Aligned
ISO/IEC 27001:2022
Information security
ISMS designed and operated against the 2022 control set. Annual third-party penetration tests.
77 officer roles. Your team or ours.We run compliance.
We run compliance.
You run the business.
License the workspace for your own compliance officers, or appoint ours. Either way, the evidence sits ready when the auditor calls.
€49 per officer role per month. Individual pricing for appointed officers.
CIVAC
One platform.
- 77 mandates.
- Internal or external.
- Always audit-ready.
OfficersPlatform
See both ways to land on CIVAC77 officer roles. All covered.
Compliance posture
Compliance, signed and sealed.
We hold ourselves to the same standards we ask our clients to meet. Aligned, audited, and ready for the next regulatory wave.
Native
GDPR · DSGVO
Data residency
Data hosted exclusively in the EU. GDPR baked in from day one, not retrofitted.
Ready
NIS-2 / §§ 30, 38 BSIG
Incident readiness
24-hour early-warning workflow plus the 72-hour incident-notification flow are part of the platform, not an add-on.
Officers and platform, one address
We supply the doctor.We supply the safety lead.We supply the platform.
Software vendors leave the appointment to you. Consultancies appoint an officer and hand you a PDF. CIVAC does both, from one address, on one evidence trail.
Appointed in writing. Named on your letterhead.
§ 3 ASiG
Occupational Physician
On-site checkups, workplace assessments, return-to-work cases.
Available
§ 5 ASiG · DGUV V2
Safety Specialist (SiFa)
Risk assessments, inspections, training records.
Available
§ 3 GbV
Dangerous Goods Officer
ADR documentation, transport checks, annual reports.
Available
Art. 37 GDPR
Data Protection Officer
Breach response, DPIAs, RoPA, privacy policies.
Available
Mandate unfilled? Personal liability of management. The regulator does not read excuses, they read appointment letters.
And every hour leaves a clean trail.
CIVAC Workspace
Tuesday, 22 April 2026
Hello, Sophie
Your situation today. Critical deadlines first, then trainings and the ongoing documentation.
Active Data Breach
Deadline in 18 h, Art. 33 GDPR
01Critical Deadlines
2 in the next 7 daysDPIA review, new HR system
in 3 days
Fire protection inspection, Building B
in 7 days
- Audit trail by defaultEvery task, training and inspection is timestamped, signed and exportable the moment an inspector asks.
- Trainings that actually closeMandatory modules with a test and a certificate. Completion tracked, without chasing inboxes.
- Evidence pinned to the mandatePhotos, voice notes and files land against the legal criterion they prove. No scattered folders.
- Monthly report, auto-generatedThe documentation officer duty stops being a week of work. It becomes one exported PDF.
77 officer rolesOne written appointmentZero binders
Checks
Answers in seconds, not weeks.
Five AI checks read your website, your obligations and your audit readiness against statute and standard. Every finding lands as a task you can act on the same afternoon.
Cease-and-desist check
Paste a URL, get the risks.
Scans a public website against eight liability categories, from imprint and cookies to accessibility and unfair competition.
Sample finding
Cookie banner without an equal reject option
§ 25 TTDSG · critical
Obligations check
Which officers you must appoint.
Maps your company profile against all 77 officer roles and flags what is mandatory versus recommended, with the statutory trigger.
Sample finding
120 employees, health data → DPO mandatory
Art. 37 GDPR
Audit readiness
Pass the audit before it happens.
Runs a mock audit against one of your criteria catalogues and scores how ready you are, gap by gap.
Sample finding
Readiness 68 % · 4 gaps before DPIA sign-off
Internal mock audit
Regulatory radar
Your standing duties, kept current.
Compiles the recurring obligations for a chosen officer role plus the recent legal changes that touch it.
Sample finding
New: EU AI Act — risk classification by 02/2026
Per officer role
Accessibility check
A website scan plus a ready statement.
Discovers your pages via sitemap and scans them with axe-core, then drafts the accessibility statement the BFSG requires.
Sample finding
30 pages scanned · 7 critical issues · statement drafted
BFSG · WCAG 2.1 AA
AI analysis, grounded in statute and standard. Results are a starting point, not legal advice.
Platform
Six surfaces. One workspace.
The entire week of an officer. In one place. Without the tab soup. Without the spreadsheet sprawl.
Daily workflow
Tasks
Template-first workflow. Email intake with automatic template detection. Recurring cadences so last quarter's work becomes this quarter's starting point.
Email intake905 templatesRecurring cadencesSide-rail AI
Onboarding + refreshers
Trainings
Roll out mandatory trainings with modules, a test, and a certificate. Track completion without chasing inboxes.
ModulesTest + certificateCompletion tracking
Evidence, in the moment
Audits
On-site inspections, supplier audits, DPIAs, TIAs. Reusable criteria catalogs, with photos, voice notes and files captured against each criterion.
Criteria catalogsPhotos + voiceSupplier auditsDPIA · TIA
Audit-ready by default
Documentation
A monthly workflow that pulls in your completed tasks and trainings and produces a clean, export-ready compliance record. No retroactive panic.
Monthly reportAuto-generatedExport-readyNo retro
Knowledge on tap
Questions
An AI data-protection assistant with confidence scoring, source citations and one-click escalation to external counsel when stakes are high.
Confidence scoreSource citationsCounsel escalation
AI analysis
Checks
Five AI checks across your website, your obligations and your audit readiness. Every finding becomes a task in one click.
Cease-and-desistObligationsReadinessRegulatory radarAccessibility
Live preview
See CIVAC in action.
A real look at the workspace you walk into after sign-in. Switch between the three surfaces most officers live in.
civac.de/dashboard
Welcome back, Mr. Hoffmann
Monday, April 20, 202612
Open tasks
4
Due this week
37
Templates
Up next4
- TodayData breach response: EU customerBreach
- TodayReview new DPA from Slack TechnologiesDocument
- TomorrowQuarterly TOM inspectionAudit
- WedSign off onboarding training batchTraining
Templates
905 templates. Already built.
Every role ships with structured templates pulled straight from the field. Groups, fields, defaults. The blank page never stops you when a breach lands at 6 PM on a Friday.
- Pick once, run forever. Fill in the structured groups, save as your own.
- Pin the ones you use weekly. The rest stay out of the way.
- Customise, then share. Your institutional knowledge compounds.
DPO · TaskData Breach ResponseDPO · TaskDPA ReviewDPO · AuditDPIADPO · TaskPrivacy Policy UpdateDPO · TaskOnboarding CheckDPO · AuditTOM InspectionDPO · AuditCloud AuditDPO · AuditISO 27001DPO · AuditTIACompliancePolicy ReviewComplianceWhistleblower IntakeComplianceQuarterly ReportIT SecurityVendor AssessmentIT SecurityIncident ReportIT SecurityAccess ReviewSafetyHazard AssessmentSafetySite Inspection+ 473 more
Officer as a service
Two ways to land on CIVAC.
Bring your own officers, or let us bring ours. Same platform, different hand on the wheel.
Self-serve.
Your internal officers own the work. CIVAC is their single workspace for tasks, trainings, audits and documentation. We stay out of your way.
€49per officer role / month
- Your officers, your data, your workflow
- Fastest time to value
- Full 905-template library included
Officers included.
We bring the officers too. Certified DPO, Compliance, IT Security or Occupational Safety professionals, embedded into your company and running CIVAC for you. You get the reports. We carry the work.
Individual pricingtailored per officer role
- Certified officers from the CIVAC team and partner network
- Direct reporting line to your leadership
- Custom engagement model per role
Faster · Cheaper · Smarter
What you save with CIVAC, in numbers.
Concrete bandwidth back into the business. Defensible numbers, no startup-cringe. Industry benchmarks plus our own field data.
Faster−80 %
Effort per audit
Mastersheet templates plus AI drafting collapse multi-day audit prep into hours.
Cheaper−40 %
Costs vs. separate appointments
One platform for all 77 officer mandates beats 77 individual external appointments.
Faster48 h
From request to appointed officer
CIVAC SLA: contract, person, Bestellurkunde within two business days, not 2-6 weeks.
Broader77 in 1
Officer roles, one workspace
Most providers cover one role. CIVAC covers every mandatory and sector-specific officer role Germany requires.
Internal benchmark vs. typical mid-market alternatives.
From the field
CIVAC moved our DPO work from crisis mode to routine. We stopped living in the last-minute Outlook scramble.
Data Protection Officer
SaaS company, 120 employees
3 weeks of audit prep, now 4 days.
Open the demo workspace
Start running compliance like a product.
Open the demo workspace in two minutes and see a full officer week - tasks, trainings, audits and documentation - laid out in front of you. Create an account and we activate your live workspace as soon as your role is confirmed.