Kertos
Compliance automation for information security, data protection and AI governance
Profile last updated: · View sources
About Kertos
Kertos is a compliance platform from Kertos GmbH in Munich, Germany. It brings policies, risks, assets, controls and audit evidence into a shared workspace for frameworks such as ISO 27001, GDPR, NIS2 and ISO 42001. Workflow automation and integrations support ongoing compliance work, with customer success and expert support depending on the plan.
The platform’s published privacy notice identifies AWS infrastructure and a range of AI, analytics, integration and support providers. It describes EU hosting for several services alongside international data-transfer safeguards, so European hosting should not be read as a promise that every processing operation stays in the EU.
Features
- Central workspace for policies, controls, risks and audit evidence
- Support for information security, data protection and AI governance frameworks
- Automated evidence collection through cloud and business-tool integrations
- Vendor, supplier and asset management
- Trust Center for sharing compliance documentation
- Single sign-on, two-factor authentication and role management
- KAIA assistance for compliance workflows and policy drafting
- Expert support options across Essential, Pro and Premium plans
Alternatives
Other European companies in the same category as Kertos.
Sovereignty Scorecard
Procurement-grade signals on data sovereignty, ownership, and EU residency.
We score every European vendor against six sovereignty dimensions captured in the SHIELD acronym. Each card below maps to one letter — read them as a checklist when comparing providers.
Third parties that may touch customer data, such as processors, subprocessors, payment providers, KYC vendors, support chatbots, analytics, and independent controllers disclosed by the vendor.
Where the legal entity sits, who controls it, and which subsidiaries operate under the same group.
Where customer data is physically stored, who runs the hosting stack, which CDN sits in front.
Whether public sources indicate the vendor or its data-processing third parties may fall under the US CLOUD Act or other extraterritorial reach.
Public terms, privacy policy, DPA, subprocessor list, impressum, and security or trust pages.
Independent audits and certifications (ISO 27001, BSI C5, TISAX, SOC 2) plus open-source transparency.
—
🇩🇪 Munich, Germany
Kertos GmbH
Application: The platform privacy notice identifies Amazon Web Services EMEA for hosting and infrastructure, including Amazon Bedrock. It also describes EU hosting for several other services and safeguards for international transfers.
| Name | Country | Role | Purpose |
|---|---|---|---|
| Amazon Web Services EMEA Sàrl | 🇱🇺 Luxembourg | Subprocessor | Server hosting, infrastructure and Amazon Bedrock model infrastructure. |
| Marker.io SRL | 🇧🇪 Belgium | Subprocessor | Bug reporting and feedback. |
| Microsoft Ireland Operations Limited | 🇮🇪 Ireland | Subprocessor | Azure AI Foundry services including semantic search and text generation. |
| Product Fruits s.r.o. | 🇨🇿 Czech Republic | Subprocessor | Customer onboarding. |
| Merge API, Inc. | 🇺🇸 United States | Subprocessor | Unified API for customers who enable integrations. |
| Langfuse GmbH | 🇩🇪 Germany | Subprocessor | LLM request logging and analysis; the notice specifies hosting in Ireland. |
| Google Cloud EMEA Ltd. | 🇮🇪 Ireland | Subprocessor | LLM-supported research for chat content; the notice specifies EU hosting. |
| Datadog, Inc. | 🇺🇸 United States | Subprocessor | Logging and performance/error monitoring; the notice specifies EU hosting. |
| Qdrant Solutions GmbH | 🇩🇪 Germany | Subprocessor | Cloud vector database hosted in the EU. |
| n8n GmbH | 🇩🇪 Germany | Subprocessor | Process optimization hosted in the EU. |
| Pylon Labs, Inc. | 🇺🇸 United States | Subprocessor | Support ticketing. |
Pricing
Custom quote
- Compliance platform, AI workflows and customer success support
Custom quote
- Essential plus ongoing expert support and multi-entity management
Custom quote
- Pro plus an appointed external CISO for information security frameworks
- Scheduled CISO or DPO strategy sessions, quarterly reporting and priority support
Questions & Answers
3 questions
What does Kertos help teams manage?
Kertos organizes compliance policies, controls, risks, assets and audit evidence. Its plans cover information security, data privacy and AI governance frameworks, with automation and different levels of expert support.
Does European hosting mean all processing stays in Europe?
No. The platform privacy notice identifies AWS infrastructure and EU hosting for several services, but it also discloses providers such as Merge API and Pylon in the United States and safeguards for international transfers.
How is Kertos priced?
Kertos offers Essential, Pro and Premium plans with tailored quotes based on company size and requirements. The plans differ in the level of customer success, expert and external CISO or DPO support.
Quick facts
Sources & provenance
This profile is compiled from cited public sources. Source URLs and latest source-check dates are listed below. Most recent source check: October 2, 2026.
Profiles use AI-assisted research with editorial review. Companies can request corrections at any time.
Found an error? Report it
Profile content
- primary · otherwww.kertos.io/en
- primary · otherwww.kertos.io/en
- primary · impressumwww.kertos.io/impressum
- primary · privacy-policywww.kertos.io/datenschutzerklaerung
- primary · pricing-pagewww.kertos.io/en/plans
- primary · pricing-pagewww.kertos.io/en/plans
- primary · pricing-pagewww.kertos.io/en/plans
- primary · privacy-policywww.kertos.io/datenschutzerklaerung
Sovereignty (SHIELD)
- primary · subprocessor-listwww.kertos.io/datenschutzerklaerungRows from the platform’s explicit Dritte Parteien subprocessor table; website marketing services are separately disclosed in the same notice.
- primary · impressumwww.kertos.io/impressum
- primary · privacy-policywww.kertos.io/datenschutzerklaerungKertos OS section; distinguishes infrastructure and specific EU-hosted services from international transfer safeguards.
- primary · privacy-policywww.kertos.io/datenschutzerklaerungThe platform notice discloses US providers including Merge API and Pylon. This is a provider-exposure classification, not a legal ruling.
- primary · impressumwww.kertos.io/impressum
- primary · privacy-policywww.kertos.io/datenschutzerklaerung