Compeas

Compeas is a GRC platform built for European organisations that need to meet multiple compliance frameworks without juggling separate tools. It covers NIS2 in national versions for ten EU countries, ISO 27001, SOC 2, NIST CSF 2.0, GDPR and the Cyber Resilience Act in one system. The platform runs in the EU on Ploi Cloud, and customer data stays within the European Economic Area.

The platform is built by security professionals who've lived through compliance work themselves. Rather than forcing you to manage each framework separately, Compeas maps them together so controls, evidence, and policies work across standards at once. You get a single source of truth instead of fragmented spreadsheets and disconnected tools.

Key capabilities include:

• Risk management with inherent and residual scoring, named owners, and treatment strategies linked to specific controls
• Policy library with ready-made templates, version control, and acknowledgement tracking across departments
• Incident register with national NIS2, GDPR and Cyber Resilience Act reporting deadlines built in
• Product and vulnerability registers for Cyber Resilience Act obligations
• Automated testing with 68 tests across ten integrations
• Continuous monitoring that watches for framework and regulatory changes so your team doesn't have to
• Real-time alerts for control changes and compliance issues
• Audit-ready reports generated with one click
• SSO included with Microsoft Entra and Google Workspace for every customer, no per-seat fees

The platform guides you through assessment, planning, implementation, and ongoing monitoring. You can move from assessment to compliant in months rather than years because workflows are streamlined and evidence collection is built in, not bolted on. Dedicated compliance experts support you through the process.

Pricing is a flat annual fee per organisation: SEK 240,000 per year, or SEK 120,000 for the first year. All users, single sign-on, onboarding and training are included.

What sets Compeas apart: it's European-first by design, not a global tool adapted for Europe. There are no add-ons or surprise costs. The pricing is transparent, and capabilities like SSO come standard. If you're managing multiple frameworks and tired of manual evidence collection or piecing together compliance from different vendors, this consolidates the work into one organised system.