SecTepe.Core– ISMS, GRC & Compliance in one place
SecTepe.Core is a self-hosted platform built in the EU. It covers compliance, your information security management system (ISMS) and risk management. It brings AI-powered automation, eIDAS signatures and full control over your data. It helps mid-sized and large firms with NIS2, GDPR, ISO 27001:2022, BSI IT-Grundschutz, SOC 2, HIPAA and PCI DSS.
Request a demoSupported frameworks
- NIS2
- GDPR
- ISO 27001:2022
- BSI IT-Grundschutz
- SOC 2
- HIPAA
- PCI DSS
- DORA
Modules & core capabilities
All you need for compliance, ISMS and security work. In one platform.
Multi-framework assessments
Automated gap analyses, maturity models and roadmap generation for all supported frameworks.
Learn moreISMS management
Asset lifecycle, risk register, policy management, control monitoring and audit collaboration.
Learn moreAI automation
Policy generation, a RAG audit assistant and STRIDE threat modeling. Fully self-hostable, with no external AI providers.
Learn moreEnterprise authentication
WebAuthn/FIDO2 hardware keys, SAML 2.0 / OIDC SSO, MFA, eIDAS-compliant digital signatures.
Learn moreWhite-label trust center
A self-hosted public compliance portal with custom domains, status pages and a certificate showcase.
Learn moreThreat intelligence & CTI
Malware analysis suite with YARA, Capa, ClamAV, MWDB and AssemblyLine. Includes MISP and OpenCTI integration.
Learn moreOnlyOffice collaboration
Edit documents together in real time, with versioning and a complete audit trail. GDPR-compliant and on-premise.
Learn moreFramework change management
Detects framework updates automatically, analyzes their impact and starts reassessment workflows.
Learn moreSupplier & vendor portal
Structured third-party risk management with self-service questionnaires and evidence upload.
Learn moreTechnology & architecture
SecTepe.Core runs on a modern, cloud-native stack. You can deploy it with Docker or with Kubernetes (Helm). Run it on your own servers or in your private cloud.
- • Frontend: React 19 + TypeScript, Tailwind CSS
- • Backend: Node.js / Express, PostgreSQL (Prisma ORM)
- • Storage: MinIO (S3-compatible), Redis caching
- • Security: Helmet, CSP, rate limiting, hardened CORS
- • Integrations: ServiceNow, Jira, Confluence, Odoo, HubSpot, AWS, Azure, GCP
Why SecTepe.Core?
- ✓Data sovereignty: 100% EU hosting. You do not depend on a US cloud.
- ✓Cost advantage: Often well below Vanta / Drata, depending on users and modules.
- ✓No vendor lock-in: Open APIs, export formats and open-source core parts.
- ✓EU-native AI: AI runs via IONOS in German data centers, optionally on-prem. No data leaks to US providers.
How the SecTepe.Core modules work together
All modules run in one application with one database. They share users, roles and tenant data. So a risk, a control, a policy document and a task live side by side and can point to each other.
One identity for every module
- Users sign in once. Core supports passwords with TOTP, WebAuthn/FIDO2 passkeys, and SSO via SAML 2.0 or OIDC.
- SSO can create accounts on first login. An LDAP or Active Directory import maps groups to roles and syncs on a schedule.
- Roles decide what each person may do. Your plan and license decide which modules a tenant can use.
- Tasks from assessments, risks, findings, vulnerabilities and GDPR requests share one task model. Each task keeps a link to the module it came from.
Operation
You run SecTepe.Core yourself. It ships as a Docker Compose stack and as a Helm chart for Kubernetes. Terraform files cover IONOS Managed Kubernetes. Core can also run in air-gapped networks. The stack brings PostgreSQL, Redis, MinIO, ClamAV and OnlyOffice. Backups of PostgreSQL and MinIO are encrypted.
Core checks its own setup at startup. In production it will not start if login is switched off. It also stops if a key secret still holds a placeholder value.
Data sovereignty
Each record belongs to exactly one tenant. Files sit in MinIO under that tenant. AI features use models hosted at IONOS in the EU. Core refuses to start if you set any other AI provider. Core can encrypt single data fields, and a scheduled job rotates the keys. Fonts are self-hosted and a strict Content Security Policy is in place. Audit logs come with integrity checks.
Common questions
Can one installation serve several companies? Yes. Core is multi-tenant with strict isolation. Each tenant can have its own subdomain or custom host. Consultants and MSPs can manage several tenants.
Can other tools connect to Core? Yes. The REST API is documented with OpenAPI. A tenant admin creates service-account API keys. Each key is limited to one tenant and to its role. Core stores only a hash of the key. An MCP server lets AI agents use the same API with such a key.
Which languages does the interface support? German and English.
Ready for compliance by design?
Talk to us about SecTepe.Core. We show you how to move your ISMS and compliance work forward.
Book a free demoHow we work with you
We see every project as a long-term partnership, not a one-off delivery. Our approach has four clear phases. So you always know what happens next, who is in charge of what and which results to expect.
1. Free initial conversation
We learn about your starting point, your goals and your constraints. In 30 to 45 minutes we check whether our offer fits your situation. We outline possible paths and answer your questions, with no obligation.
2. Structured assessment
We record the current state: technical, organizational and regulatory. You get a prioritized assessment that names strengths, gaps and areas for action. It is the basis for a reliable offer.
3. Delivery with a dedicated lead
An experienced lead guides you through the delivery. You get clear milestones, transparent planning of effort and cost, and a weekly status. All results are documented and belong to you.
4. Continuous operations & review
After the project, we stay with you in operations. This includes managed services, regular reviews and tracking of open actions. We also reach out when new threats, new rules or technology changes come up.
Frequently asked questions about our services
These are the questions we hear most often in first conversations. For anything else, reach our team at hello@sectepe.de or by phone.
- How do we start working with SecTepe?
- Every project starts with a free initial conversation. You then get an offer with a clear scope, timeline and outcome. If you like, we start with a small pilot. That way you get to know how we work before the full project begins.
- What company sizes and sectors do you support?
- We work with small and mid-sized businesses, with corporate divisions and with operators of critical infrastructure (KRITIS). Our core sectors are manufacturing, trades, healthcare, financial services, energy and the public sector. Our focus is the mid-market in the DACH region.
- Do you work on site, remotely or hybrid?
- Both. Assessments, consulting and most managed services run remotely from our German data centers. For workshops, training and incident response on site, we mainly cover North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
- Which standards and regulations do you cover?
- We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
- How do you protect the confidentiality of my data?
- We secure confidentiality by contract and by technology. Before every project we sign a mutual non-disclosure agreement. We process data only in German data centers. Access runs through zero-trust rules with multi-factor authentication. All staff are bound to confidentiality by contract and under the GDPR.