We're building the platform
we wished we'd had.

If you have ever supported the appointment of an internal officer (whether for data protection, IT security, occupational safety, anti-money-laundering or any of the twenty-five other mandatory roles), you know how it really works. The contract is signed, the Bestellurkunde is filed, and from that moment on the officer has personal liability under German law. What follows is, in most companies, a quiet panic: a shared drive, a few Excel trackers, a calendar full of recurring deadlines, and a documentation effort that is genuinely revisited only when an audit appears on the horizon.

We have lived this from both sides. As advisors stepping into mid-market companies and inheriting the inevitable tab soup, and as operators trying to make a single appointed role functional in a real organisation. What frustrated us was never the regulatory work itself. It was the gap between the seriousness of the mandate and the tooling people were actually using to fulfil it.

So we built CIVAC.

Not as another GRC suite for Konzern-level governance, and not as another lightweight GDPR PDF generator. CIVAC is the operating system for the German Beauftragten model: the workspace, the templates, the audit trail, the AI agent, and where companies prefer it, the bestellte officer themselves. The same platform whether you license the workspace for your internal team or appoint ours, the same evidence trail an inspector will recognise.

We believe this matters because the mandate matters. Every appointed officer signs for personal liability under § 130 OWiG, § 38 BDSG, § 5 ASiG and a dozen other statutes. The least our profession deserves is a platform that takes that responsibility as seriously as the law does.

Better officer work doesn't require longer audit weeks. It requires better tools.

That's what CIVAC is here to be.

Sebastian Johnston

Co-Founder, CIVAC