01
Master data
Set up group structure, entities, processes (XLSX import supported).
Empower CRA Tool
AI-powered Compliance Risk Assessment
Multi-tenant SaaS productized from 20+ years of consulting. Claude-driven, EU-AI-Act-ready, Hetzner-hosted in Germany.
Architectural pillars
Hetzner
Hosted in Germany
GDPR
PII stripped before AI calls
EU AI Act
Two-stage questionnaire
DICO
Risk categories
COSO
Mapped during AI scoring
Multi-Tenant
RBAC with 6 roles
01 · Workflow
Six steps to the risk matrix
02
Questionnaire
DICO 3.0 or your own questionnaire, A/B/C structure, evidence requirements.
03
Scoring
Probability × impact, sub-criteria weighting, AI per-block rationales.
04
Scoping
Which entities at which depth — AI recommendation with manual override.
05
Assessment
Multi-user responses with file attachments and department assignment.
06
Reporting
PDF · XLSX · PPTX · DOCX. Async via Celery, audit-grade.
02 · Features
Six core capabilities
AI Risk Analysis
Claude-powered per-block rationales
Exposure · Signals · Controls — as advisory with audit trail. Never auto-overwrite.
EU AI Act
Two-stage questionnaire workflow
Screening → CO triage → deep-dive analysis → final classification with mitigation plan.
Permanent Screening
Living risk map
Web search + LLM event detection. Alerts instead of Excel graveyards. Dedicated Celery worker.
Multi-Tenant
Group-ready with RBAC
6 roles: tenant_admin, compliance_officer, local_compliance, function_owner, action_owner, reviewer_audit.
Reporting
PDF · XLSX · PPTX · DOCX
Async via Celery. WeasyPrint, openpyxl, python-pptx, python-docx. Audit-grade.
GDPR · Hosting
Hetzner · Caddy · Made in Germany
PII stripped before AI calls. Multi-tenant isolation via ContextVar.
03 · Tech stack
Production-grade architecture
Backend: FastAPI · PostgreSQL 16 · Celery · Redis. Frontend: React 18 · TypeScript · Vite · Tailwind. Infra: Docker · nginx · Caddy. AI: Anthropic Claude API with PII redaction.
- FastAPI 0.115+
- React 18 + Vite
- PostgreSQL 16
- Celery 5.4 + Redis 7
- Claude API (Anthropic)
- Docker + Caddy + Hetzner
04 · Demo
See the tool in action
30-minute live demo through the 6-step wizard, AI scoring and multi-format reports. We show you how Compliance Risk Assessment scales with AI.
05 · FAQ
Frequently asked
Where is the data stored?+
Entirely on Hetzner servers in Germany. Multi-tenant isolation via tenant_id filtering. PII is stripped before any AI call.
Which AI do you use?+
Anthropic Claude (claude-opus + claude-sonnet) in advisory mode — AI recommendations are never auto-applied, every accept/reject requires a mandatory rationale.
How is the tool licensed?+
SaaS subscription per tenant. Pricing on request — we calibrate based on group size, number of entities and module selection. Request a demo for a no-commitment conversation.
Can you provide the tool on-premise?+
Yes. A Docker-Compose setup is available. We support on-premise rollouts including migration.
Which EU AI Act risk levels does the tool support?+
All four: prohibited · high-risk · limited · minimal — plus GPAI. Two-stage questionnaire with screening, CO triage and deep-dive analysis.