StartComply
vs Centraleyes
Why do European SMBs choose StartComply?
- Go live in a day. We scope the platform on a call and configure it for you. That work is inside the price, and most customers are running before the week is out.
- Keep the whole programme inside Europe. EU-only hosting under Greek and EU ownership, no US parent and no CLOUD Act. Your team and your suppliers work in seven European languages.
- Pay for nothing you will never use. We cover NIS2, DORA, ISO 27001:2022, GDPR and IMO. There is no SOC 2 engine underneath that you fund, configure and work around.
100+ European organisations · No credit card, no sales maze
Should you choose StartComply or Centraleyes?
If you need FAIR dollar reporting for a board and manage hundreds of vendors, buy Centraleyes. We mean that. If your deadline says NIS2, DORA or ISO 27001:2022, four things decide it.
NIS2 and DORA are the product, not a mapping
Open an incident and the clocks start counting: 24 hours, 72 hours, one month. Your DORA register of information sits on the vendor record, with the Article 30 clauses tracked contract by contract.
Centraleyes covers NIS2 and DORA as mapped frameworks, and its Greek NIS2 self-assessment mirroring the national authority’s tool deserves real credit. A self-assessment is still a questionnaire: our research found no register generation and no incident clocks behind it.
Vendor risk is included, and so is the scan
Registry, tiering, questionnaires, continuous monitoring and offboarding come with every plan. So does active external vulnerability scanning of your own domain and of every vendor domain you track, run on our own engine.
Centraleyes’ vendor module is genuinely deep, and it is metered by vendor count, so the bill grows with your supplier list. Its vendor intelligence is a threat feed; for scanning, its own pages point you to license Qualys, Tenable or Rapid7 separately.
The price is on our website
€4,500 a year for each framework you are regulated against, plus €1,500 for the third-party risk and external scanning module. That is the list price on our own website, implementation included. It follows the frameworks you actually need, not your entity count or your vendor count. Extra user packs are the only add-on.
Centraleyes publishes no prices and no verified estimate exists in the public record. The model meters frameworks in one module and vendor count in the other, with premium support reported near 15 percent of the licence.
You get a security team, not a support queue
StartComply is built and run by TicTac, an Athens security firm doing incident response, forensics and audits since 1999. The people who answer your call are the people who wrote the control mappings.
Centraleyes runs on a lean team of roughly 21 people, nine years in market, with its last disclosed funding in December 2021. Capable people, thin bench. Behind StartComply stands a working incident response firm in continuous operation since 1999.
The features StartComply has that Centraleyes doesn’t
Twenty-nine capabilities, checked against both products in July 2026. 3 of them go the other way, and they are in the list too. Use the toggle to strip out everything we both do and leave only the lines where the choice is actually made.
| Capability |  StartComply |
 Centraleyes |
|---|---|---|
| European regulatory mechanics | ||
| NIS2 24h, 72h and one month incident clocks | ||
| DORA register of information | ||
| DORA Article 30 contract clause tracking | ||
| ISO 27001:2022 | In the library | |
| GDPR | In the library | |
| IMO maritime cyber | ||
| SOC 2 | In the library | |
| HIPAA, PCI DSS, NYDFS, SOX | In the library | |
| Third-party risk management | ||
| TPRM included without a vendor-count meter | Metered by vendors | |
| Vendor registry and risk tiering | ||
| Risk-tiered questionnaires with automated distribution | ||
| FAIR dollar quantification of risk | ||
| Continuous vendor monitoring in the base price | Threat feed | |
| External vulnerability scanning of vendor domains | ||
| External scanning of your own domain | ||
| Fourth party and subcontractor visibility | ||
| Structured vendor offboarding | ||
| Commercials | ||
| Pricing published on the website | ||
| Implementation included in the price | Fast, cost not stated | |
| Price does not scale with entity or vendor count | Meters vendor count | |
| Operational in hours to days | ||
| Sovereignty and language | ||
| EU-only data residency by default | ||
| EU-owned, outside US CLOUD Act reach | ||
| Seven live EU language interfaces | ||
| Platform and ecosystem | ||
| Documented integration catalogue | Thin catalogue | |
| AI risk register and AI governance module | Narrower | |
| Contract lifecycle management | ||
| Independent review base | ||
| In-house MSSP and incident response team behind the product | ||
Compiled July 2026 from both vendors’ public documentation and pricing pages and third-party sources. Centraleyes publishes no price list and no verified third-party estimate exists, so this page quotes no number for it. Where a capability could not be evidenced in a vendor’s own documentation we recorded it as absent rather than assuming it exists. Corrections are welcome and we will publish them.
Both sides of all 20 criteria on one screen
The same 20 criteria we apply to every vendor in our 68-platform market study, side by side. What we offer, what Centraleyes offers, and who takes the point. Nothing hidden, including the 4 Centraleyes wins.
| # | Criterion | StartComply |
Centraleyes |
Point to |
|---|---|---|---|---|
| 01 | TPRM in the base product | Core module included in the base at every tier, with no vendor-count metering. | One of the deeper TPRM modules in the mid-market: contract lifecycle management, smart questionnaires and threat-intel monitoring, metered by vendor count. | Centraleyes |
| 02 | Independent analyst and peer ratings | No independent review footprint yet. We launched in 2026 and review bases take years to build. | Roughly two Capterra reviews in nine years, no current G2 base and no confirmed analyst presence. | Draw |
| 03 | Native EU regulatory mechanics | NIS2 24 hour, 72 hour and one month incident clocks, a DORA ICT register of information, Article 30 clause tracking, GDPR and IMO, all as working product. | DORA and NIS2 as mapped frameworks in a 100-plus library, plus a notable Greek NIS2 self-assessment; no register generation or incident clocks evidenced. | StartComply |
| 04 | Framework breadth | A deliberately focused set: NIS2, DORA, ISO 27001:2022, GDPR and IMO. Nothing outside Europe. | More than 100 frameworks marketed, around 50 cross-mapped: the NIST family, ISO, CIS, CMMC, PCI DSS, SOC 1 and 2, HIPAA, SOX, NYDFS, TISAX and DORA. | Centraleyes |
| 05 | Questionnaire automation | Control-mapped, risk tiered questionnaires with automated distribution and reminders. | Strong: pre-loaded smart questionnaires with answer-once cross-framework mapping. | Centraleyes |
| 06 | Continuous vendor monitoring in the base price | Continuous cyber, compliance and financial signals with live risk score updates, included at every tier. | A threat intelligence feed with event triggers; the scanning itself arrives via recommended third-party integrations. | StartComply |
| 07 | External vendor domain scanning | Active external vulnerability scanning of your own domain and every vendor domain, included as standard, first party. | No engine of its own; its pages recommend integrating Qualys, Tenable or Rapid7, licensed separately. | StartComply |
| 08 | AI and automation engine | An AI engine for gap analysis, remediation suggestions and policy work. Narrower in scope. | An AI risk register since 2025, an AI governance module in 2026, and FAIR-based dollar quantification via a proprietary loss calculator. | Centraleyes |
| 09 | Integrations and public API | No public integration catalogue or API documentation at the time of research. | A modest documented set: AWS CloudTrail, Azure, Qualys, Rapid7 and Tenable; the catalogue is thin and not fully published. | Draw |
| 10 | Pricing transparency | Published: €4,500 a year per framework and €1,500 for the third-party risk module, implementation included. | No public prices; metered by frameworks and vendor count, with premium support reported near 15 percent of the licence. | StartComply |
| 11 | Total cost at SMB scale | €10,500 a year for two frameworks plus third-party risk, implementation included. | No verified estimate exists; generic anchors place modern GRC platforms at USD 10,000 to 100,000 a year. | StartComply |
| 12 | EU data residency and jurisdiction | EU-only hosting under Greek and EU ownership, with no US parent and therefore no CLOUD Act pathway. | A US entity with US hosting and no EU residency option advertised. | StartComply |
| 13 | Platform polish and UX maturity | A modern interface on a young product, less battle tested at scale. | A mature feature set; reviewers note preset reporting limits and UI slowness between sections. | Draw |
| 14 | Security practitioners behind the product | Built and operated by TicTac, a working MSSP and incident response firm running since 1999. | A lean team of roughly 21 people, nine years in market, with R&D roots in Tel Aviv. | StartComply |
| 15 | Implementation and onboarding | Configuration done by us, included in the subscription, with no implementation fees. | No-code deployment in days, with single-day onboarding reported by reviewers. | Draw |
| 16 | Support model | Direct support from the product team, included. Optional vCISO from the same bench, never mandatory. | Responsive support, with a GRC-as-a-Service managed option on top. | Draw |
| 17 | Localisation | Seven live EU language interfaces, with localised policies and questionnaires. | English first; the Greek NIS2 content lives inside an English-language platform. | StartComply |
| 18 | Scale and customer proof | More than 100 European organisations, vendor stated, plus Cyber Security Awards 2026 recognition. | Customer roster not published; no independent scale figures confirmed. | Draw |
| 19 | Deployment speed | Hours to days, with same day configuration possible. | Days, with single-day onboarding reported; genuinely fast as well. | Draw |
| 20 | Fit for EU SMBs | Purpose built for European organisations of roughly 20 to 1,000 people under NIS2, DORA, ISO 27001:2022 or GDPR. | Built for mid-market and enterprise cyber GRC teams managing 100-plus vendors with US and global frameworks. | StartComply |
Final tally: 9 StartComply, 7 draws, 4 Centraleyes. Centraleyes wins the criteria that reward its own centre of gravity. We win the criteria that decide whether a European SMB can actually buy, deploy and afford the thing.
How to read the draws. This pairing has an unusually high number of them, because both products are capable and both market footprints are thin. The separation comes from structure: where the data lives, what is metered, and whether EU regulation is operated or assessed.
What each one actually costs you
The honest comparison is what a documented vendor risk programme costs, and what happens to that number when your vendor list grows. Ours is published and flat. Theirs is quote-only and metered.
Three-year total for a third-party risk programme, 30 vendors
No framework certification work in this scope. Ours is the published price of the module that does exactly this, and it does not change with vendor count. Centraleyes does not publish prices, so its bar is the bottom of the public third-party range, and its vendor risk module is metered.
Reading notes: each bar uses the currency that vendor quotes in, euro and US dollar, plotted on one numeric axis for illustration only. No conversion is applied. Our figure is our published list price: the third-party risk and external vulnerability assessment module at €1,500 a year, flat whether you track 30 vendors or 100, with no implementation fee and no per-seat charge. Centraleyes pricing is quote-only, with unverified third-party ranges of USD 10,000 to USD 100,000 a year, so three years runs from roughly USD 30,000 to USD 300,000 depending on scope. The bar shows the bottom of that range. Its vendor risk module is metered, so the bill rises as vendors are added, and its vendor intelligence comes from threat feeds and scanner integrations rather than a native scanning engine. Its hosting spans Israel, the United States and the European Union, with no EU-only option offered. External audit and certification fees sit outside both numbers. Validate both against written quotes for your own scope, including year two.
What our customers say
Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.Maria Papadopoulos, CISO, financial services
The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.Thomas Müller, Compliance Manager, insurance
We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.Elena Kowalski, Data Protection Officer, technology
We consider joining Centraleyes. Why should we choose StartComply?
There is a straight answer, and it depends on two things: how big you are, and which regulation is actually binding you.
If you are one of the thousands of European SMBs facing NIS2 and DORA
Then you are not Centraleyes’s buyer, and paying for a platform whose EU regulation is mapped on top is the expensive way to fail an inspection.
You need the 24 and 72 hour incident clocks, the DORA register of information, Article 30 clause tracking, vendor risk and external scanning in the price, evidence that stays in the EU, and artefacts in the language your auditor reads. That is the entire product. €4,500 a year per framework, published, live in a day.
If you are a US-facing organisation wanting FAIR reporting across 100+ vendors
Buy Centraleyes. Its third-party module is genuinely deep: contract lifecycle management, answer-once cross-mapped questionnaires, threat-intelligence monitoring, and FAIR-based dollar quantification that speaks the language of a board. Its 100-plus framework library covers SOC 2, HIPAA, PCI DSS, NYDFS and CMMC.
Probe the corporate side before a multi-year commitment: a team of roughly 21, about USD 2.8 million in disclosed funding, and a last disclosed round in December 2021.
And if you sit in both worlds, a group whose global risk function wants FAIR reporting while its EU subsidiaries face NIS2 and DORA, the group can keep Centraleyes for Boardview and US obligations while the EU entities run StartComply for the clocks, the register, Article 30 tracking and supplier scanning, with that evidence resident in the EU where the group platform cannot place it. For a standalone EU SMB, running two GRC platforms doubles the work; choose one.
Compare us with the rest
Same 20 criteria, same honesty, one competitor at a time.
How we compiled this. Both platforms were assessed against the same 20 criteria we apply to every vendor in the TPRM Platform Landscape 2026, using vendor documentation and pricing pages, company announcements, G2 and Gartner Peer Insights review data, Forrester’s GRC Platforms Wave, and third-party contract price data, gathered in July 2026. Centraleyes figures marked as estimates are public third-party figures published in the absence of an official price list. Where a capability could not be evidenced in a vendor’s own documentation we recorded it as absent rather than assuming it exists. If we got something wrong, write to us and we will correct it publicly.
Centraleyes is a trademark of CyGov Ltd. All product names, logos and brands are the property of their respective owners. Their use here is for identification only and implies no affiliation or endorsement. Last updated July 2026.