EU-sovereign AIfor compliance
AI from Germany or your own server speeds up compliance work. No data goes to US AI providers. Use them to draft policies, answer audit questions and model threats.
What you get
- EU-sovereign AI from German data centers
- Audit assistant with sources
- Policy drafts
- STRIDE threat modeling
- No need for a US cloud
- Optional on your own servers with a local model
Features at a glance
AI workflows built for compliance. The AI runs in Germany or on your premises, with no US provider involved.
Audit Assistant with Sources (RAG)
Ask the assistant any audit question. It builds the answer from your own policies, controls and evidence.
Policy Generator
Get first drafts of policies. They fit your context, the frameworks you chose and the tone of your company.
STRIDE Threat Modeling
Run a STRIDE check, a set list of attack types, on your system design and data flow diagrams. You also get ideas on how to reduce each threat.
Framework Translator
Map controls from one framework to another. For example, ISO 27001 to NIS2, SOC 2 to BSI IT-Grundschutz and more.
Control Gap Finder
Find the controls you still lack. The tool looks at your assets, your risk register and where your compliance stands now.
Document Summarization
Turn long policies, contracts and audit reports into short, clear briefs that executives can read fast.
Your benefits
AI only speeds up compliance if it keeps your data safe. The models run in Germany or on your own server. There is no US cloud involved, and each AI call is logged for audits.
- No data leaks to outside providers
- Fits GDPR, Schrems II and NIS2
- Faster policy drafts and audit answers
- Each prompt and answer is logged for audits
- Optional on your own servers, even with no outside link
Use cases
Audit Q&A
Auditors ask about controls and evidence. The assistant answers and names the source documents.
New policy roll-out
Draft new policies in minutes. The drafts fit your framework and context.
Threat modeling workshop
Start STRIDE sessions with a first list of threats and fixes that the AI drafts for you.
Framework change absorption
When a standard changes, the framework translator marks the controls it hits. It also suggests new ones.
How AI Automation works in practice
You choose where the AI features of SecTepe.Core run: at IONOS in German data centers, on SecTepe GPU servers or, if you run Core on-prem, on your own GPU server. No US provider is involved in any case.
How the audit assistant finds its answers
The assistant only searches your own records. Core stores your policies, controls, evidence, risks and audit findings as vectors. These are strings of numbers that let the AI find text by meaning. The search never leaves your tenant. The assistant takes the best matches and asks the model for an answer with citations.
- A citation can only point to a source the search really found. Core drops any other reference.
- Each answer gets a confidence score that shows how sure it is. If the score is too low, the assistant says there is not enough evidence.
- Cached answers are stored per tenant. Two tenants never share an answer.
Typical scenarios
- Policy drafts: You pick a policy type and describe your company, such as its size, industry and frameworks. The AI plans the sections first, then writes each one. The draft goes into the normal approval workflow. It is never published on its own.
- Threat models: You describe a system in plain text. The AI splits it into components, data flows and trust boundaries. Then it lists STRIDE threats for each component. Your team reviews them in the threat model.
- Control mapping: You describe a control. Core suggests which requirements of your enabled frameworks it covers. Each match comes with a reason.
- Security questionnaires: The AI drafts answers from your policies, controls and evidence. Answers with low confidence stay blank, so your team writes them by hand.
Operation and control
You decide how much the AI may do on its own. Each feature has one of three modes: suggest, auto with review, or auto. Admins can change the mode per tenant or turn a feature off. Some features always stay in suggest mode, such as policy drafts. A person stays accountable for those results.
Core logs every AI call. The log holds the input, the output, the confidence, the version of the instructions (prompt) and the model. Reviewers can trace each step later.
Common questions
Can the AI see data from other customers? No. Search, cache and logs are all bound to your tenant.
What happens if the AI service is down? Some features keep working without the model. The Excel catalog import then maps columns with fixed rules.
Ready for sovereign AI automation?
Book a personal demo. See how SecTepe.Core brings EU-sovereign AI to your compliance team.
How we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.
Common questions
We hear these questions most often in a first call. For anything else, write to hello@sectepe.de or give us a call.
- How do we start working with SecTepe?
- Every project starts with a free first call. Then you get an offer with scope, timeline and result. If you like, we start small with a pilot. That way you get to know us before the real work starts.
- What company sizes and sectors do you support?
- We work for small and mid-sized firms, for parts of large groups and for operators of critical infrastructure (KRITIS). Often that means industry, trades, health, banks, energy and public bodies. Our focus is mid-sized firms in Germany, Austria and Switzerland.
- Do you work on site, remotely or hybrid?
- Both. Reviews, advice and most services run remotely from German data centers. For workshops, training and emergencies we come to you, mainly in North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
- Which standards and regulations do you cover?
- We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
- How do you protect the confidentiality of my data?
- By contract and by technology. Before every project, both sides sign a non-disclosure agreement. Your data stays in German data centers. Every access needs a second login factor and is checked one by one. Our whole team is bound to secrecy by contract and under the GDPR.