Deadlines are computed, not remembered.
Reviews, contract dates, test dates and incident reports become dated obligations with an owner. Reminders and escalations go out on schedule.
DORA COMPLIANCE PLATFORM
Run DORA from one workspace.
Training, registers, incidents, testing and third parties in one place. Deadlines run themselves. Every step leaves evidence your auditor can verify.
Evidence is generated, not assembled.
Every export carries its source, extraction time, filters, record count and hash. You hand over a package, not a folder of screenshots.
You start with content, not empty screens.
Reviewed starter risks, assets and obligation templates are there on day one. You confirm and adjust instead of typing from zero.
What is covered
The whole regulation, not one chapter.
Manage ICT risk, report incidents, test resilience, control third parties, train your people. Dora Check has a module for each, and they share one data model. A provider in the register is the same provider on the incident and on the asset.
TRAINING · DORA ART. 13(6)
Train everyone. The proof arrives on its own.
Pick a course and a cycle. Invitations, reminders and the next round run without you. When the last person finishes, the proof record is in your mailbox.
- Quiz with a fixed pass mark, stored per participant.
- Failure rate per question, without exposing who answered what.
- Courses carry their language, so each team gets the right version.
OBLIGATIONS · ALL ARTICLES
A compliance calendar that does the chasing.
Each recurring duty has an owner, a cadence, a due date and an evidence requirement. Reminders and escalations are sent on schedule, and the log shows that they were.
- Policy reviews, contract dates, risk reviews, test dates and inventory reviews land in the same calendar.
- Completion needs a note, and evidence where you require it.
- Template updates are announced, never applied silently.
ICT RISK · DORA ART. 5-16
A risk register the board will read.
Score each risk by impact and likelihood, attach measures, and see the heatmap. The board report is drafted from the register and waits for your review.
- Starter risks, reviewed and ready to confirm.
- Review dates run through the obligation calendar.
- Risks link to the assets and providers they concern.
ICT ASSETS · DORA ART. 8
Know what you run, and what depends on it.
Record each asset with its owner and the business functions it supports. Link it to providers and risks. Import what you already have.
- Export the inventory as of any reference date.
- Staged import: preview first, apply second.
- The annual inventory review is scheduled for you.
INCIDENTS · DORA ART. 17-23
When it happens, the clock is already running.
Capture an incident in seconds and classify it with guidance. For a major incident the reporting deadlines are computed to the hour: initial notification, intermediate report after 72 hours, final report after one month.
- Live countdowns and alerts before a deadline passes.
- Report drafts, client notices and management notifications tracked on the incident.
- Exports for the period: incident report, nil confirmation, annual cost report.
RESILIENCE TESTING · DORA ART. 24-25
A test programme, not a folder of pentest reports.
Plan tests across several years and carry over what is unfinished. Management approval is recorded as evidence. A finding stays open until the retest closes it.
- First-year programme proposed from your resilience areas.
- External testing requests tracked in one list.
- Programme export for the auditor.
THIRD PARTIES · DORA ART. 28-30
Your register of information, in the regulator's format.
Providers, contracts and criticality in one register. Company data fills in from GLEIF by LEI. Export as xBRL-CSV under ITS (EU) 2024/2956, and import last year's file instead of retyping it.
- Contract and notification deadlines become obligations.
- Each provider shows its incidents and linked risks.
- Contract documents sit in a vault, download only.
POLICIES · DORA ART. 5-9
Every policy has an owner, a version and a next review.
Start from a category catalogue mapped to DORA articles. Approvals and versions are recorded. Reviews are scheduled and end up in the audit package.
AUDIT READINESS
The auditor sends a list. You send a package.
Create the engagement with audit firm, period and reference date. Import the request list as CSV or pasted table. One click builds a verified package from the modules you use; anything else you upload by hand.
- A cover sheet on every export: source, time, filters, record count, hash.
- An audit chain you can verify yourself in the activity log.
- Package history, so you know what was handed over and when.
COMPLIANCE SCORE
One number, and the list behind it.
The score is built from every module you use. Open exceptions come first. A weekly summary by email is available if you switch it on.
How it starts
Set up in one sitting.
- Create your workspace.Sign up, secure the account with two-factor authentication, and enter your company profile.
- Bring your people and pick your modules.Import the workforce, name owners, mark critical functions. Starter content is loaded for the modules you choose.
- Let the calendar run.Obligations, reminders and evidence start from day one. You handle exceptions.
Built for supervised firms
Security you can show your own auditor.
Two-factor sign-in is mandatory.
No workspace access without it.
Tenants are separated in the database.
Row-level security on every tenant table, not a filter in application code.
Support access is visible.
If our staff enter your workspace, access is time-limited and a banner says so.
Your data stays in Germany.
Hosted in Germany. On request, Dora Check also runs on your own infrastructure.
FAQ
FAQ
Which parts of DORA does this cover?
ICT risk management, incident reporting, resilience testing, third-party risk and staff training, plus the obligations calendar and audit evidence that run across all of them.
Do we have to use every module?
No. Training and the obligations calendar are the base. You add modules when you need them, and the audit package works with whatever you use.
What does the auditor receive?
A verified package per engagement. Every export in it states its source, extraction time, filters, record count and hash.
How long does setup take?
One sitting. The onboarding asks for your company profile, people, owners and critical functions, then loads starter content.
Does Dora Check file reports with the authority for us?
No. It computes the deadlines, prepares drafts and exports, and records what you submitted and when. You submit.
Where is our data stored?
In Germany. If your policy requires it, we run Dora Check on your own infrastructure.