# Veritise

> Veritise is an EU-native agentic GRC platform that drafts EU AI Act, GDPR, and ISAE 3402 compliance work for European SMEs — every output reviewed and signed by certified compliance specialists before delivery. Operated by Veritise ApS, Copenhagen (CVR 46279050).

Veritise is a joint venture between Horaizon (engineering, London) and RiskEnable (risk and compliance consultancy, Copenhagen). The platform replaces checklist-style compliance software for European SMEs that need to prove EU compliance without standing up a dedicated compliance team.

Last reviewed: 2026-08-27.

---

## Home

### Hero

**Audit-grade compliance. Priced for SMEs.**

Automation handles the heavy lifting (frameworks, policies, controls, vendors, and a customer-facing trust centre) and a certified compliance specialist stands behind every output. So you can get back to building.

### Launch offer (1 July 2026 onwards)

To celebrate the official launch, Veritise is offering a free AI risk assessment to qualifying SMEs from 1 July 2026. Contact info@veritise.dk to start.

### What you get out of Veritise

Built for European teams that have to prove compliance to someone, without a compliance department or a five-figure GRC contract.

- **Audit-grade. Every output.** A certified compliance specialist is involved from kickoff to delivery; automation drafts and maintains the work, the expert shapes and signs it. What you ship is audit-ready, not a first draft.
- **One platform. Every answer.** Frameworks, controls, policies, procedures, audits, vendors, and your customer-facing trust centre in one place. Your buyer's diligence questionnaire becomes a single link.
- **Regulation, tracked.** The EU AI Act, GDPR, and NIS 2 keep moving. Veritise tracks the changes; your documents and controls update with them.
- **Priced for SMEs.** Enterprise GRC platforms assume a five-figure annual contract and a compliance team to run it. Veritise is built for European teams that have neither.

### Platform

**Assess risks. Prove compliance. Build trust publicly.**

One platform for the three things every EU-exposed business has to do: assess AI and data risk, generate the documents that prove it, and publish the result where your customers can see it. One platform, eight connected capabilities, every compliance answer in one place.

**Eight connected capabilities:**

1. **Frameworks** (automated). Maps your assurance frameworks end-to-end (ISAE 3402 I and II, ISAE 3000 I and II shipping, ISO 27001 coming soon, NIS 2) and keeps coverage current as standards evolve.
2. **Controls** (automated). Drafts your control library, monitors it against your live systems, and surfaces drift before it matters.
3. **Policies** (automated). Generates policies tailored to your business and keeps them under live version control.
4. **Procedures** (automated). Turns policy into operational runbooks with named owners and clear, executable steps.
5. **EU AI Act assessment** (AI). A context-aware AI agent reads your platform, documents, and live website to produce an assessment specific to your business. Includes GDPR, DPIA, risk register.
6. **Vendors** (automated, beta). Connects you to a Veritise-verified global registry; review work is shared, not duplicated.
7. **Audits** (automated, coming soon). Bundles evidence into audit-ready packages your external auditor can drop into a data room.
8. **Trust Centre** (public). An embeddable widget that sits inside your own site, in your own branding. Buyers and security reviewers self-serve your compliance proof. Updates itself as your posture changes. Included in every subscription.

### Trust Centre on your own domain

The Veritise Trust Centre is an embeddable widget that lives inside your existing site, in your own branding, showing your live compliance status. It shortens enterprise security reviews, builds buyer trust without a sales call, auto-updates as your posture changes, and is included in every subscription (not a paid add-on, not gated behind a higher tier).

**What it displays:** ISAE 3402 Type I and II, EU AI Act risk classifications and model cards, GDPR records of processing, published policies, vendor and sub-processor register. Additional frameworks can be added as you certify against them.

### How it works (automation does the work, experts stand behind it)

A Veritise run, end-to-end. A certified compliance specialist is involved from scoping through sign-off. Automation drafts and maintains the work in between, so what you ship is audit-ready, not a first draft.

1. **Scoping and onboarding (with a specialist).** A certified compliance specialist scopes the engagement with you: frameworks, obligations, deliverables.
2. **Framework selected.** EU AI Act, GDPR, ISAE 3402.
3. **Controls created.** The framework spine.
4. **Tasks, policies, procedures, assessments drafted.** Automation drafts each output from your framework controls.
5. **Expert review.** The same specialist who scoped the engagement reviews and signs every output.
6. **Audit-ready.** Deliverables ready.

### EU-native vs US-built GRC

Other tools in this space are excellent US-built GRC platforms; most have shipped agentic AI in 2025 and 2026. Veritise is the European-SME alternative: deeper on assurance and EU regulation, certified compliance specialists in every step, and a subscription priced for teams without a five-figure enterprise contract.

For detailed named comparisons see /alternatives/vanta and /alternatives/drata.

**Where it was built**
- US-built GRC platforms: US-first; SOC 2 and ISO 27001 at the core, EU frameworks added as the catalogue grew.
- Legacy GRC suites: configured per engagement; consultant-driven.
- Veritise: EU-native. EU AI Act, GDPR, ISAE 3402, NIS 2 at the core.

**ISAE 3402 assurance**
- US-built GRC platforms: not on the major published framework catalogues.
- Legacy GRC suites: available via consulting engagement.
- Veritise: native. Type I and Type II controls.

**EU AI Act assessment**
- US-built GRC platforms: available via framework templates and AI-assisted workflows.
- Legacy GRC suites: consultant-led mapping.
- Veritise: context-aware AI agent that pulls from your platform, documents, and website.

**Expert review of outputs**
- US-built GRC platforms: self-serve platform; auditors and consulting via partner networks, billed separately.
- Legacy GRC suites: in-house compliance team or external consultants.
- Veritise: included. Certified compliance specialists are involved in every step.

**Customer-facing trust centre**
- US-built GRC platforms: standalone product page (included in higher tiers or as a paid add-on).
- Legacy GRC suites: not typically offered.
- Veritise: included. Embeddable widget on your own site.

**Framework strategy**
- US-built GRC platforms: breadth. Wide US and EU framework catalogues.
- Legacy GRC suites: custom per engagement.
- Veritise: depth. EU-specific frameworks, end-to-end.

### Who Veritise is for

Built for the person who actually has to ship the answer.

- **Founders and CEOs.** Close enterprise deals and pass investor diligence without hiring a compliance lead.
- **Compliance managers.** Produce the documents and evidence your auditors and customers ask for, without living in spreadsheets.
- **CTOs and tech leads.** Get your AI systems EU AI Act-ready before procurement, regulators, or your own customers ask the question.

### FAQ

**What is Veritise?**
Veritise is a risk and compliance platform for any business that operates in the EU or serves EU customers. It combines EU AI Act risk assessments, compliance document generation, and an embeddable trust centre into one subscription, helping you meet the EU AI Act, GDPR, and the data protection requirements your customers and regulators ask about.

**Who is Veritise designed for?**
Any business with EU operations or EU customers, whether you are based in the EU or outside it. If you deploy AI systems, handle personal data of EU residents, or need to demonstrate compliance to EU regulators, clients, or partners, Veritise is designed for you.

**What is the EU AI Act?**
The EU AI Act is European legislation that regulates the development and use of artificial intelligence systems within the EU. It introduces mandatory requirements around risk assessment, transparency, documentation, and governance for AI systems placed on the EU market. Compliance deadlines are staggered between 2025 and 2027.

**How does Veritise help with data protection compliance?**
Veritise generates essential data protection documents including privacy policies, data processing records, risk assessments, and internal controls. These are aligned with GDPR and EU data protection standards and structured to satisfy regulatory review.

**How is Veritise different from other GRC tools?**
Other GRC platforms in this space are excellent; most are US-built with broad framework catalogues. Veritise is the EU-native alternative for teams whose primary obligations are EU frameworks (EU AI Act, GDPR, NIS 2) and assurance reporting (ISAE 3402 today, ISAE 3000 shipping), with two specific differences: certified compliance specialists are involved in every step as part of the subscription rather than billed separately through a partner network; and the trust centre is an embeddable widget inside your own site rather than a standalone product page.

**What does the Trust Centre do?**
The Veritise Trust Centre is an embeddable widget you add to your own website. It displays your live compliance status, policies, certifications, and security posture to visitors and prospective customers, building trust before they even contact you.

**Is there a free trial?**
To celebrate the official launch of Veritise, we are offering a free AI risk assessment to qualifying SMEs from 1 July 2026. Email info@veritise.dk to get started. We also run a 20-minute guided demo so you can see your own use case mapped to the platform before you commit.

---

## Pricing

Veritise publishes prices across two categories: recurring SaaS subscriptions and one-off professional-services engagements. Full pricing page at https://veritise.io/pricing.

### Subscription plans (monthly, per organisation)

- **Trust Centre Package.** 600 DKK / €79 / £69 per month. Base fee. Includes the EU AI Act assessment in-platform, embeddable Trust Centre widget on your own domain, vendor module, compliance dashboard, and AI-assisted document generation.
- **Full Suite Package.** 3,000 DKK / €399 / £349 per month. Base fee. Everything in Trust Centre Package plus frameworks (ISAE 3402, ISAE 3000, ISO 27001) with full controls library, and managed vendor due diligence.
- **Custom Plan.** Bespoke scope, priced on request. Everything in Full Suite plus a custom framework mix, dedicated compliance specialist, and rollout support.

### One-off engagements (professional services)

- **ISAE 3402 readiness engagement.** 30,000 DKK excluding VAT. One-off setup that gets a service organisation audit-ready for an ISAE 3402 Type I or Type II report. Runs four to five weeks on average from discovery to auditor handoff. Final price may depend on organisation size and how much of the compliance environment is already in place — scope is confirmed on a 30-minute discovery call before any work starts. Full page: https://veritise.io/isae-3402. **Requires the Full Suite subscription** — the platform is where the environment lives and where the Type II observation period is sustained.

Invoicing is in DKK; EUR and GBP amounts are reference conversions shown for buyer clarity. Prices exclude VAT. Contact info@veritise.dk to book a scoping call.

---

## ISAE 3402 readiness engagement (https://veritise.io/isae-3402)

Dedicated commercial page for buyers looking to become ISAE 3402 audit-ready. Distinct from the informational resources under /resources/isae-3402/*, which explain the standard itself.

### The offer

Veritise builds the ISAE 3402 environment (controls, evidence, policies, procedures, walkthrough documentation) on the customer's Veritise Full Suite subscription. The customer's team operates the environment day to day; an external audit firm tests it and signs the ISAE 3402 report. Veritise never signs the report — the standard is designed that way; a service organisation cannot audit itself.

**Published price:** 30,000 DKK excluding VAT. One-off engagement fee.

**Requires:** the Veritise Full Suite subscription (3,000 DKK / €399 / £349 per month) — the platform is where the environment lives and where the Type II observation period is sustained.

### The delivery

Setup runs four to five weeks on average, in three phases:

1. **Discovery.** Thirty-minute call to map services in scope, the SOC 1 work, ROPA, and security controls the customer already has, and the audit firm that will run the engagement. Scope, price, and timeline are agreed in writing by end of call.
2. **Build.** Missing controls built, policies drafted, evidence-collection scaffolding set up on Full Suite. Existing Full Suite work (GDPR, security, vendors) is aligned around the ISAE 3402 environment. A certified compliance specialist signs off every artefact before it reaches the customer.
3. **Handoff.** Environment goes live on Full Suite; customer's team operates from day one. Veritise briefs the audit firm on how it was built and stays on call through their fieldwork.

Timeline may extend if the customer is starting from a thin evidence base — that is flagged on the discovery call so nothing surprises later.

### Five work products delivered

1. Control library mapped one-to-one to the ISAE 3402 control objectives the auditor tests.
2. Evidence-collection scaffolding on Full Suite so the Type II observation period runs on its own rails.
3. Policies and procedures — one per in-scope control, drafted for the customer's product and team, signed off by a certified compliance specialist.
4. Walkthrough documentation written in the format the audit firm reads.
5. Remediation plan for control gaps surfaced during Discovery, ordered by priority and effort.

### Why the price sits at 30,000 DKK

Traditional Big-Four readiness engagements for a mid-market SaaS run 150,000 to 400,000 DKK (roughly £15k–£45k, €20k–€55k) — that is what it costs when the provider rebuilds the control environment from scratch and bills every hour of it. Veritise reuses existing SOC 1 work, GDPR posture, prior policies, and security controls already in place. Two variables move the number: how many services are in scope, and how much of the environment is already documented. See the full comparison at https://veritise.io/resources/isae-3402/vs-traditional-readiness.

### Who this is not for

- Organisations that need a SOC 1 report (that is the AICPA standard, tested by a different auditor).
- Organisations that expect the readiness provider to also sign the assurance report (that is not how ISAE 3402 works).
- Organisations that need controls documented on paper but no continuous evidence collection — a template library is cheaper than a Full Suite subscription.
- Complex financial-services groups that need multiple standards (SOC 1, ISAE 3402, ISAE 3000) produced together with a Big-Four brand on the deliverable.

---

## Resources

A library of plain-language resources on the regulations and frameworks European SMEs operate under. Index at https://veritise.io/resources. Each topic is a hub with a canonical definition plus practical guides, comparisons, and (for the EU AI Act) a long-form article.

### EU AI Act (https://veritise.io/resources/eu-ai-act)

The EU AI Act is the European Union's horizontal regulation on artificial intelligence, in force since 1 August 2024 (20 days after publication in the Official Journal on 12 July 2024). It classifies AI systems by risk tier and imposes obligations on providers, deployers, importers, and distributors that touch the EU market.

**Timeline (Article 113):**
- 2 February 2025: prohibited AI practices (Chapter II) became applicable.
- 2 August 2025: GPAI obligations (Chapter V), governance bodies, and the penalty framework became applicable.
- 2 August 2026: the bulk of obligations for high-risk AI systems (Chapter III, Title II onwards) become applicable.
- 2 August 2027: remaining obligations including those for Annex I product-safety AI systems.

**Four risk tiers (Articles 5, 6, 50):**
- Unacceptable risk (Article 5): prohibited outright. Eight categories including subliminal/manipulative techniques, vulnerability exploitation, social scoring, predictive policing based on profiling or personality traits, facial-image database scraping, emotion recognition in workplaces and education, biometric categorisation by sensitive attributes, real-time remote biometric ID by law enforcement.
- High risk (Article 6 plus Annex III): permitted but heavily regulated. Annex III catches eight use cases including employment, education, credit scoring, biometric identification, critical infrastructure, law enforcement.
- Limited risk (Article 50): transparency obligations only. AI-system interaction notice, synthetic content labelling, deepfake disclosure, public-interest AI-text disclosure.
- Minimal risk: no specific obligations.

**Penalties (Article 99):** up to €35 million or 7% of global annual turnover for prohibited practices; €15 million or 3% for non-compliance with other obligations; €7.5 million or 1% for incorrect information to regulators. SMEs and start-ups: cap is the lower of the absolute amount or the percentage.

**GPAI (Article 51):** systemic-risk threshold is 10^25 FLOPs at training time. Most SMEs are downstream deployers, not GPAI providers. Substantial-modification fine-tuning of a third-party model inherits downstream provider obligations.

**Sub-resources under this topic:**
- /resources/eu-ai-act/definition: full definition with scope and penalties.
- /resources/eu-ai-act/risk-levels: the four tiers explained with 11 worked classification examples for SME product types (CV screening, performance evaluation, credit scoring, chatbots, generative AI, recommendation engines, dev tooling, internal RAG, biometric authentication, sentiment analysis).
- /resources/eu-ai-act/timeline: full enforcement timeline 2024 to 2027.
- /resources/eu-ai-act/gpai-obligations: what Chapter V means for SMEs using OpenAI, Anthropic, Mistral, or open-weights models.
- /resources/eu-ai-act/sme-guide: long-form (2,750-word) practical guide by Lukas Benic, Co-founder, Veritise. Covers the two SME failure modes (denial and over-engineering) and a five-step starting plan.

### GDPR (https://veritise.io/resources/gdpr)

The General Data Protection Regulation (Regulation (EU) 2016/679) is the European Union's data protection law, in force since 25 May 2018. Article 3 sets its extraterritorial reach: processing in the context of an EU establishment, plus any non-EU controller or processor offering goods or services to people in the EU or monitoring their behaviour within the EU.

**Penalty tiers:** lower tier up to €10 million or 2% of global turnover (organisational obligations such as recordkeeping); upper tier up to €20 million or 4% (core principles, data subject rights, international transfer rules). Cumulative fines since 2018 have exceeded €4 billion.

**Core obligations:** lawfulness (legal basis), purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability. Plus Record of Processing Activities (Article 30), Data Processing Agreement (Article 28), Data Protection Impact Assessment for high-risk processing (Article 35), breach notification within 72 hours, lawful international transfer mechanism (Chapter V).

**Sub-resources:**
- /resources/gdpr/definition.
- /resources/gdpr/ropa: Records of Processing Activities, Article 30. The small-organisation exemption (fewer than 250 employees) is almost always overridden.
- /resources/gdpr/dpa: Data Processing Agreement, Article 28. Mandatory clauses, sub-processor mechanics, SCC interaction.
- /resources/gdpr/dpia-vs-dpa: the two GDPR documents commonly confused in procurement. DPA is a contract; DPIA is an internal high-risk-processing assessment.
- /resources/gdpr/international-transfers: adequacy decisions (15+ countries plus the US Data Privacy Framework adopted 10 July 2023), Standard Contractual Clauses (Implementing Decision (EU) 2021/914 adopted 4 June 2021), Schrems II (case C-311/18, judgment 16 July 2020), Transfer Impact Assessments and supplementary measures.

### ISAE 3402 (https://veritise.io/resources/isae-3402)

ISAE 3402 is the international assurance standard for reporting on controls at a service organisation, issued by the International Auditing and Assurance Standards Board (IAASB). It is the SOC 1 equivalent used outside the United States, most commonly required when a service organisation processes data that materially affects the financial reporting of its customers.

**Type I vs Type II:**
- Type I: design of controls at a point in time. The auditor confirms controls exist and are suitably designed as of one date.
- Type II: operating effectiveness over a period (typically six to twelve months). The auditor selects samples across the period and tests whether controls operated as designed throughout.

**Common trigger services:** payroll, hosted accounting, transaction processing, fund administration, claims handling, custody, treasury, outsourced financial close.

**ISAE 3402 is not on the published framework catalogue of most US-built GRC platforms.** European procurement teams ask for ISAE 3402 specifically because that is the standard their auditors test against.

**Sub-resources:**
- /resources/isae-3402/definition.
- /resources/isae-3402/type-i-vs-type-ii: the two report variants compared.
- /resources/isae-3402/when-you-need-one: trigger industries, timeline from first ask to delivery (typically 8 to 14 months for a Type II).
- /resources/isae-3402/evidence-collection: walkthrough testing, detailed testing and sampling, complementary user entity controls (CUECs), common failure modes.
- /resources/isae-3402/vs-traditional-readiness: honest comparison of a Veritise readiness engagement (30,000 DKK) vs a traditional Big-Four quote (150,000 to 400,000 DKK). When each model fits. Same standard, different delivery.

### NIS 2 (https://veritise.io/resources/nis-2)

NIS 2 is Directive (EU) 2022/2555, the European Union's second-generation cybersecurity directive. It expanded the original NIS Directive to a much wider set of sectors and entities. Transposition deadline: 17 October 2024. Important: NIS 2 is a Directive (not a Regulation like GDPR or the EU AI Act), so the operational rulebook in each country is the national transposition act, which differs between member states.

**Two entity classes:**
- Essential entities (Annex I sectors): proactive supervision including ex ante inspections. Fines up to €10 million or 2% of global turnover.
- Important entities (Annex II sectors): supervised ex post. Fines up to €7 million or 1.4% of global turnover.

**Annex I (essential) sectors (11):** energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration, space.

**Annex II (important) sectors (7):** postal and courier, waste management, chemicals, food, manufacturing, digital providers (marketplaces, search engines, social networks), research.

**Size threshold:** medium-sized or larger per Commission Recommendation 2003/361/EC. Practical floor: 50+ employees brings you in scope unconditionally; below 50 employees, you are in scope only if both annual turnover and annual balance sheet total exceed €10 million.

**Entities regardless of size (Article 2(2) and 2(3)):** DNS service providers (excluding root name servers), top-level domain registries, trust service providers (qualified and non-qualified under eIDAS Regulation (EU) 910/2014), providers of public electronic communications networks and services, sole providers in a member state of essential services, entities whose disruption could significantly impact public safety/security/health, entities identified as critical entities under Directive (EU) 2022/2557 (the CER Directive), and central government public administration.

**Incident reporting (Article 23):** 24-hour early warning, 72-hour notification, one-month final report.

**Management body accountability (Article 20):** governing bodies must approve cybersecurity risk measures, oversee implementation, follow training. National transpositions vary on personal liability (Germany NIS2UmsuCG, Italy Decreto Legislativo 138/2024, Belgium Loi du 26 avril 2024, Netherlands Cyberbeveiligingswet are all examples of how member states have extended or detailed the directive floor).

**Sub-resources:**
- /resources/nis-2/definition.
- /resources/nis-2/sectors-in-scope: Annex I and II, the size threshold with worked edge case, the regardless-of-size categories, national transposition variation.
- /resources/nis-2/24-hour-reporting: the three-stage Article 23 reporting timeline.
- /resources/nis-2/management-liability: Article 20 governance, training, personal liability under national transpositions.

### ISO 27001 (https://veritise.io/resources/iso-27001)

ISO/IEC 27001 is the international standard for an information security management system (ISMS). It is the certification European enterprise procurement most commonly asks software vendors for, and the framework most NIS 2 entities use to demonstrate alignment with the Article 21 cybersecurity measures.

**2022 revision:** Annex A restructured to 93 controls in four themes (organisational 37, people 8, physical 14, technological 34), down from 114 controls in the 2013 version. The management system clauses (4 through 10) are largely unchanged. Transition deadline for organisations on the 2013 version: October 2025.

**11 new controls in the 2022 revision:** Threat intelligence (5.7), Information security for use of cloud services (5.23), ICT readiness for business continuity (5.30), Physical security monitoring (7.4), Configuration management (8.9), Information deletion (8.10), Data masking (8.11), Data leakage prevention (8.12), Monitoring activities (8.16), Web filtering (8.23), Secure coding (8.28).

**Certification path:** gap assessment (optional), ISMS implementation (6 to 12 months for orgs starting fresh), internal audit and management review, Stage 1 audit (documentation, 1 to 3 days for an SME), Stage 2 audit (operational, 2 to 10 days), certificate valid 3 years with annual surveillance, full recertification in year 3.

**Sub-resources:**
- /resources/iso-27001/definition.
- /resources/iso-27001/annex-a-controls: the 93 controls, the four themes, the 11 new controls in 2022, the Statement of Applicability.
- /resources/iso-27001/certification-path: gap assessment to recertification, picking a certification body (must be accredited under IAF MLA).
- /resources/iso-27001/iso-27001-vs-soc-2: the comparison European buyers ask about. Geographic recognition split, certified vs attested, Type I vs Type II, NIS 2 conformance acceptance.

### Agentic GRC (https://veritise.io/resources/agentic-grc)

A category of governance, risk, and compliance software in which AI agents read a customer's product, documents, and operational context, then draft and maintain the compliance work end-to-end. The defining property is autonomy: agents act, not just retrieve.

The category test: does the platform produce primary work product (drafted policies, drafted assessments, drafted documentation) that a human reviews and signs, or does it only summarise and retrieve existing work product? Chat-over-a-control-library is retrieval, not agency.

Real implementations keep a certified human in the loop. The agent drafts; the expert reviews and signs. Regulators and auditors require attributable authorship; an unsigned AI output does not stand up to audit.

**Sub-resources:**
- /resources/agentic-grc/definition.
- /resources/agentic-grc/vs-checklist-grc: the structural difference, where the practitioner time goes, the chatbot-bolted-on trap.
- /resources/agentic-grc/expert-in-the-loop: the regulatory requirement for attributable authorship; bundled-expert vs partner-network billing.
- /resources/agentic-grc/the-review-chain: Veritise's five-step engagement workflow from kickoff to continuous monitoring.

### Trust Centre (https://veritise.io/resources/trust-centre)

The customer-facing surface where a software vendor exposes its certifications, policies, sub-processors, and live compliance posture to prospects, customers, and their auditors. The modern Trust Centre replaces emailed PDF security questionnaires.

**Hosted vs embedded:** hosted Trust Centres run on a third-party platform under a vendor.com/trust subdomain (SafeBase, Whistic, Conveyor). Embedded Trust Centres run inside the vendor's own site in the vendor's own branding. Veritise ships an embeddable widget.

**What it exposes (in order of buyer-check frequency):** ISO 27001 certificate or SOC 2 Type II report, sub-processor list with country of processing, GDPR readiness statement and DPA terms, most recent penetration test date, live monitoring status, breach history, security contact route.

**Standard questionnaire frameworks buyers use** (these are independent of Veritise; Veritise is a GRC system in its own right, not a routing layer for third-party questionnaire formats): SIG (Shared Assessments), CAIQ (Cloud Security Alliance), ISO 27036 supplier questionnaires, bank-specific templates derived from EBA outsourcing guidance. A Trust Centre that publishes the underlying compliance answers covers what these questionnaires ask, regardless of which format the buyer arrives with.

**Sub-resources:**
- /resources/trust-centre/definition.
- /resources/trust-centre/embedded-vs-hosted: visitor flow, SEO and indexation, brand consistency, maintenance burden.
- /resources/trust-centre/what-it-exposes: the buyer checklist in priority order.
- /resources/trust-centre/replaces-security-questionnaires: the pre and post-Trust-Centre procurement workflow.

---

## About

**Built by compliance experts and the engineers who automate the busywork.**

Veritise is a joint venture between Horaizon and RiskEnable. We combine engineering capability with specialist risk and compliance expertise to build a platform that understands both the technology and the regulation.

### Horaizon (Engineering and Technology)

Horaizon is a technology and engineering company specialising in product development and automation. We build the systems that power Veritise's risk assessment engine, document generation, and platform infrastructure.

- Location: London, United Kingdom
- Website: https://www.horaizon.co.uk/
- LinkedIn: https://www.linkedin.com/company/horaizonltd

### RiskEnable (Risk and Compliance)

RiskEnable is a risk and compliance consultancy with deep expertise in EU regulation, data protection, and governance frameworks. As a founding partner of Veritise, RiskEnable contributes the methodology and assurance standards that the in-house Veritise specialist team applies when reviewing every assessment, document, and framework before delivery.

- Location: Copenhagen, Denmark
- Website: https://riskenable.dk/

### Why we built Veritise

We built Veritise because we saw a gap in the market. SMEs with EU operations or EU customers face growing compliance obligations (the EU AI Act, GDPR, NIS 2, and beyond) but the tools available were either built for large enterprises or did not exist at all. Veritise fills that gap: serious compliance capability that builds trust, at a price and complexity level that works for SMEs.

---

## Veritise vs Vanta (https://veritise.io/alternatives/vanta)

(The named alternatives pages are the sanctioned place for direct competitor comparisons. Full content lives at the URL above.)

Vanta is an excellent US-built GRC platform with its own AI agents (Agentic Trust Platform with AI Agent 2.0, launched at VantaCon 2025 on November 19, 2025) and one of the widest framework catalogues in the category. Veritise is the EU-native alternative for European SMEs whose primary obligations are the EU AI Act and ISAE 3402.

### When Vanta is still the right call

- SOC 2 Type II is your most important framework.
- You sell into US enterprise procurement asking for SOC 2 or ISO 27001 by name.
- You need the broadest framework catalogue (SOC 2, ISO 27001, HIPAA, PCI DSS, FedRAMP, etc.).
- You have an internal compliance lead or external GRC consulting partner to operate the platform.

### When to choose Veritise

- The EU AI Act is a real obligation.
- You need ISAE 3402 Type I or Type II (not on Vanta's published framework list).
- You want certified expert involvement throughout the engagement, included in the subscription rather than purchased separately through Vanta's auditor partner network.
- You want a trust centre that embeds as a widget inside your own site rather than living as a standalone product page (Vanta's Trust Center is included from the Plus tier upward, with advanced features as a paid add-on).

---

## Veritise vs Drata (https://veritise.io/alternatives/drata)

(The named alternatives pages are the sanctioned place for direct competitor comparisons. Full content lives at the URL above.)

Drata is an excellent US-built GRC platform with its own agentic AI (Agentic TPRM Assessment GA, Agentic Questionnaire Response beta, and AI Trust Center Creation, launched at RSA 2026 on March 24, 2026) and one of the broadest framework catalogues in the category. Drata's trust centre is powered by SafeBase, which Drata acquired for $250M in February 2025. Veritise is the EU-native alternative.

### When Drata is still the right call

- You need to certify against many frameworks in parallel. Drata's published catalogue includes SOC 2, ISO 27001, ISO 42001, HIPAA, PCI DSS, NIS 2, GDPR, and many more.
- ISO 42001 is the AI framework your customers ask for, rather than the EU AI Act by name.
- You value a deep integration catalogue and SafeBase-powered trust centre.

### When to choose Veritise

- Your obligation is the EU AI Act specifically (Drata covers AI governance through ISO 42001, but does not list the EU AI Act by name on its public framework catalogue today).
- You need ISAE 3402 Type I or Type II (not on Drata's published framework catalogue either).
- You want expert involvement in every step, included in the subscription.

---

## Legal entity

- Company: Veritise ApS
- CVR-nr.: 46279050
- Registered address: Brannersvej 7, 1. th., 2920 Charlottenlund, Denmark
- Founded: 2026-02-23
- Registry: https://datacvr.virk.dk/enhed/virksomhed/46279050
- LinkedIn: https://www.linkedin.com/company/veritiseaps/
- Wikidata: https://www.wikidata.org/wiki/Q139859160
- Crunchbase: https://www.crunchbase.com/organization/veritise-bf2d
- Joint venture: Horaizon (London) and RiskEnable (Copenhagen)

## Regulatory and framework coverage

Primary positioning. The three regulations Veritise leads with:

- **EU AI Act.** Risk classifications, model cards, transparency records, post-market monitoring.
- **GDPR.** Data protection policies, ROPAs, DPAs, risk assessments, internal controls.
- **NIS 2.** Covered in the regulatory horizon scanning.

Assurance and advisory:

- **ISAE 3402.** Type I and Type II controls; framework end-to-end.
- **ISAE 3000.** Type I and Type II controls (shipping).
- **ISO 27001.** Information security management (certification support coming soon).
- **Cybersecurity controls.** Controls library and evidence, integrated with EU AI Act assessments.

## Contact

- Email: info@veritise.dk
- Website: https://veritise.io
- Platform (logged-in): https://app.veritise.dk
- LinkedIn: https://www.linkedin.com/company/veritiseaps/
- Horaizon (technology partner): London, UK. https://www.horaizon.co.uk/
- RiskEnable (compliance partner): Copenhagen, Denmark. https://riskenable.dk/