Compeas GRC is a European governance, risk and compliance platform for organisations that answer to European law. It is built in Sweden by Compeas AB and hosted in the EU, and customer data stays in the European Economic Area.
One system covers NIS2, ISO 27001, SOC 2 (Type 1 and Type 2), NIST CSF 2.0, GDPR and the Cyber Resilience Act. Controls are managed once and mapped across frameworks, so the same work and evidence count towards every framework it satisfies.
NIS2 follows each country's own law. Compeas carries national versions for Sweden, Denmark, Finland, Germany, Austria, Belgium, the Netherlands, Poland, Italy and Bulgaria, built from each country's official legal texts, with national requirements, key dates and incident reporting deadlines.
The platform includes a risk register with inherent and residual scoring, a policy library with ready-to-use templates and acknowledgement tracking, evidence collection with approval, vendor management, and an incident register that tracks the NIS2, GDPR and CRA reporting deadlines that apply. For manufacturers, a product register and a vulnerability register cover the Cyber Resilience Act, with report drafts that follow the fields of ENISA's single reporting platform.
68 automated tests run every hour across Microsoft 365, Google Workspace, GitHub, Azure, Slack and Zoom with read-only access, and each result is linked to the controls it proves. Single sign-on with Microsoft Entra ID or Google Workspace is included.
Compeas Auditor Tool gives audit firms and groups one view of every company they follow: compliance progress, evidence requests, incidents and products.
