# eramba — Information Security

eramba by eramba Ltd. holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-10-21. Provenance: provenance unknown; sovereignty: not determined.

- Vendor: eramba Ltd. (https://www.eramba.org)
- Category: [Information Security](https://whats-best.ai/software/information-security.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/information-security/eramba
- Alternatives: https://whats-best.ai/software/information-security/eramba/alternatives ([markdown](https://whats-best.ai/software/information-security/eramba/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-21 · oldest source captured 2026-10-20

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: eramba Ltd.
- Headquarters: Not stated on the vendor’s pages as of 20 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 20 Oct 2026
- Free plan: Yes, per the vendor’s own page [S4]

## The panel's verdict

eramba is an information-security GRC platform whose scores peak on pricing and controls. Pricing transparency clusters at 8: Community is free self-hosted with no user or time limit, Enterprise on-premises from 2500€/year, SaaS from 5000€/year, every module included, renewal capped at CPI plus an optional 3%. Controls and statement-of-applicability work clusters at 7, the SoA generated from live compliance analysis. Framework coverage, scored 6 to 8, is the real split: judges crediting the shared control fabric behind the ISO and NIS2 pages scored 8; those finding no public information on an explicit one-control-many-frameworks mapping held back at 6 to 7. Weakest are sovereignty at 2 to 3 — Eramba Limited of England and Wales under English law, SaaS in EU or US regions, no public information on a data processing agreement or subprocessor list — and integrations and automation at 4 to 5: the automation shown is a REST API, MCP and scheduled testing, with no public information on directory, ticketing or CMDB connectors. Judges also found no public information on NIS2 24h/72h reporting clocks or revision-safe change history.

**Speaks for it:**
- Every edition carries a published number — Community free with no user or time limit, on-premises from 2500€/year, SaaS from 5000€/year — with unlimited users, every module included and renewal capped at CPI plus an optional 3%.
- Statement of applicability generated from live compliance analysis, with requirements linked to controls, policies, projects and risks.
- Twenty-three frameworks named, with 70+ ready-to-import packages including a free NIS2 CSV, any framework uploadable as CSV, and no per-framework fees.
- Risk work is enforced rather than optional — owners and review dates mandatory, and exceptions recorded as documented decisions with owners and expiry.
- Self-hosted editions keep the risk register on your own servers, with numerical-only telemetry stored in the EU and an opt-out in the settings menu.

**Held against it:**
- Sovereignty scored 2 to 3: an England-and-Wales contracting entity under English law, SaaS offered in EU or US regions, and no public information on a data processing agreement or a subprocessor list.
- Integrations and automation scored 4 to 5, with no public information on directory, ticketing, CMDB, cloud or endpoint connectors, or on SSO, SCIM and webhooks.
- We found no public information on NIS2 24h/72h statutory incident reporting clocks, a documented risk methodology, or protection-needs inheritance across asset relations.
- We found no public information on revision-safe change history, audit-scoped evidence packs on demand, or reconstructing the state on a given date.
- The captured pages give different figures for the on-premises tier — a flat €2,500 on one page and 'from 2500€/year' on another — and no public information on setup fees.

**Best for:**
- You run ISO 27001 or NIS2 compliance and want the statement of applicability generated from live compliance analysis rather than assembled by hand.
- You need a flat, published budget with unlimited users and every module included instead of per-user or per-framework pricing.
- You must keep the risk register on your own infrastructure, starting with the free self-hosted Community edition.
- You want a second or third framework answered inside the same module fabric rather than bought as a paid add-on.

**Avoid if:**
- You require an EU contracting entity and EU-only hosting — the vendor is Eramba Limited of England and Wales under English law with exclusive English-court jurisdiction, and the SaaS regions include the US.
- Your evidence collection depends on live-estate feeds from directories, ticketing or CMDB systems — the automation the pages show is a REST API, an MCP server, notifications and scheduled control testing.
- You need statutory NIS2 24h/72h reporting clocks inside incident workflows — the incident lifecycle is described from detection to lessons learned with no public information on statutory timelines.
- You must show revision-safe change history and reconstruct the state on a given date for a certification audit — an activity log is listed among capabilities, and we found no public information on tamper-evident history.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The CISO | The GRC Consultant | The Drafted IT Officer | The Lead Auditor | The Evidence Integrator | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Asset & risk management depth | 3/5 | 2.5/5 | 3/5 | 2.5/5 | 3/5 | 3/5 |
| Controls, SoA & measures | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Framework & standard coverage | 4/5 | 4/5 | 3.5/5 | 3/5 | 4/5 | 3.5/5 |
| Audit readiness & evidence | 3/5 | 3/5 | 3/5 | 2.5/5 | 3/5 | 3/5 |
| Integrations & automation | 2.5/5 | 2/5 | 2.5/5 | 2/5 | 2/5 | 2.5/5 |
| European sovereignty | 1/5 | 1.5/5 | 1.5/5 | 1/5 | 1.5/5 | 1.5/5 |
| Pricing transparency | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 |
| **Weighted verdict** | **3/5** | **3/5** | **3/5** | **3/5** | **2.5/5** | **3/5** |

### The judges

- **The CISO** (v1.0): Owns the ISO 27001 certificate and the NIS2 exposure of a 400-employee company. Optimizes for a real risk backbone: methodology, inheritance, incident clocks, a statement of applicability that is never stale. Rejects checklist theater and risk registers that cannot answer who accepted what.
- **The GRC Consultant** (v1.0): Builds and runs ISMSs for a dozen clients at once. Optimizes for reusable control catalogs, multi-framework mapping that answers a control once, and templates that make client twelve cheaper than client one. Rejects single-tenant tools and frameworks bolted on as checklists.
- **The Drafted IT Officer** (v1.1): SME IT admin who became the information security officer by an email from management. Optimizes for guided setup, sane defaults, plain-language controls and a tool that runs alongside the day job. Rejects platforms that assume a security team and a consultant on retainer.
- **The Lead Auditor** (v1.0): Certifies ISMSs for a living and has seen every folder of screenshots. Optimizes for revision-safe history, an SoA generated from live control status, and a defensible answer to "show me the state on date X". Rejects audit trails assembled the week before the audit.
- **The Evidence Integrator** (v1.0): Believes evidence that is typed is evidence that is stale. Optimizes for connectors to the live estate — directory, CMDB, ticketing, cloud — continuous control checks, and an API with parity to the UI. Rejects data islands with a CSV drawbridge.
- **The Skeptic** (v1.1): Hunts "100% audit success" claims, framework logos that link nowhere, "coming soon" integrations sold as shipped, consulting bundled as software, and customer counts that disagree between pages. Exists to keep the rest of the bench honest.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Analytics cookies: Google Analytics · yes [S3]
- Complaint channel: www.ico.org.uk · Information Commissioner (ICO) [S3]
- Privacy policy URL: https://www.eramba.org/privacy [S2]

**Data**
- Data sale: no [S3]
- Rights: yes · yes · yes · if technically possible within retention parameters [S3]
- Rights fee: manifestly unfounded or excessive requests · yes [S3]
- Statistical collection: Eramba Enterprise · Eramba Community · no · yes [S3]
- Statistical optout: Settings menu · yes · no [S3]
- Statistical storage: EU · software updates · no [S3]
- Website retention: 5 · yes [S3]

**Hosting**
- Options: yes · yes · EU · US [S4]
- Saas location: Europe · AWS [S3]

**Integrations**
- Enterprise automation: yes · yes · yes · yes [S4]
- Framework import CSV: CSV · ISO 27002:2022 [S5]
- Upload any framework CSV: yes · 70+ [S5]

**Legal**
- Address: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ [S3]
- Change notice: email · 30 [S3]
- Entity: Eramba Limited · England and Wales · 09524547 · 71-75 Shelton Street, Covent Garden, London, England WC2H 9JQ [S2]
- Entity name: Eramba Limited [S3]
- Force majeure termination: 10 [S2]
- Governing law: England and Wales · exclusive jurisdiction of the courts of England and Wales [S2]
- Governing law: England and Wales [S3]
- Policy revision: 2025-07-11 · 1.6 [S3]
- Reseller sales: yes [S2]
- Terms documents: Enterprise On Premise · Community On Premise · Partner Agreement · eramba SaaS [S2]
- Terms version: 2026-07-31 · V1.9 [S2]

**Pricing**
- Community edition: 0 · no · no · yes [S5]
- Community free: 0 · no · unlimited [S4]
- Community free: self-hosted · 0 [S6]
- Competitor model: competitors: per user/employee/module, tiered, paid frameworks, paid add-ons [S1]
- Enterprise onprem: yes · 2500 · yes [S5]
- Enterprise onprem: customer infrastructure · EUR · 2500 [S6]
- Enterprise price: yes · 2500 · unlimited · yearly [S4]
- Enterprise saas: EU · US · 5000 [S5]
- Enterprise saas: eramba-operated, EU or US · EUR · 5000 [S6]
- Flat fee: flat annual fee · 5000 [S1]
- Flat fee model: unlimited · flat fee · unlimited [S4]
- Flat model: yes · yes · no [S5]
- Late payment interest: 3% per annum above Bank of England base rate · daily [S2]
- Pricing model: flat annual price, unlimited users, unlimited frameworks, all modules included · annual [S6]
- Renewal increase: CPI increase + optional 3% [S2]
- Scaling model: all included · no increase · unlimited · unlimited [S1]
- VAT inclusive: yes [S2]

**Product**
- Account reviews: account/role reviews, accounts pulled from customer systems [S6]
- AI assistant: AI Assistant & MCP listed among common features [S1]
- Auditor readonly account: yes [S5]
- Awareness per department: awareness content per department on repeating cycle, per-person completion tracking [S6]
- Backups: automatic · automatic [S4]
- Capabilities: Detailed Access Controls · Form Customisation · API · Notifications · Activity Log · Dynamic Statuses · Data views, Sorting, Filters, Etc [S1]
- Clause6 risk: Compliance Analysis · likelihood, impact, score, treatment · Compliance Exceptions [S5]
- Clause9 1 feature: dynamic status over time: expired reviews and failed audits per requirement [S5]
- Community downloads: 39591 [S5]
- Community edition: yes [S1]
- Community self install: yes [S4]
- Community size: 15705 · 1458 [S1]
- Community support: yes · yes [S4]
- Compliance course: Compliance Management · 22 [S5]
- Compliance packages: 70+ · yes · no [S4]
- Control testing: scheduled control testing with notifications on failed treatment [S6]
- Corrective measures projects: Article 21(4) corrective measures tracked as projects with owner and deadline [S6]
- CSV import: yes [S4]
- Current version: 3.31.0 · 73 [S1]
- Demo availability: Community · Enterprise [S1]
- Demo availability: yes · yes [S6]
- Demo call: use case · pricing · migration · 30 [S4]
- Deployment options: SaaS · Enterprise · On Premise [S1]
- Enterprise use cases: Awareness · Account Reviews · Online Assessments · 7 [S4]
- Enterprise users count: 641 [S5]
- Essential vs important supervision: proactive supervision · reactive supervision on cause [S6]
- Framework track record: ISO · PCI · SOC2 Reports · Risk Frameworks [S1]
- Frameworks listed: 23 · ISO 27001 · NIS2 · DORA · SOC 2 · GDPR · HIPAA [S4]
- Frameworks supported other: 93 [S5]
- Hosting models: On-Premise (Community) · On-Premise (Enterprise) · SaaS (Community and Enterprise) [S3]
- Incident lifecycle: incident lifecycle from detection to lessons learned [S6]
- ISO 27001 clause coverage: ISO 27001 clauses mapped to eramba modules, clauses 4-10 [S5]
- Marketing emails optout: contact us · unsubscribe link · yes [S3]
- Mcp server: yes [S1]
- Measure a: Policies · covered [S6]
- Measure b: Incidents · covered [S6]
- Measure c: Risk · covered [S6]
- Measure d: Assessments · covered [S6]
- Measure f: Controls · covered [S6]
- Measure g: Awareness · covered [S6]
- Measure i: Account reviews · covered [S6]
- Module awareness: Videos, disclaimers and questionnaires that audiences complete on a schedule. [S5]
- Module compliance analysis: Requirements linked to controls, policies, projects and risks. The SoA comes out of here. [S5]
- Module exceptions: Documented decisions that a requirement or risk is not treated, with owners and expiry. [S5]
- Module internal controls: The activities you run, tested at regular intervals with collected evidence. [S5]
- Module online assessments: Spreadsheet-defined questionnaires sent to anyone. Answers land in a portal for your review. [S5]
- Module organisation: Issues, scope, roles and goals. The ISMS context, measurable at intervals. [S5]
- Module policies: Write, review, approve and publish policies through a portal, with attestation via the Awareness Portal. [S5]
- Module projects: What you will do in the future about a gap, with tasks and deadlines. [S5]
- Module risk: Identify, classify, review and treat risks. Owners and review dates are mandatory. [S5]
- Modules count: 9 · yes [S5]
- National law variation: twenty-seven member-state transpositions, timelines vary [S6]
- Nis2 article21 coverage: eramba maps its modules to the ten measures of NIS2 Article 21 [S6]
- Nis2 package CSV free: NIS2 package as free CSV download, full directive Chapter IV or Article 21 alone [S6]
- Nis2 timeline: 2023-01 · 2024-10-17 [S6]
- No sales team: No sales team; contact is with core team or partner [S4]
- Partner network: 37 · 29 · yes [S4]
- Partner program: Partner program open to consultancies and MSPs [S4]
- Releases last year: 11 [S5]
- Self hosted backup updates: yes · yes [S4]
- Size gate: 50 · 10000000 [S6]
- Software scope: yes [S2]
- Supplier questionnaires: supplier questionnaires with findings and risks output [S6]
- Unlimited users flat fee: yes · yes · yes [S5]
- Upcoming feature: roadmap/preview · Approvals, Reviews and Attestation [S1]
- Usage history: 2015 · ISO · PCI · SOC 2 [S5]
- Usage stats: 2015 · 641 · 11 · 39591 [S6]
- Use cases: Risk Management · Automated Account Reviews · Awareness Trainings · Incident Management · Data Privacy · Online Assessment · Compliance Management [S1]

**Support**
- Documentation: yes [S1]
- Enterprise channels: free · yes · yes · yes [S4]
- Forum: discussions.eramba.org · public forum · 2015 [S1]
- Hours: Monday to Friday · 09:00-16:00 · CET [S2]
- Live training: yes · instructor-led courses · monthly webinars [S1]
- Release notes: yes [S1]
- Reply time: contact form replies within a couple of days [S6]

## Questions

### Is eramba European?

Not determined: the vendor’s pages as captured do not say where eramba is based.

### Where does eramba store data?

Not stated on the vendor’s pages as of 20 Oct 2026.

### Does eramba have a free plan?

Yes. eramba has a free plan, per [the vendor’s page captured 20 Oct 2026](https://whats-best.ai/evidence/9523).

### What are the best alternatives to eramba?

As of 21 Oct 2026, the panel rates [6clicks (3.5/5)](https://whats-best.ai/software/information-security/6clicks), [preeco | informationssicherheit (3.5/5)](https://whats-best.ai/software/information-security/preeco-informationssicherheit) and [Secfix (3.5/5)](https://whats-best.ai/software/information-security/secfix) highest among the other 26 Information Security products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [preeco | informationssicherheit](https://whats-best.ai/software/information-security/preeco-informationssicherheit) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [eramba alternatives](https://whats-best.ai/software/information-security/eramba/alternatives).

## What this page leaves out

- 20 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 13 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 8 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor page: https://www.eramba.org (checked 2026-10-20)
- [S2] Terms of service — found from the homepage: https://www.eramba.org/terms-and-conditions (checked 2026-10-20)
- [S3] Privacy policy — found from the homepage: https://www.eramba.org/privacy-policy (checked 2026-10-20)
- [S4] Security / trust page — found from the homepage: https://www.eramba.org/eramba-software (checked 2026-10-20)
- [S5] Framework & standard coverage — found from sitemap: https://www.eramba.org/frameworks/iso-27001 (checked 2026-10-20)
- [S6] Framework & standard coverage — found from sitemap: https://www.eramba.org/frameworks/nis2 (checked 2026-10-20)

---

Cite as: whats-best.ai, "eramba — Information Security", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/information-security/eramba

Corrections: https://whats-best.ai/correct/916?target=page