EU data residency
Keep your compliance calm.
One GRC platform for the whole organisation, hosted in the EU.
Pritect runs governance, risk and compliance in 14 suites on one shared record: data protection, cybersecurity, AI governance, enterprise risk, third parties, legal operations, policies, board reporting, ESG and more, mapped to GDPR, NIS2, DORA, the EU AI Act and the CRA. Agents draft the work, and a named person signs it off.
- Residency
- Application database and file storage in Ireland, EU
- Platform
- Every governance domain on one shared record
- Sign-off
- Every draft waits for a named owner
CV screening assistant
Human resources · supplier hosted
Ready
AI governance
DraftAdded to the AI inventory and classified
Use case, EU AI Act risk class and accountable owner drafted for review
Source: EU AI Act Art. 6(2), Annex III(4)(a)Data protection
DraftProcessing activity added to the register
Purpose, lawful basis and retention drafted against GDPR
Source: GDPR Art. 30Cybersecurity
DraftSupplier security review opened
Control questions drawn from the controls you already run
Source: NIS2 Art. 21(2)(d)Risk management
DraftRisk raised and scored
Bias and supplier dependency scored against your risk appetite
One record, linked into four suites by the person who registered it. Every draft now waits for Anna Lindqvist, Head of Governance, to review it.
Scripted playback of demo data. In the product, the assistants run on Mistral, hosted in the EU, and a person applies or escalates every answer.
Ask Pritect
Demo dataNot another chatbot. Answers from your own records.
Ask Pritect works from your organisation's own records across your suites: incidents, assets, processing activities, assessments, suppliers and your organisation profile. A general chatbot knows the law. Pritect also reads your records, and shows which kinds of record each answer drew on.
A scripted demo with fictional data, not legal advice. Nothing is typed or sent anywhere.
Choose a question to see a scripted answer.
01 · The GRC model
Governance, risk and compliance, on one record.
Every suite works on the same records. Here are all 14, by the part of GRC each one carries.
Supplier
Demo dataOrrin Talent
Hosts the CV screening assistant. One record, read by every suite.
- Named as processor on the recruitment record of processing
- Its CV screening system classified, with an accountable owner
- Supplier security assessment opened against your controls
- Supplier dependency scored on your own risk matrix
- Its sustainability data sits on the same record
- Rolls into the next board report, reviewed by someone else
- Your supplier policy applies, approved by a named person
- Evidence linked to every obligation the supplier touches
- A breach at the supplier is reported once, with a clock per clause
- Due diligence on file, reassessment due before renewal
- Contract reviewed against your playbook
- The commercial arrangement assessed for competition law risk
- Its contract owner's awareness course assigned
- Entered once, with a review date, and read by every suite
- Not available yet. It has no release date.
Governance
Decisions with a named owner
Policies routed by your authority matrix, board meetings and reports, contracts, competition law and training. In Executive governance, Governance, Legal operations, Competition, Training, and Internal audit (coming soon).
Risk
One register for every risk
Security, privacy, AI and incident risks in one register, scored on your own matrix, with residual risk above appetite flagged. In Enterprise risk, Incident Centre, and Third-party governance.
Compliance
Obligations, controls and evidence
Records of processing, impact assessments, controls, evidence and disclosures, mapped to GDPR, NIS2, DORA and the EU AI Act. In Data protection, AI governance, Cybersecurity, ESG, General compliance, and Inventories.
02 · One platform
Every domain, one source of truth.
Each suite reads and writes the same records: the same suppliers, systems, processing activities and risks. A supplier entered once is the same supplier in every suite, so there is one copy to keep current instead of one per team.
Data protection
Records of processing, impact assessments, data subject requests and breach handling
AI governance
An inventory of AI systems with classification, impact assessment and an accountable owner
Cybersecurity
Assets, controls, assessments and evidence, mapped to NIS2, DORA and ISO/IEC 27001
Enterprise risk
One risk register, scored on your own matrix and treated, with residual risk above appetite flagged
ESG
Sustainability disclosures and metrics on the same record as risk and suppliers
Executive governance
Board packs and reports assembled from every domain, each report reviewed by someone who did not write it
Governance
Policies drafted, reviewed by a named person and routed by your authority matrix
General compliance
Obligations, regulatory change and evidence across every framework you follow
Incident Centre
Personal data breaches, cyber and AI incidents reported once, with a clock for each clause you adopted. In preview
Third-party governance
Supplier onboarding, due diligence, contracts, periodic reassessment and renewal alerts
Legal operations
Request intake, contract review against your playbook, matters and obligations
Competition
Competition law risk assessments for commercial arrangements, with dawn-raid readiness
Training
Awareness courses, assignments and completion evidence for every team
Inventories
Suppliers, assets, customers and services entered once and read by every suite, each with a review date
Internal auditComing soon
Not available yet. It has no release date.
03 · How it works
From the record to the report, with a person deciding.
Six steps every suite follows, whichever part of the programme the work belongs to.
01 · Record
Enter it once
Suppliers, systems, assets, processing activities and your organisation structure, typed in or imported, then shared by every suite.
02 · Assess
Assess what is already there
DPIAs, AI risk assessments, security risk assessments and supplier due diligence link to the records they concern, and agents draft from those links.
03 · Act
Work it to a deadline
Risks are treated, tasks assigned, and requests and incidents worked against the clock that applies, with a named owner on each.
04 · Evidence
Keep the proof with the control
Evidence sits on the controls you run, and the controls are mapped across frameworks, so one piece of evidence can serve more than one.
05 · Sign off
A person decides
Agents draft. A named person reviews each draft and decides, and the audit log records who did what, and when.
06 · Report
Report from the same records
Dashboards, board reports and versioned PDF exports are built from the records the work happened on.
04 · Agents at work
Agents draft the work. People decide.
Two moments from the platform, played back on demo data. The assessment companion drafts a DPIA answer from the records linked to it. The data protection advisor answers a question from the organisation's own register. In both, a person applies or escalates the result.
- Data protection
- DPIA
- Loyalty app analytics
Answer applied to the field
- Description
- Necessity
- Risks
- Measures
- Sign-off
Step 2 of 5 · Question 1 of 3
Why is this processing necessary and proportionate to its purpose?
Explain why a less intrusive approach would not achieve the purpose.
Linked records
- Processing activityPA-014
- SupplierSUP-031
- EntityENT-002
Companion
- Expert
- Business
- Explain
- Draft
- Review
- Context
- Smart Fill
- Support
- Read the processing activity
- Read the supplier's data processing terms
- Read your answers to step 1
Suggested answer
The purpose is to learn which loyalty offers members use, so that offers can be improved or retired. Collection is limited to pseudonymised member IDs and offer events, with no location or payment data.PA-014 Aggregate counts alone cannot show which offer variant led to a redemption, so event-level data is kept for 90 days and then aggregated. Northwind Analytics processes the events under its data processing terms. Where it processes them is not yet confirmed, so this is flagged for the risk step.SUP-031
Always review AI output before applying
- DPO Office
- AI Advisor
Answer ready
Can we start sending loyalty app events to our analytics supplier next month?
Not yet. Three things in your records stand in the way.
- The activity is still a draft and records no lawful basis for event-level analytics.PA-014
- Its DPIA is open at step 2 of 5 and has not been signed off.GDPR Art. 35
- Your prior advice asks analytics suppliers to confirm where they process data before go-live, and Northwind Analytics has not confirmed it.ADV-022GDPR Art. 44
Next step: finish the DPIA, ask Northwind Analytics where it processes the events, and ask Layla Haddad to complete the activity record.
Automated guidance, not formal advice. A DPO can escalate this answer to the advice register as a draft.
Sources read for this answer
- Processing activityLoyalty app analyticsDraft · owner Layla HaddadPA-014
- AssessmentDPIA, loyalty app analyticsStep 2 of 5 · not signed offDPIA-007
- RegulationGeneral Data Protection RegulationCited as a general article reference in this demoGDPR Art. 35GDPR Art. 44
- Prior DPO adviceAnalytics suppliers outside the EUProvided by Omar Saleh, DPOADV-022
05 · EU coverage
Mapped to the rules you answer to.
The EU frameworks your regulators apply, with the Pritect suites that carry the work for each. Open a linked framework to read how.
GDPR
Regulation (EU) 2016/679, the General Data Protection Regulation
EU AI Act
Regulation (EU) 2024/1689, harmonised rules on artificial intelligence
NIS2
Directive (EU) 2022/2555, a high common level of cybersecurity across the Union
DORA
Regulation (EU) 2022/2554, digital operational resilience for the financial sector
Cyber Resilience Act
Regulation (EU) 2024/2847, cybersecurity requirements for products with digital elements
CSRD
Corporate sustainability reporting, on the same record as risk and suppliers
ISO/IEC 27001
Cross-mapped to the same controls, so one piece of evidence serves both
06 · Who it is for
Start from the work you do.
Each page plays one task a role does in Pritect, on demo data, through to the named person who reviews it. Four roles also have a GCC edition.
For data protection officers
Baseline every entity's privacy programme, with a reviewer named
For CISOs
Set a cyber maturity target a second person decides
For AI governance leads
Take a shadow AI tool to a reviewed supplier assessment
For risk officers
One risk register, fed by every suite
For executives
Recommendations you can trace back to the signal
For data protection officers in the GCC
Baseline every entity's privacy programme across the GCC, with a reviewer named
For CISOs in the GCC
Set a cyber maturity target a second person decides
For AI governance leads in the GCC
Take a shadow AI tool to a reviewed supplier assessment
For risk officers in the GCC
One risk register, fed by every suite
07 · Pricing
Every tier, priced in public.
Choose a platform tier, then add the domain suites you need. Enterprise included.
Free
€0/ month
1 user
Try the platform with one user and your own data.
Get startedBasic
€199/ month
Up to 5 users
For small teams starting a programme, with inventories, reports and the Incident Centre.
Book a demoPro
Recommended€599/ month
Up to 25 users
For growing programmes, adding training, organisation hierarchy, custom branding and enforced MFA.
Book a demoEnterprise
€1,299/ month
Up to 1,000 users
Single sign-on, API access and enterprise controls for large organisations.
Book a demoEnterprise custom
From€3,500/ month
Tailored to you
For requirements that change our cost to serve, such as dedicated infrastructure or bespoke terms.
Talk to us
Domain suites
Complete domain packages, the way most customers buy Pritect. List prices are struck through where a suite is discounted.
- Data protection suiteList price €460€299/ month
- Cybersecurity suiteList price €749€487/ month
- AI governance suiteList price €460€299/ month
- Enterprise risk suiteList price €460€299/ month
- Governance suiteList price €229€160/ month
- Compliance suiteList price €229€160/ month
- Executive governance suiteList price €299€209/ month
- Enterprise completeList price €1,999€1,299/ month
- Legal operations suiteList price €460€299/ month
- Training suite€229/ month
- ESG suite€98/ month
Prices in euro (EUR), excluding VAT.
08 · Residency
Your data is hosted in the EU.
The platform's database, sign-in and file storage run in Ireland, and every sub-processor is published with where it runs.
- Hosting
- Application database, sign-in and file storage in Ireland, EU
- AI processing
- Mistral AI, hosted in the EU and included as standard
- UAE edition
- A separate deployment hosted in Microsoft Azure UAE North, Dubai
- Sub-processors
- Published in full, each with its location, including those outside the EU
09 · Trust and security
Security you can check before you buy.
A summary of what the Trust Centre publishes, including what is still in progress. The Trust Centre has the detail and the documents.
Tenant isolation
Row-level security on every tenant table, with access across tenants denied by design.
Encryption
TLS 1.2 or higher in transit, and AES-256 at rest.
Sign-in
Multi-factor authentication available on every account, and single sign-on over SAML 2.0 on Enterprise.
Audit log
Every action logged with the user, the time and its context.
Certification
ISO/IEC 27001 certification is in progress, with a 2026 target. SOC 2 and ISO 27701 are on the roadmap. None is held yet.
AI
No training on customer data, and human oversight in every AI-assisted feature.
10 · Questions