SecTepe.Core– ISMS, GRC & Compliance in one place
SecTepe.Core is a self-hosted platform built in the EU. It covers compliance, your information security management system (ISMS) and risk management. It brings AI-powered automation, eIDAS signatures and full control over your data. It helps mid-sized and large firms with NIS2, GDPR, ISO 27001:2022, BSI IT-Grundschutz, SOC 2, HIPAA and PCI DSS.
Request a demoSupported frameworks
- NIS2
- GDPR
- ISO 27001:2022
- BSI IT-Grundschutz
- SOC 2
- HIPAA
- PCI DSS
- DORA
Modules & core capabilities
All you need for compliance, ISMS and security work. In one platform.
Multi-framework assessments
See where you stand and what is missing, automatically. With a maturity model and a roadmap for each supported standard.
Learn moreISMS management
Assets over their whole lifecycle, a risk register, policies and controls under constant watch. You work on audits together.
Learn moreAI automation
AI drafts policies, answers audit questions from your own documents and helps with threat modeling. You choose where the AI runs: at IONOS, on our GPU servers or on your own.
Learn moreSecure login & signatures
FIDO2 hardware keys, single sign-on via SAML 2.0 or OIDC, multi-factor login and eIDAS digital signatures.
Learn moreWhite-label trust center
Your public compliance portal on your own domain. With status pages and an overview of your certificates. You run it yourself.
Learn moreThreat intelligence & CTI
Malware analysis with detection rules, a virus scanner and a malware archive. Includes links to threat intelligence databases and our own knowledge graph.
Learn moreOnline office
Edit documents together in real time, with versions and a complete audit trail. GDPR-compliant and on your own servers.
Learn moreFramework change management
Reports when a framework changes. Shows the impact and guides you through the reassessment.
Learn moreSupplier & vendor portal
Manage supplier risk in a set way. Suppliers fill out questionnaires themselves and upload proof.
Learn moreMore about SecTepe.Core
Technology & architecture
SecTepe.Core has a modern, cloud-native design. It runs in containers or on Kubernetes. Run it on your own servers or in your private cloud.
- • Interface: a modern web app in your browser
- • Server and database: proven open-source building blocks
- • Storage: S3-compatible file storage and a fast cache
- • Security: security headers, Content Security Policy, rate limiting, strict CORS rules
- • Integrations: ServiceNow, Jira, Confluence, Odoo, HubSpot, AWS, Azure, Google Cloud
Why SecTepe.Core?
- ✓Data sovereignty: 100% EU hosting. You do not depend on a US cloud.
- ✓Cost advantage: Often well below Vanta / Drata, depending on users and modules.
- ✓No vendor lock-in: Open APIs, export formats and open-source core parts.
- ✓AI from Germany: The AI runs at IONOS in German data centers, on SecTepe GPU servers or, if you run Core on-prem, on your own GPU server. No data goes to US providers.
How the SecTepe.Core modules work together
All modules run in one application with one database. They share users, roles and tenant data. So a risk, a control, a policy and a task sit side by side. Each one can point to the others.
One login for every module
- Users sign in once. Core supports passwords with one-time codes, FIDO2 passkeys and single sign-on via SAML 2.0 or OIDC.
- With single sign-on, Core creates the account at first login. An import from LDAP or Active Directory maps groups to roles. It syncs on a schedule.
- Roles decide what each person may do. Your plan and license decide which modules a tenant can use.
- Tasks from assessments, risks, findings, vulnerabilities and GDPR requests land in one shared task list. Each task links back to the module it came from.
Operation
You run SecTepe.Core yourself. It ships as a container package and as a package for Kubernetes. Ready-made scripts set it up on IONOS Managed Kubernetes. Core also runs in networks with no internet access. It brings its own database, cache, file storage, virus scanner and online office. Backups of the database and file storage are encrypted.
Core checks its own setup at startup. In production it will not start if login is switched off. It also stops if a key or password is still set to a placeholder.
Data sovereignty
Each record belongs to exactly one tenant. Files sit in the file storage of that tenant. The AI runs at IONOS in German data centers, on SecTepe GPU servers or, if you run Core on-prem, on your own GPU server. Core can encrypt single data fields. Core swaps the keys on a schedule. Fonts come from your own server. A strict Content Security Policy limits what the browser may load. No one can change the audit logs unnoticed.
Common questions
Can one installation serve several companies? Yes. Core keeps tenants strictly apart. Each tenant can have its own subdomain or domain. Consultants and IT service providers (MSPs) can manage several tenants.
Can other systems connect to Core? Yes. Core has a documented REST API. A tenant admin creates API keys for service accounts. Each key works for one tenant and one role only. Core stores only a fingerprint (hash) of the key. AI agents use the same API with such a key, via the Model Context Protocol (MCP).
Which languages does the interface support? German and English.
Ready for compliance by design?
Talk to us about SecTepe.Core. We show you how to move your ISMS and compliance work forward.
Book a free demoHow we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.
Common questions
We hear these questions most often in a first call. For anything else, write to hello@sectepe.de or give us a call.
- How do we start working with SecTepe?
- Every project starts with a free first call. Then you get an offer with scope, timeline and result. If you like, we start small with a pilot. That way you get to know us before the real work starts.
- What company sizes and sectors do you support?
- We work for small and mid-sized firms, for parts of large groups and for operators of critical infrastructure (KRITIS). Often that means industry, trades, health, banks, energy and public bodies. Our focus is mid-sized firms in Germany, Austria and Switzerland.
- Do you work on site, remotely or hybrid?
- Both. Reviews, advice and most services run remotely from German data centers. For workshops, training and emergencies we come to you, mainly in North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
- Which standards and regulations do you cover?
- We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
- How do you protect the confidentiality of my data?
- By contract and by technology. Before every project, both sides sign a non-disclosure agreement. Your data stays in German data centers. Every access needs a second login factor and is checked one by one. Our whole team is bound to secrecy by contract and under the GDPR.