COMPLIANCE AND RISK SOFTWARE
GDPR, EU AI Act and DORA compliance
for European organisations
Registers, assessments and evidence in one system, including what you owe after your AI system is live.
Covenance Engine
Post-market monitoring
Signed
FRIA locked
Open
Needs re-test
GDPR
DORA, ISO
Register
AI systems
Support triage
Annex III
CV screening
FRIA due
Customer chatbot
Art. 50
Which systems are in scope for Article 27?
3 of 12 need a fundamental rights assessment.
24 findings, folded into 3 issues
Article 72
Signed
Locked on approval
Open
Needs a re-test to close
a3f9…c210
Shown unchanged
Use cases
What are you trying to get done?
Pick the job you're stuck on. Each one shows the work, what you end up with, and which rules it covers.
GDPR
One place for your records, assessments, subject requests and breaches.
EU AI Act
List your AI, classify the risk, and keep watching it after launch.
DORA
Register of information, IT incidents, resilience tests and supplier oversight.
Run a DPIA
Screening, a draft from your own documents, and the DPO opinion attached.
Assess vendors & third parties
One supplier list feeding every framework that asks for one.
Prepare for an audit
Evidence that builds itself, and history you didn't have to reconstruct.
How it works
Start from the documents
you already have
Upload your policies, contracts and records. Covenance reads them and suggests the entries, the risks and the gaps. You approve what goes in.
Your documents
Covenance Engine
Compliance intelligence map
Organisation overview
6 departments · 4 frameworks · 164 activities
92%
74%
88%
56%
95%
68%
Platform
One place to see where you stand
Risk, evidence and what’s still open, across every framework you’re working to, in one view.
Risk Heatmap
DPIA Summary
In ProgressCustomer Analytics Pipeline
Legitimate Interest (Art. 6(1)(f))
Framework Coverage
Where we're different
Three things the big platforms don't do
The rights assessment nobody else runs
If you use certain high-risk AI, you may owe a fundamental rights assessment. We check whether you do, then run it. It locks and is signed once approved.
Read moreAI Act Article 72We keep watching after launch
Most tools stop at the assessment. Problems from live systems group into issues, and a fix can't be closed without evidence and a re-test.
Read moreBuilt for firms tooEvery client, properly separated
If you do this work for other organisations, each client's records stay apart, and onboarding, engagements and invoicing are in the same place.
Read moreIntegrations
Connect the tools you already use
Import policies, contracts and compliance data from the systems your team works in, and push remediation back out to them.
SharePoint
Policies & internal documents
Import policies and internal documentation, then extract the structure, clauses and obligations they contain.
Google Drive
Spreadsheets & shared files
Pull shared files and spreadsheets into document extraction, so existing registers become structured records.
Jira
Remediation tracking
Turn findings and control gaps into tracked issues in the workflow your engineering team already uses, with two-way reconciliation.
DocuSign
Contracts & e-signature
Sync envelopes, monitor signature status and link executed agreements to vendors, DPAs and controls.
GitHub
Repository analysis
Connect repositories so the Code Analyzer can review how personal data is handled in the codebase.
GitLab
Repository analysis
Same analysis as GitHub, including self-hosted instances, with automatic token refresh.
Slack
Alerts & notifications
Route deadline reminders, escalations and digests to the channel your compliance team works in.
Automatic parsing, classification and compliance mapping
That’s the complete list. We don’t show logos for connectors we haven't built. See what each one does.
Built for
European rules
Covenance was built for European rules from the start, not retrofitted from a US product. And if "hosted in Europe" has to mean all of it, we can do that properly, or run it inside your own network.
See how we host your dataHosted in Europe, or in your building
Our standard cloud runs in France. If your rules are stricter, we can keep everything in the EU, or run Covenance on your own hardware.
Regulatory-Native Design
Built around GDPR, the EU AI Act and DORA, not adapted from US compliance frameworks after the fact.
Your Data Stays Yours
Tenant isolation enforced in the data layer, configurable retention, full export, and an audit log behind every change.
See Covenance on your own data
Leave your email and we’ll arrange a time. Bringing the register or spreadsheet you use today makes the session far more useful.
What actually happens
- We walk through the product properly, not a slide deck
- You ask the awkward questions about your own situation
- We show you where Covenance fits, and where it doesn’t
- Nobody chases you afterwards
30 minutes
Long enough to be useful, short enough to fit your day
A real person
Someone who knows the regulations, not a script
Your calendar
Pick whatever time suits you
Takes about 30 seconds
No obligation. We'll get back to you within one business day.
Get out of the spreadsheets
Bring us the mess you have now. We'll show you what it looks like once it's in one place.