Athereon GRC is a modular cloud platform for governance, risk and compliance. Its modules cover information security management (ISMS), business continuity management, data protection management, risk management and supplier risk. Organisations use it to structure standards and regulations such as ISO 27001, TISAX, NIS2, DORA, the EU AI Act and BSI IT-Grundschutz, to track tasks and evidence and to prepare audits. The platform is delivered as SaaS, can be connected through a REST API and also includes AI assistance.
Athereon GRC GmbH is headquartered in Saarbrücken, Germany, and has developed the product there since 2018. According to the vendor, customer data is stored exclusively in Germany, in the Open Telekom Cloud, which is also where the daily backups are kept. No foreign parent company was found, so direct exposure to the US CLOUD Act through ownership has not been established. No self-hosted edition or open-source code is mentioned. For European organisations that want sensitive compliance data to stay inside the EU, this is a hosted option from Germany.