Information Security
eramba
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by eramba Ltd. · www.eramba.org
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
eramba at a glance
- Vendor
- eramba Ltd.
- Headquarters
- Not stated on the vendor’s pages as of 20 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 20 Oct 2026
- Free plan
- Yes, per the vendor’s own page source, captured 20 Oct 2026
- Panel verdict
- The AI panel rates eramba 3/5, the mean of 6 judges. eramba is an information-security GRC platform whose scores peak on pricing and controls. how scores are made
- As of
- Vendor pages captured 20 Oct 2026; evaluated by the panel 21 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
eramba is an information-security GRC platform whose scores peak on pricing and controls. Pricing transparency clusters at 8: Community is free self-hosted with no user or time limit, Enterprise on-premises from 2500€/year, SaaS from 5000€/year, every module included, renewal capped at CPI plus an optional 3%. Controls and statement-of-applicability work clusters at 7, the SoA generated from live compliance analysis. Framework coverage, scored 6 to 8, is the real split: judges crediting the shared control fabric behind the ISO and NIS2 pages scored 8; those finding no public information on an explicit one-control-many-frameworks mapping held back at 6 to 7. Weakest are sovereignty at 2 to 3 — Eramba Limited of England and Wales under English law, SaaS in EU or US regions, no public information on a data processing agreement or subprocessor list — and integrations and automation at 4 to 5: the automation shown is a REST API, MCP and scheduled testing, with no public information on directory, ticketing or CMDB connectors. Judges also found no public information on NIS2 24h/72h reporting clocks or revision-safe change history.
Speaks for it
- Every edition carries a published number — Community free with no user or time limit, on-premises from 2500€/year, SaaS from 5000€/year — with unlimited users, every module included and renewal capped at CPI plus an optional 3%.
- Statement of applicability generated from live compliance analysis, with requirements linked to controls, policies, projects and risks.
- Twenty-three frameworks named, with 70+ ready-to-import packages including a free NIS2 CSV, any framework uploadable as CSV, and no per-framework fees.
- Risk work is enforced rather than optional — owners and review dates mandatory, and exceptions recorded as documented decisions with owners and expiry.
- Self-hosted editions keep the risk register on your own servers, with numerical-only telemetry stored in the EU and an opt-out in the settings menu.
Held against it
- Sovereignty scored 2 to 3: an England-and-Wales contracting entity under English law, SaaS offered in EU or US regions, and no public information on a data processing agreement or a subprocessor list.
- Integrations and automation scored 4 to 5, with no public information on directory, ticketing, CMDB, cloud or endpoint connectors, or on SSO, SCIM and webhooks.
- We found no public information on NIS2 24h/72h statutory incident reporting clocks, a documented risk methodology, or protection-needs inheritance across asset relations.
- We found no public information on revision-safe change history, audit-scoped evidence packs on demand, or reconstructing the state on a given date.
- The captured pages give different figures for the on-premises tier — a flat €2,500 on one page and 'from 2500€/year' on another — and no public information on setup fees.
Best for
- You run ISO 27001 or NIS2 compliance and want the statement of applicability generated from live compliance analysis rather than assembled by hand.
- You need a flat, published budget with unlimited users and every module included instead of per-user or per-framework pricing.
- You must keep the risk register on your own infrastructure, starting with the free self-hosted Community edition.
- You want a second or third framework answered inside the same module fabric rather than bought as a paid add-on.
Avoid if
- You require an EU contracting entity and EU-only hosting — the vendor is Eramba Limited of England and Wales under English law with exclusive English-court jurisdiction, and the SaaS regions include the US.
- Your evidence collection depends on live-estate feeds from directories, ticketing or CMDB systems — the automation the pages show is a REST API, an MCP server, notifications and scheduled control testing.
- You need statutory NIS2 24h/72h reporting clocks inside incident workflows — the incident lifecycle is described from detection to lessons learned with no public information on statutory timelines.
- You must show revision-safe change history and reconstruct the state on a given date for a certification audit — an activity log is listed among capabilities, and we found no public information on tamper-evident history.
The scores
| Criterion | Panel median |
|---|---|
| Asset & risk management depth | 3 of 5 |
| Controls, SoA & measures | 3.5 of 5 |
| Framework & standard coverage | 4 of 5 |
| Audit readiness & evidence | 3 of 5 |
| Integrations & automation | 2.5 of 5 |
| European sovereignty | 1.5 of 5 |
| Pricing transparency | 4 of 5 |
Asset & risk management depth
Show reasoningHide reasoning
How this is scored
The ISMS core: asset inventory, risk methodology (identification, assessment, treatment), protection-needs inheritance, incident handling with statutory clocks.
0 — No ISMS substance; "information security" is a chapter in the marketing site.
3 — A flat risk list and an asset spreadsheet import; no treatment tracking, no inheritance, incidents live in the ticket system.
5 — Asset and risk management with configurable matrices and treatment tracking; basic incident handling; inheritance and aggregation need manual work.
8 — A real risk backbone: documented methodology (ISO 27005 or equivalent), inherited protection needs across asset relations, incident workflows with statutory reporting clocks (NIS2 24h/72h), risk acceptance with ownership.
10 — Risk management a certifier works inside: complete asset-risk-treatment chain with inheritance, continuity planning, incident reporting with authority export, and risk reporting the executive level actually reads.
The CISO
Risk work is enforced rather than optional: owners and review dates are mandatory, likelihood, impact, score and treatment are the module core, and exceptions are documented decisions with owners and expiry — the register can answer who accepted what. What I could not find: protection-needs inheritance across asset relations, a named risk methodology, and incident reporting clocks for the NIS2 24h/72h duties; the incident lifecycle is described from detection to lessons learned with nothing on statutory timelines. 5 6
The GRC Consultant
The risk module runs identify, classify, treat with owners and review dates mandatory, exclusions are documented non-treatment decisions with owners and expiry, and incidents run detection through lessons learned — a real register, not a spreadsheet. But I found no public information on an asset inventory module, protection-needs inheritance across asset relations, or NIS2 24h/72h statutory reporting clocks, and those are exactly the pieces that make client twelve cheaper than client one. 1 5 6
The Drafted IT Officer
The risk module forces owners and review dates and works through likelihood, impact, score and treatment, and exceptions give documented risk acceptance with owners and expiry — exactly the discipline I was never going to invent myself alongside the day job. Incidents run a whole lifecycle from detection to lessons learned, but I found no public information on statutory reporting clocks like the NIS2 24/72-hour duties, a documented risk methodology, or protection needs inherited across asset relations. 5 6
The Lead Auditor
The risk module identifies, classifies and treats risks with mandatory owners and review dates, untreated items are recorded as documented decisions with owners and expiry, and incidents run a full lifecycle from detection through lessons learned. We found no public information on an asset inventory with inherited protection needs, a documented risk methodology, or incident workflows carrying the statutory NIS2 24h/72h reporting clocks — which is what separates working risk tooling from the backbone a certifier works inside. 5 6
The Evidence Integrator
The risk module carries likelihood, impact, score and treatment with owners and review dates mandatory, and exceptions document untreated risks with owners and expiry — risk acceptance with ownership. Incident handling runs the full lifecycle from detection to lessons learned, but I found no public information on protection-needs inheritance across asset relations, statutory reporting clocks, or a documented risk methodology. 5 6
The Skeptic
The risk module has real substance — identification, classification and treatment with mandatory owners and review dates, likelihood, impact and scoring, and an exceptions module that documents risk acceptance with owners and expiry. Incident handling covers a lifecycle from detection to lessons learned, but we found no public information on statutory reporting clocks or protection-needs inheritance across asset relations, which is what separates a good risk register from a real risk backbone. 5 6
Controls, SoA & measures
Show reasoningHide reasoning
How this is scored
Control catalogs, statement of applicability, measure tracking and internal audit — whether the control side of the ISMS is operable or a checklist.
0 — A static control checklist; applicability, implementation status and evidence are the consultant's spreadsheet.
3 — Control catalogs with status fields, but no SoA generation, no measure ownership, no link between controls and risks.
5 — Controls linked to risks and measures with owners and due dates; SoA producible with manual assembly; internal audit supported by checklists.
8 — SoA on demand from live control status, measure tracking with delegation and escalation, internal audit workflows with findings management, controls carrying their own evidence.
10 — The control fabric as a living system: catalog updates versioned, SoA always current, audit programs with recurring schedules, and every control answerable with linked evidence at any moment.
The CISO
This is the strongest part for me: the Statement of Applicability comes out of Compliance Analysis from live requirement status — expired reviews and failed audits per requirement, before the auditor asks — and corrective measures are projects with an owner and a deadline linked to the requirement they close, tested on schedule with collected evidence. Approvals, reviews and attestation are shown as roadmap rather than shipped, and we found no public information on internal-audit findings workflows or versioned catalog updates. 5 6 1
The GRC Consultant
The statement of applicability comes out of the Compliance Analysis module with requirements linked to controls, policies, projects and risks, and exclusions handled as exceptions with owners and expiry — that is generation from live status, not manual assembly. Internal controls are tested on schedules with collected evidence and notifications when a treatment fails its test; I found no public information on internal audit workflows with findings management or versioned catalog updates, which is what separates a living control fabric from a very good tracker. 4 5 6
The Drafted IT Officer
The statement of applicability comes out of compliance analysis rather than out of my spreadsheet, requirements are linked to controls, policies, projects and risks, internal controls collect evidence on a test schedule, and corrective measures land as projects with an owner and a deadline. Failed tests trigger notifications, which is a start on escalation. I found no public information on delegation of measure ownership or a full internal-audit findings workflow. 5 6
The Lead Auditor
The statement of applicability is produced from the compliance analysis that links requirements to controls, policies, projects and risks, and internal controls are tested on schedules with collected evidence — the control side is operable rather than a checklist. We found no public information on internal-audit workflows with findings management or on measure delegation and escalation, and approvals, reviews and attestation are presented as a roadmap item rather than shipped. 5 6 1
The Evidence Integrator
The statement of applicability comes out of the compliance analysis where requirements link to controls, policies, projects and risks, and internal controls are tested on schedules with collected evidence and notifications when a treatment fails its test. I found no public information on delegation and escalation in measure tracking or internal audit workflows with findings management, which is what separates this from a top score. 5 6
The Skeptic
The statement of applicability is generated from live compliance analysis, exclusions are handled as documented exceptions with expiry, and controls are tested on schedules with collected evidence and notifications when a test fails. We found no public information on internal audit workflows with findings management or delegation of measure tracking, which keeps the control side a strong working system rather than a fully living one. 5 6
Framework & standard coverage
Show reasoningHide reasoning
How this is scored
Which regimes the product actually operationalizes — ISO 27001, NIS2, TISAX/VDA ISA, DORA, BSI IT-Grundschutz, SOC 2 — and whether one control maps across them or each framework is a fresh island.
0 — One framework, hard-coded; anything else is "on the roadmap".
3 — Two or three frameworks as separate checklists; the same control is answered once per framework.
5 — The major regimes for its market with partial cross-mapping; newer regimes (NIS2, DORA) present as content packs of varying depth.
8 — Broad current coverage including NIS2/TISAX/DORA where relevant, one-control-many-frameworks mapping, and visible maintenance as regimes evolve.
10 — Framework coverage as a living product: dozens of regimes, genuine multi-compliance mapping on one data basis, per-industry profiles, and documented update cadence when the standard moves.
The CISO
Twenty-three regimes are named — NIS2, DORA, TISAX, BSI C5, CPS 230 and ISO 42001 among them — with 70+ packages included, no per-framework fees, custom CSV upload and eleven releases last year, which reads as live maintenance rather than static content. Both the ISO and NIS2 pages map requirements onto the same underlying modules, but we found no public information on an explicit one-control-many-frameworks cross-mapping view or per-industry profiles. 4 5 6
The GRC Consultant
Twenty-three named regimes including NIS2, DORA, TISAX, C5 and CPS 230, seventy-plus import packages, any framework uploadable as CSV with no per-framework fees, and NIS2 Article 21 mapped measure-by-measure onto the modules — this is one shared control fabric rather than framework islands, which is the answer-once model I run on. I found no public information on per-industry profiles or explicit cross-framework rollup reporting, so I stop short of the top step. 1 4 5 6
The Drafted IT Officer
Twenty-three regimes are listed from ISO 27001, NIS2, DORA and TISAX through to SOC 2 and CPS 230, with 70+ ready packages, no per-framework fees, any framework uploadable as CSV, and the NIS2 package as a free download. Eleven releases last year and current packages like ISO 27002:2022 suggest the content is kept alive. I found no public information on one-control-many-frameworks mapping, so whether an answer given for ISO also answers for DORA is not shown. 4 5 6
The Lead Auditor
Twenty-three regimes are named — including NIS2, DORA, TISAX, C5 and CPS 230 — with 70+ ready packages, a free NIS2 CSV download, any custom framework uploadable as CSV, and a visible maintenance cadence of eleven releases last year. We found no public information on one-control-many-frameworks mapping on a single data basis, so answering a second regime may still mean working a fresh package rather than reusing live answers. 4 5 6
The Evidence Integrator
Twenty-three regimes are named including NIS2, DORA and TISAX, backed by more than seventy ready-to-import packages, any framework uploadable as CSV, no per-framework fees, and eleven releases last year showing the catalog is maintained. Requirements link to shared controls and risks on one data basis; I found no public information on per-industry profiles or a documented per-regime update cadence. 4 5 6
The Skeptic
Twenty-three regimes are named — NIS2, DORA and TISAX among them — on top of 70+ ready-to-import packages, free CSV packages for NIS2, and CSV upload for anything custom, with no per-framework fees. We found no public information demonstrating that one control answers multiple frameworks on a single data basis, or a documented cadence for updating packages as the regimes move. 4 5 6
Audit readiness & evidence
Show reasoningHide reasoning
How this is scored
Whether the system produces defensible proof: revision-safe history, evidence collection, reports for auditors, authorities and management.
0 — Exports are screenshots; history is overwritten in place.
3 — PDF reports exist but evidence is attached ad hoc and changes leave no reliable trail.
5 — Versioned records, standard report generators, evidence attachments per control; assembling a full audit file still takes days.
8 — Revision-safe change history, audit-scoped evidence packs on demand, management reports current at a click, auditor access roles.
10 — Audit readiness as a standing state: continuous evidence status per framework and scope, exportable proof packs an external auditor accepts as-is, and a defensible answer to "show me the state on date X".
The CISO
Auditors get read-only accounts scoped to what they need to see, and internal controls are tested at regular intervals with collected evidence — the two things an external auditor asks for first. We found no public information on revision-safe change history, audit-scoped evidence packs on demand, or reconstruction of the state on a given date; an activity log is listed only as a general capability. 5 1 4
The GRC Consultant
Auditors get a read-only account scoped to what they need to see, controls carry evidence collected at each scheduled test, and status per requirement shows expired reviews and failed audits before the auditor asks — a standing readiness view I like. But an activity log is not revision-safe change history, and I found no public information on date-scoped state reconstruction or audit-scoped evidence packs on demand, which is what I need before I send a certification client to a registrar. 1 4 5
The Drafted IT Officer
Auditors can get a read-only account scoped to what they need to see, requirements show dynamic status over time including expired reviews and failed audits before the auditor asks, and an activity log plus reporting ship as standard features with evidence collected on controls. That said, I found no public information on audit-scoped evidence packs on demand, revision-safe history guarantees, or a defensible answer to the state of the system on a given date. 1 5
The Lead Auditor
Auditors can be given read-only accounts scoped to what they need to see, controls collect evidence on test schedules, and requirement status is shown over time with expired reviews and failed audits flagged before the auditor asks. We found no public information on revision-safe change history, audit-scoped evidence packs on demand, or a defensible reconstruction of the state on a given date; an activity log is listed among capabilities, but the captured pages do not show tamper-evident history. 5 6 1
The Evidence Integrator
Auditors get read-only accounts scoped to what they need, controls carry evidence from scheduled tests, requirements show dynamic status over time including expired reviews and failed audits, and an activity log plus reporting ship in the product. I found no public information on revision-safe change history, audit-scoped evidence packs on demand, or reconstruction of the state on a given date. 5 1 4
The Skeptic
Read-only auditor accounts scoped to what they need, evidence collected per control on test schedules, reporting, and an activity log are all visible on the captured pages. We found no public information on revision-safe change history, audit-scoped evidence packs, current-at-a-click management reports, or an answer to the state on a given date — the difference between assembling a good file and standing audit readiness. 1 4 5
Integrations & automation
Show reasoningHide reasoning
How this is scored
Whether the platform feeds from the real IT estate — directory import, CMDB, ticketing, scanners, API — and automates evidence collection instead of re-typing it.
0 — A closed island: manual entry in, PDF out, no API.
3 — CSV/Excel import and export; no live connections, no API worth the name.
5 — Directory import (AD/Entra), a documented REST API for core objects, a handful of native connectors (ticketing, CMDB or SSO); automation is reminders and recurrence.
8 — Real connector set (Jira/ServiceNow-class ticketing, CMDB, cloud and endpoint sources), webhooks, SSO/SCIM, automated evidence tests with human review.
10 — The platform behaves like infrastructure: API parity for the data model, event streams, continuous control monitoring against the live estate, and automation that measurably removes the recurring toil rather than renaming it.
The CISO
A documented REST API, an MCP server, CSV import for any framework, account pulls from customer systems for reviews, and scheduled control testing with notifications give enough to feed the platform without re-typing everything. We found no public information on named connectors for directories, CMDB, ticketing, SSO/SCIM or scanners, and no evidence of continuous control monitoring against the live estate — automation here is reminders, recurrence and tests. 4 1 6
The GRC Consultant
There is a REST API, notifications, reporting automation, an MCP server for plain-language access, scheduled control testing and account reviews pulling accounts from customer systems — more than CSV in and PDF out. I found no public information on ticketing, CMDB, cloud, endpoint or SSO connectors or webhooks, so the platform does not yet feed from the live IT estate the way evidence collection has to. 1 4 6
The Drafted IT Officer
The story is a REST API, an MCP server for plain-language access from my AI assistant, notifications and reporting, plus CSV import for frameworks and pulling accounts from my systems for reviews. Scheduled control testing with automatic notifications and triggers is real automation, not just reminders. I found no public information on native connectors to ticketing, CMDB, SSO/SCIM or scanners, so the live-estate feed is not demonstrated. 1 4 6
The Lead Auditor
A REST API, notifications, reporting and an MCP server for plain-language queries are documented, accounts can be pulled from customer systems for review, and frameworks import as CSV packages. We found no public information on directory imports such as AD or Entra, native ticketing or CMDB connectors, SSO/SCIM, webhooks, or automated evidence testing against the live IT estate — the automation shown is scheduled tests and triggers rather than estate-fed monitoring. 4 1 6 5
The Evidence Integrator
A REST API and an MCP server are named among automation features and account reviews pull accounts from customer systems, but the mechanism behind that pull is never shown. I found no public information on directory, ticketing, CMDB, cloud or endpoint connectors, or on SSO, SCIM and webhooks — and the import paths I can actually see are CSV packages and spreadsheet-defined questionnaires, a drawbridge rather than a live estate feed. 4 6 1
The Skeptic
A REST API, MCP access from an AI assistant, notifications, scheduled control testing, and pulling accounts from customer systems for review put this clearly above CSV in and PDF out. We found no public information on native connectors for ticketing, CMDB or SSO/SCIM, on webhooks, or on automated evidence tests run against the live estate. 1 4 6
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where the security posture of the whole company actually lives and under whose law — entity, hosting, subprocessors, DPA. The risk register is itself a target.
0 — Non-EU entity, non-EU-default hosting, no public DPA or subprocessor list — for the system holding your risk register.
3 — A DPA exists and an EU region is available on request or on top tiers; subprocessor exposure to US CLOUD Act reach is broad or undocumented.
5 — EU hosting is the default, DPA and subprocessor list published; the vendor or a critical subprocessor is still within non-European jurisdictional reach.
8 — EU entity, EU hosting with named data centers, published subprocessor list free of content-touching non-EU processors, DPA and TOMs public.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors, on-premises or sovereign-cloud options, and the whole chain documented publicly.
The CISO
The vendor is Eramba Limited of England and Wales under English law and the UK regulator; the captured pages give different pictures of SaaS hosting — 'in the EU or the US' on the pricing side and servers 'in Europe (AWS)' in the privacy policy — with self-hosting available as the clean escape. For the system that would hold my risk register, we found no public information on a data processing agreement or a subprocessor list, and a non-EU entity is a real problem for NIS2-era diligence. 2 3 4 6
The GRC Consultant
On-premises editions for both Community and Enterprise mean the risk register can live entirely on your own infrastructure, SaaS is offered EU or US with the captured pages naming AWS in Europe, and the in-product telemetry is EU-stored, content-free and opt-out-able. But the contracting entity is Eramba Limited registered in England and Wales under English law, and I found no public information on a DPA or a published subprocessor list, so the SaaS chain is not jurisdictionally clean. 2 3 4
The Drafted IT Officer
The company is Eramba Limited of England and Wales under English law and English courts, SaaS runs on AWS in the EU or the US, and I found no public information on a DPA, a subprocessor list or named data centers for the system that would hold my risk register. Two things soften this: self-hosting puts everything on my own servers with automatic backups, and telemetry is numbers-only to EU servers with an opt-out in the settings menu that does not affect updates. 2 3 4
The Lead Auditor
The vendor is an England-and-Wales company, SaaS runs on AWS with the customer choosing an EU or US region, telemetry from installed instances lands on EU servers, and a genuine self-hosted edition lets the whole register live on the customer's own infrastructure. We found no public information on a published data processing agreement, a subprocessor list, or EU hosting as the default — thin transparency for the system that holds the risk register itself. 2 3 4
The Evidence Integrator
The vendor is Eramba Limited registered in England and Wales, SaaS runs on AWS with an EU or US choice, statistical telemetry goes only to EU servers, and a self-hosted edition exists for buyers who want the risk register on their own machines. I found no public DPA, no subprocessor list beyond AWS as the host, and no public information on ownership — and the entity itself sits outside the EU. 2 3 4
The Skeptic
The vendor is Eramba Limited, registered in England and Wales under English law and the exclusive jurisdiction of the English courts — a European but non-EU entity — offering SaaS in EU or US regions plus an on-premises edition that keeps the risk register on your own servers, with telemetry stored on EU servers. We found no public information on a data processing agreement or a subprocessor list, so the chain below the named EU AWS region is not visible, and a US region is offered alongside the EU one. 2 3 4
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real invoice — per module, per entity, per year, with consulting unbundled — from public pages alone. Unpublished pricing is the B2B norm in this market, so this criterion describes rather than condemns; the benches weight it accordingly.
0 — No public prices at all; every configuration is a sales conversation.
3 — An entry price exists, but module add-ons, scale steps or bundled consulting make the real total incomputable.
5 — Most editions carry real numbers with billing period stated and software separated from services; at least one commonly needed module or scale step is unpriced.
8 — Every edition and module priced publicly with entity/user boundaries and setup fees stated; only genuine corporate-group contracts are custom.
10 — Complete price computability: modules, scale steps, service packages and renewal rules public, so the invoice for a 100-employee company and a certification project is a two-minute exercise.
The CISO
Every edition carries a number a buyer can act on: Community free, Enterprise on-premises at €2,500 per year with unlimited users, Enterprise SaaS from 5000€/year, all modules included — and the renewal rule (CPI plus an optional 3%) sits in the published terms. Two frictions: the on-premises price is presented as flat on one page and as 'from 2500€/year' on another, and we found no public information on setup fees. 4 5 6 2
The GRC Consultant
Three public numbers — Community free self-hosted with no user or time limit, Enterprise on-premises at €2,500 per year flat, Enterprise SaaS at from 5000€/year — with unlimited users, data, modules and frameworks, a published renewal rule of CPI plus an optional 3%, and VAT treatment stated. The captured pages give different figures for the on-premises tier ("flat · unlimited users" versus "from 2500€/year"), and I found no public information on setup fees or multi-entity boundaries, which is the one step left before the invoice is a two-minute exercise. 2 4 5 6
The Drafted IT Officer
Community is free self-hosted with no user or time limit, Enterprise on-premises is quoted as "€2,500 per year · flat · unlimited users" with Enterprise SaaS "from 5000€/year", all modules included and no per-framework fees — my real invoice is close to computable from public pages alone. Renewal is publicly capped at CPI plus an optional 3%, sums are VAT-inclusive, and there is no sales team pushing an unlisted tier. The "from" wording on the Enterprise figures hints at unlisted steps, and I found no public information on setup fees. 2 4 5 6
The Lead Auditor
Real numbers are public for every edition: Community is free self-hosted with no user or time limit, the on-premises edition is shown flat at €2,500 per year with unlimited users on one page and 'from 2500€/year' on another, SaaS is 'from 5000€/year', all modules and frameworks are included, and the terms state VAT treatment plus a renewal formula of CPI with an optional 3%. The 'from' qualifiers and the absence of any stated setup fee leave the top of the invoice uncomputable, short of the two-minute exercise. 4 5 6 2
The Evidence Integrator
Community is free self-hosted with no user or time limit, Enterprise on-premises is stated "from 2500€/year" on one page and "€2,500 per year · flat · unlimited users" on another, Enterprise SaaS "from 5000€/year", with every module included in every edition and the renewal formula (CPI increase plus optional 3%) and VAT treatment published. I found no public information on setup fees or partner managed-service pricing, which is what keeps the full invoice from being a two-minute exercise. 4 5 6 2 1
The Skeptic
Three editions carry real numbers — Community free with no user or time limit, on-premises "from 2500€/year", SaaS "from 5000€/year" — with every module included, unlimited users and frameworks, VAT treatment stated, and a public renewal formula of CPI plus an optional 3%. The captured pages give different headline figures (a €2,500 flat fee on the software page, "€5000/Year" on the homepage), the "from" qualifiers are never explained, and we found no public information on setup fees — so the invoice is nearly, not fully, computable. 1 2 4 5 6
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | Not determined ⚠ unverified | — | uncited Report an error |
Questions about eramba
Is eramba European?
Not determined: the vendor’s pages as captured do not say where eramba is based.
Where does eramba store data?
Not stated on the vendor’s pages as of 20 Oct 2026.
Does eramba have a free plan?
Yes. eramba has a free plan, per the vendor’s page captured 20 Oct 2026.
What are the best alternatives to eramba?
As of 21 Oct 2026, the panel rates 6clicks (3.5/5), preeco | informationssicherheit (3.5/5) and Secfix (3.5/5) highest among the other 26 Information Security products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is preeco | informationssicherheit (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: eramba alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 20 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data residency, Subprocessors, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 20 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 13 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 8 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (6)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page www.eramba.org Checked 20 Oct 2026 Details →
- 2 Terms of service — found from the homepage www.eramba.org Checked 20 Oct 2026 Details →
- 3 Privacy policy — found from the homepage www.eramba.org Checked 20 Oct 2026 Details →
- 4 Security / trust page — found from the homepage www.eramba.org Checked 20 Oct 2026 Details →
- 5 Framework & standard coverage — found from sitemap www.eramba.org Checked 20 Oct 2026 Details →
- 6 Framework & standard coverage — found from sitemap www.eramba.org Checked 20 Oct 2026 Details →