What CIVAC does

CIVAC, operated by the German private limited company CITO GmbH (registered Munich, operational HQ Hamburg), is a compliance management platform purpose-built for the German and EU Beauftragten (appointed officer) model. It sells a SaaS workspace covering all 77 statutory officer roles — Data Protection (DSB), IT Security (ISB/CISO), Compliance, Occupational Safety (SiFa), AML, ESG, Supply Chain (LkSG), and 66 sector-specific roles — supported by a library of 905 ready-to-run templates, an immutable append-only audit trail, AI-powered compliance checks, and a source-cited AI Q&A assistant for regulatory queries. The platform is built on Google Cloud Platform with EU-Frankfurt data residency and uses Vertex AI (Gemini, Embeddings, Document AI OCR) alongside Anthropic Claude on EU endpoints, with Cloudflare for edge delivery and Stripe for billing.

CIVAC generates revenue through three coordinated streams: a self-serve SaaS Tool License at €49 per officer role per month for companies using internal officers; a full-service Officer-as-a-Service subscription that bundles externally appointed certified officers (DPO, Compliance, IT Security, Occupational Safety) with platform access; and one-time professional services for setup, audits, and project work. The go-to-market is hybrid — self-serve sign-up via civac.de for the workspace, with inside sales and a vetted partner network handling Officer-as-a-Service engagements under a two-business-day appointment SLA. The primary target is the German Mittelstand (50–5,000 employees) across DACH and the broader EU, with secondary focus on regulated industries and international subsidiaries operating in Germany.

The company is founder-controlled (Sebastian von Johnston, Managing Director and co-founder), bootstrapped with no disclosed external funding, and is actively progressing through enterprise-grade certifications — ISO/IEC 27001:2022 Stage 1 complete with Stage 2 targeted Q4 2026, SOC 2 Type II observation opened May 2026, and EU AI Act compliance mapping in progress ahead of the August 2026 deadline. The platform reports 100% uptime over the prior 90 days and positions strict EU data residency, NIS-2 readiness, and German regulatory specificity as core market differentiators.

Name

CIVAC

Legal name

CITO GmbH

Website

https://civac.de

Company type

Private

Operating status

Operating

Short description

CIVAC, a CITO GmbH service, provides a German compliance SaaS workspace plus Officer-as-a-Service for managing all 77 statutory appointed-officer roles (DSB, IT Security, Compliance, SiFa) at mid-market DACH and EU companies.

Ownership category

akta.pro rank

Product category

Compliance Management Software

akta.pro primary industry

Governance, Risk & Compliance (GRC) Platforms (BPAEAPAA)

akta.pro secondary industries

Compliance Technology, GRC Platforms & Controls Automation Advisory (BPAHAFAO), Regulatory Change, Governance & Compliance Management (GRC) (FSACAJAK), Risk, Controls & Governance (GRC) Platforms (FSAFAOAG)

Keywords

• Compliance management software
• Regulatory compliance platform
• Officer-as-a-service
• Data protection officer services
• Audit-ready compliance workspace

Headquarters

HQ city

Hamburg

HQ country

Germany

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. Tool License (SaaS Workspace): Monthly or annual subscription to the CIVAC compliance workspace for internal officers. Includes 905 templates, audit trail, AI features, and documentation workflows. Customers license per officer role.
2. Officer-as-a-Service: Full-service offering including externally appointed certified officers (DPO, Compliance, IT Security, Occupational Safety) plus the platform. Officers are appointed in writing on behalf of customer, report to leadership. Individual pricing per officer role.
3. Platform Add-ons and Professional Services: One-time fees for setup, onboarding, and project-based services (audits, assessments, written opinions, policies, training materials). Additional export support beyond standard export function billed at time-and-materials rates.

Pricing tiers

Go-to-market motion2 records

Distribution channels3 records

Marketing channels4 records

Core offering

CIVAC provides a SaaS compliance management workspace combined with Officer-as-a-Service, enabling German and EU mid-market companies to appoint, manage, and document mandatory officer roles (e.g., Data Protection, IT Security, Compliance, Occupational Safety) across all 77 appointable mandates. Customers can either license the platform for internal officers at €49 per officer role per month, or engage CIVAC to appoint certified external officers who operate the same workspace on their behalf, with all audit evidence captured in an immutable audit trail.

Product overview

CIVAC is a German compliance management platform and Officer-as-a-Service provider offering two coordinated delivery models under one unified platform: (1) a self-serve tool license (€49 per officer role per month) for companies using their own appointed officers, and (2) a full-service Officer-as-a-Service offering that includes certified external officers plus the workspace. The core CIVAC Workspace provides six functional areas — Aufgaben (Tasks), Schulungen (Trainings), Audits, Dokumentation (Documentation), Fragen (AI Q&A), and Checks (AI Analysis) — covering all 77 German and EU appointable officer roles with 905 ready-to-use templates and an immutable audit trail. AI capabilities include five compliance check scanners, an AI Q&A assistant powered by Vertex AI Gemini, and automated document processing. All data is hosted exclusively in the EU (Frankfurt).

Differentiator

Problem solved

Functional benefit

Products and services

• CIVAC Workspace Centralized SaaS compliance platform for businesses needing to document and manage mandatory officer roles (DSB, ISB, SiFa, Compliance, etc.). Provides tasks, trainings, audits, documentation, AI-powered checks, and audit-ready evidence trails. Licensed per officer role per month for companies using their own internal officers.
• Officer-as-a-Service Full-service offering that supplies certified external officers (Data Protection Officer, Compliance Officer, IT Security Officer, Occupational Safety Specialist) plus the CIVAC platform. Officers are appointed in writing, report directly to customer leadership, and operate inside the shared workspace and evidence trail. Targeted at companies that need a qualified officer without a full-time hire.
• Setup, Onboarding, and Project Services One-time, project-based services covering platform setup, onboarding, audits, assessments, written opinions, policy documents, training materials, and additional export support. Sold as discrete deliverables or billed at time-and-materials rates for CIVAC customers.

Quantifiable outcome

• 80% reduction in audit preparation effort
• +3 more outcomes

Named customers1 record

Segments3 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability7 records

Feature6 records

Partnerships

Five partnerships are on record, tiered core.

• Google Cloud Platform (GCP)coreTechnology or Integration · 8 May 2026Primary cloud infrastructure provider hosting CIVAC platform. Data processed and stored exclusively in EU (Frankfurt region). Services used: Vertex AI Gemini (LLM inference), Vertex AI Embeddings (text vectorization), Document AI (OCR), Cloud Storage. Data residency guaranteed within EU. EU-US Data Privacy Framework applies for any US transfers.
• CloudflarecoreTechnology or Integration · 8 May 2026CDN and edge network provider for CIVAC platform. EU edge nodes used for content delivery and DDoS protection. Supports platform availability target of 99%.
• AnthropiccoreTechnology or Integration · 8 May 2026AI infrastructure partner providing Claude AI capabilities through EU regional endpoints. Used for AI compliance agent and intelligent document processing within CIVAC workspace.
• StripecoreTechnology or Integration · 8 May 2026Payment processing provider for platform subscriptions and Officer-as-a-Service billing. Operated from Ireland. Handles recurring billing (annual platform fees, monthly officer service fees) and one-time charges.
• CIVAC Partner Network (Officer Suppliers)coreImplementation/ SI/ Consulting PartnerVetted network of certified appointed officers (DPO, Compliance, IT Security, Occupational Safety professionals) supplying Officer-as-a-Service. Officers embedded into customer companies, report to leadership, step into same workspace and evidence trail. Network ensures continuity if assigned officer leaves.

Scale indicators5 records

Recent moves6 records

Expansion highlights5 records

Broad incumbents

• OneTrust: OneTrust is a global privacy, security and GRC platform widely used for GDPR/DSGVO programs, consent management and data protection officer workflows. It competes with CIVAC in the EU privacy and broader GRC stack, though it is much broader in scope and serves global enterprises rather than focusing on the German Beauftragten model.
• Workiva: Workiva is an established GRC, ESG and regulatory reporting platform widely used for SOX, ESG/CSRD and audit-grade documentation. Comparable to CIVAC in delivering audit-ready compliance documentation and evidence management, though at a much larger enterprise scale and without the German officer-as-a-Service focus.
• Diligent (Galvanize / HighBond): Diligent's HighBond platform (formerly Galvanize / ACL) is an enterprise GRC suite covering risk, compliance, audit and ESG. Comparable to CIVAC in the audit-evidence and controls-management layer, though Diligent targets large enterprises and boards rather than German Mittelstand officer mandates.

Emerging players

• Vanta: Vanta is a leading compliance automation platform focused on SOC 2, ISO 27001, HIPAA and adjacent frameworks. It targets fast-growing tech companies and overlaps with CIVAC in automating audit evidence, control monitoring and continuous compliance, though without the German-officer and Officer-as-a-Service layer.
• Drata: Drata is a compliance automation platform automating SOC 2, ISO 27001, HIPAA, GDPR and other frameworks via continuous control monitoring. It is comparable to CIVAC on the audit-readiness automation axis and on serving mid-market compliance buyers, but lacks the German regulatory specialization and managed-services layer.
• Secureframe: Secureframe automates compliance for SOC 2, ISO 27001, HIPAA, PCI and similar frameworks, combining software with guided onboarding and optional managed services. Comparable to CIVAC in pairing a self-serve compliance SaaS with human-assisted delivery, though oriented to US tech/SaaS rather than EU officer statutes.
• LogicGate: LogicGate offers a flexible GRC workflow platform (Risk Cloud) for risk, compliance and policy management. It overlaps with CIVAC's template-driven compliance workflows and audit documentation, but lacks the German officer statute specialization and managed-services bundle.

Direct peers

• Dataguard (DataGuard): DataGuard is a Berlin-based privacy and compliance platform offering DPO-as-a-Service, EU representative services and compliance software to European mid-market companies. It is the closest direct competitor to CIVAC, operating an almost identical combination of self-serve SaaS and certified external DPO/officer services for the German and EU Mittelstand.
• HeyData (formerly Heydealer): HeyData is a German compliance SaaS focused on data protection, IT security and ISO 27001 for SMBs and Mittelstand. Comparable to CIVAC in selling subscription compliance software to German companies with limited internal compliance capacity, though with less emphasis on the full-service officer appointment model.

Others

• KPMG / EY / PwC / Deloitte (Big 4 GRC advisory practices): Big 4 advisory firms operate large German compliance, DPO outsourcing and GRC implementation practices serving Mittelstand and large enterprises. They are comparable to CIVAC on the Officer-as-a-Service side (outsourced DPO, compliance officer, IT security officer) but rely on manual advisory delivery rather than a software-first platform model.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks5 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/civacde

Compliance7 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about CIVAC