–AL3 assessment levels, NIS2 and NIST CSF sit in Smart Mapping, and the ISO 27001:2022 adoption shows the library moving with the standards; one-control-many-frameworks mapping is directly claimed and crosswalking automated. The captured pages give different figures for library size, from more than fifty pre-loaded to over a hundred and eighty frameworks, and we found no public information on a documented update cadence or per-industry profiles. 1 2 4 5 6 7
The Skeptic
Broad and current on paper: dedicated TISAX content, leverage across ISO 27001, ISO 27701, GDPR and NIS2, Smart Mapping across NIS2, NIST CSF and the ISO editions, and a visible update to the 2022 editions of ISO 27001 and ISO 27002. The captured pages give different figures for the framework library — over 180+, more than a hundred, more than fifty — which a buyer cannot reconcile from public pages. We found no public information on DORA coverage or a documented update cadence. 1 4 5 6 10
Audit readiness & evidence
Show reasoningHide reasoning
How this is scored
Whether the system produces defensible proof: revision-safe history, evidence collection, reports for auditors, authorities and management.
0 — Exports are screenshots; history is overwritten in place.
3 — PDF reports exist but evidence is attached ad hoc and changes leave no reliable trail.
5 — Versioned records, standard report generators, evidence attachments per control; assembling a full audit file still takes days.
8 — Revision-safe change history, audit-scoped evidence packs on demand, management reports current at a click, auditor access roles.
10 — Audit readiness as a standing state: continuous evidence status per framework and scope, exportable proof packs an external auditor accepts as-is, and a defensible answer to "show me the state on date X".
The CISO
Automated compliance testing, AI-powered evidence collection, evidence stored under custom roles and permissions, and consolidated reports with audit trails at a few clicks go beyond plain report generators. The "complete audit trails" claim stands without detail, and we found no public information on revision-safe point-in-time reconstruction, audit-scoped evidence packs, or a dedicated auditor access role. 1 7 8 9
The GRC Consultant
Consolidated reports with audit trails generated in a few clicks, centralized evidence storage, automated compliance testing and API-based evidence collection are evidenced, but I found no public information on revision-safe change history, audit-scoped evidence packs, auditor access roles, or reconstruction of the state at a past date. 2 7 8 9
The Drafted IT Officer
Automated evidence collection via APIs, secure evidence storage with custom roles and permissions, and consolidated reports described as carrying complete audit trails are real claims, with evidence mapped once across frameworks instead of re-assembled per audit. I found no public information on revision-safe version history, point-in-time reconstruction of a past state, or dedicated auditor access roles, which is what separates audit-ready from audit-scrambling. 2 7 8 9
The Lead Auditor
Evidence is collected automatically, stored with custom roles and permissions, mapped to controls, and consolidated reports with 'complete audit trails' are claimed at a few clicks. What I need before certifying — revision-safe change history and a defensible answer to the state on a past date — I found no public information on. Today this reads as strong evidence assembly without the point-in-time defense. 2 6 7 8 9
The Evidence Integrator
Evidence is centralized and mapped per control, collected automatically via APIs with automated compliance testing, stored under custom roles and permissions, and consolidated reports "with complete audit trails" arrive in a few clicks. That audit-trail claim is a single phrase with no detail behind it, and we found no public information on revision-safe history, audit-scoped evidence packs, or auditor access roles. 6 7 8 9
The Skeptic
Audit-ready evidence, automated compliance testing, AI-powered evidence collection and consolidated reports with complete audit trails are all asserted in the vendor's own words, and evidence storage carries custom roles and permissions — but none of it is demonstrated rather than claimed. We found no public information on revision-safe change history, audit-scoped evidence packs on demand, an auditor access role, or reconstruction of the state on a given date. 2 7 8 9
Integrations & automation
Show reasoningHide reasoning
How this is scored
Whether the platform feeds from the real IT estate — directory import, CMDB, ticketing, scanners, API — and automates evidence collection instead of re-typing it.
0 — A closed island: manual entry in, PDF out, no API.
3 — CSV/Excel import and export; no live connections, no API worth the name.
5 — Directory import (AD/Entra), a documented REST API for core objects, a handful of native connectors (ticketing, CMDB or SSO); automation is reminders and recurrence.
8 — Real connector set (Jira/ServiceNow-class ticketing, CMDB, cloud and endpoint sources), webhooks, SSO/SCIM, automated evidence tests with human review.
10 — The platform behaves like infrastructure: API parity for the data model, event streams, continuous control monitoring against the live estate, and automation that measurably removes the recurring toil rather than renaming it.
The CISO
Bidirectional Jira and ServiceNow integration, an advanced Tenable integration, API-based evidence collection and automated compliance testing form a real connector set. The AWS, GitHub and Google Cloud material reads as generic best practice rather than named native connectors, and we found no public information on directory import, SSO/SCIM, webhooks, or a documented API for the data model. 8 9 10 11
The GRC Consultant
Bidirectional Jira and ServiceNow integration plus cloud API connectors for AWS, GitHub and Google Cloud, with automated evidence collection and vulnerability scanning, show a real connector start, but I found no public information on directory import, SSO or SCIM, webhooks, CMDB, or a documented REST API for core objects. 8 9 10
The Drafted IT Officer
The platform is described as bidirectionally integrated with Jira and ServiceNow — pushing tasks out and pulling updates back — plus API-driven automated evidence collection and a no-code cloud deployment the vendor says is live in under a day, which fits a tool running alongside my day job. I found no public information on directory import from AD or Entra, SSO/SCIM, CMDB or webhook connectors, so the live-estate picture is partial rather than complete. 8 9 10
The Lead Auditor
Bidirectional JIRA and ServiceNow integration, automated evidence collection via APIs, a Tenable integration, threat-intelligence scanning and vulnerability scanning are all captured — a real connector set, not CSV shuffle. The API mentions around AWS, GitHub and Google Cloud sit in best-practice prose rather than product documentation, and we found no public information on a documented REST API, directory import, or SSO/SCIM. 8 9 10 11
The Evidence Integrator
This is a live-estate play, not a CSV drawbridge: bidirectional Jira and ServiceNow integration pushing data out and pulling updates back, API-driven automated evidence collection with cloud sources like AWS and Google Cloud named, continuous vulnerability scanning, automated external threat-intelligence scanning of the vendor surface, and a feature announcement of an advanced Tenable integration. What I cannot verify holds it back: we found no public information on directory import, CMDB, SSO/SCIM, webhooks, or a documented API reference, so API parity to the UI is unproven. 8 9 10 11
The Skeptic
This is the strongest area of the capture: bidirectional Jira and ServiceNow integration, a named Tenable integration, and AWS, GitHub and Google Cloud APIs feeding automated evidence capture. We found no public information on directory import, SSO or SCIM, webhooks, or a documented API reference for the platform's own data model. 8 9 10 11
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where the security posture of the whole company actually lives and under whose law — entity, hosting, subprocessors, DPA. The risk register is itself a target.
0 — Non-EU entity, non-EU-default hosting, no public DPA or subprocessor list — for the system holding your risk register.
3 — A DPA exists and an EU region is available on request or on top tiers; subprocessor exposure to US CLOUD Act reach is broad or undocumented.
5 — EU hosting is the default, DPA and subprocessor list published; the vendor or a critical subprocessor is still within non-European jurisdictional reach.
8 — EU entity, EU hosting with named data centers, published subprocessor list free of content-touching non-EU processors, DPA and TOMs public.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors, on-premises or sovereign-cloud options, and the whole chain documented publicly.
The CISO
We found no public information on the vendor's legal entity jurisdiction, ownership, hosting location, data residency, subprocessor list or a data processing agreement. A risk register is itself a target, and the captured pages do not say where it would live or under whose law. 1 3
The GRC Consultant
The captured pages are silent on entity jurisdiction, ownership, hosting location, data residency, a DPA and subprocessors, and for the system that would hold a client's risk register itself I found no public information on any sovereignty attribute. 1 3
The Drafted IT Officer
The captured pages give me no information on where the vendor is domiciled, where my risk register would be hosted, or which subprocessors touch the data, and I found no public data processing agreement or subprocessor list. For the system that would hold the company's entire risk picture, that silence answers the question on its own. 1 3
The Lead Auditor
The captured vendor pages give no public information on legal entity jurisdiction, ownership, hosting location, subprocessors, or a data processing agreement — for a system meant to hold the risk register itself. With nothing documented on any link in that chain, I can only score at the bottom of the scale. 1
The Evidence Integrator
Every sovereignty attribute — entity jurisdiction, ownership, data residency, subprocessor exposure — is undocumented in what was captured, and we found no public information on a DPA, subprocessor list or hosting location. A buyer cannot see under whose law their risk register would actually sit. 1 3
The Skeptic
We found no public information on the vendor's legal entity jurisdiction, ownership, hosting location, data processing agreement or subprocessor list — for the system that would hold the buyer's risk register. The vendor's captured pages are silent on where the data lives and under whose law. 1
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real invoice — per module, per entity, per year, with consulting unbundled — from public pages alone. Unpublished pricing is the B2B norm in this market, so this criterion describes rather than condemns; the benches weight it accordingly.
0 — No public prices at all; every configuration is a sales conversation.
3 — An entry price exists, but module add-ons, scale steps or bundled consulting make the real total incomputable.
5 — Most editions carry real numbers with billing period stated and software separated from services; at least one commonly needed module or scale step is unpriced.
8 — Every edition and module priced publicly with entity/user boundaries and setup fees stated; only genuine corporate-group contracts are custom.
10 — Complete price computability: modules, scale steps, service packages and renewal rules public, so the invoice for a 100-employee company and a certification project is a two-minute exercise.
The CISO
Beyond a "Start Getting Value With Centraleyes for Free" claim and demo scheduling, we found no public prices for any edition, module or service such as GRC as a Service or Regulatory Watch. The real invoice for a 400-employee certification project is not computable from the public pages. 5 9 11
The GRC Consultant
The only pricing-related statement anywhere is the free-entry tagline; every route to numbers runs through a demo or a brochure download, and I found no public figures for editions, modules or billing terms. 2 5 9
The Drafted IT Officer
The only pricing-related signal anywhere is a "Start Getting Value With Centraleyes for Free" claim with no figures attached, and everything else routes through "Schedule a demo". There are no public numbers for editions, modules or scale steps, so I cannot even begin to compute what the real invoice would look like. 5 9
The Lead Auditor
The only pricing signal anywhere is the 'Start Getting Value With Centraleyes for Free' claim; no edition, module or scale figure appears, with a free brochure and a demo funnel instead. We found no public information on pricing for any of the four platform modules, so a buyer cannot begin to compute an invoice from the captured pages. 2 5 9
The Evidence Integrator
The only pricing signals are a free-entry invitation and a demo call-to-action; we found no public prices for any edition, module, billing period or setup. The real invoice is a sales conversation end to end. 5 9
The Skeptic
No price figures appear in the captured pages; the only pricing-adjacent statement is "Start Getting Value With Centraleyes for Free", with a demo gate and a free brochure where an edition page would be. Software and services are sold side by side — GRC as a Service and Regulatory Watch appear alongside the platform modules — with no public pricing to separate them. 2 5 9 11
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined | — | uncited Report an error |
| Subprocessors | Not determined | — | uncited Report an error |
Questions about Centraleyes
Is Centraleyes European?
Not determined: the vendor’s pages as captured do not say where Centraleyes is based.
Where does Centraleyes store data?
Not stated on the vendor’s pages as of 13 Oct 2026.
Does Centraleyes have a free plan?
Not stated on the vendor’s pages as of 13 Oct 2026.
What are the best alternatives to Centraleyes?
As of 21 Oct 2026, the panel rates 6clicks (3.5/5), preeco | informationssicherheit (3.5/5) and Secfix (3.5/5) highest among the other 26 Information Security products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is preeco | informationssicherheit (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Centraleyes alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 13 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We could not confirm any pricing information on the vendor’s own pages as captured, so this page shows none rather than a statement we cannot stand behind. Know more? Tell us
- 5 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (11)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page www.centraleyes.com Checked 13 Oct 2026 Details →
- 2 Asset & risk management depth — found from sitemap www.centraleyes.com Checked 13 Oct 2026 Details →
- 3 Asset & risk management depth — found from sitemap www.centraleyes.com Checked 13 Oct 2026 Details →
- 4 Controls, SoA & measures — found from sitemap www.centraleyes.com Checked 13 Oct 2026 Details →
- 5 Controls, SoA & measures — found from sitemap www.centraleyes.com Checked 13 Oct 2026 Details →
- 6 Framework & standard coverage — found from sitemap www.centraleyes.com Checked 13 Oct 2026 Details →
- 7 Framework & standard coverage — found from sitemap www.centraleyes.com Checked 13 Oct 2026 Details →
- 8 Audit readiness & evidence — found from sitemap www.centraleyes.com Checked 13 Oct 2026 Details →
- 9 Audit readiness & evidence — found from sitemap www.centraleyes.com Checked 13 Oct 2026 Details →
- 10 Integrations & automation — found from sitemap www.centraleyes.com Checked 13 Oct 2026 Details →
- 11 Integrations & automation — found from sitemap www.centraleyes.com Checked 13 Oct 2026 Details →