D
DataGuard
DataGuard is a European security and compliance platform that runs an organization's privacy program and information security management system in one place. The privacy side covers records of processing, data subject requests, data protection impact assessments, incident and breach management, third party risk, consent and cookie management, and whistleblowing intake. The security side carries a policy and control library, asset inventory, vendor management, risk management and employee training, with templates and guided workflows aimed at certification.
Supported frameworks are GDPR and UK GDPR, ISO 27001, NIS2, TISAX and the EU AI Act, and several can run together across multiple entities. AI is a layer rather than the product: an AI Co-pilot, help with processing inbound security questionnaires, and automation the company says removes up to forty percent of manual work. Software and people are sold together. Base is the platform alone, Pro adds access to DataGuard's certified consultants, and add ons let a customer appoint DataGuard as its external Data Protection Officer or Information Security Officer. Every tier is quoted rather than priced. DataCo GmbH trades as DataGuard, is based in Munich and was founded in 2018.
DataGuard, head to head
Side by side on the same 15 capability axes and 12 legal signals: where the two part company, and what neither one publishes.
Alternatives to DataGuard
Vendors in the same categories as DataGuard whose graded profiles look most alike, with a line on what each product does.
Similar is not the same, so check that each one does the job you need. No vendor pays for placement.
- OOnspringOnspring is a no code governance, risk and compliance platform for building and running GRC programs without developers.
- RRed Oak ComplianceRed Oak is a financial services compliance platform from Red Oak Compliance Solutions of Austin, Texas, sold to broker dealers, registered investment advisers, banks and insurers.
- AAscentAIAscentAI is a regulatory lifecycle management platform for financial institutions.
- CCanopyCanopy is data breach response software from Canopy Software, Inc. of Reston, Virginia, which Epiq acquired on 25 September 2026 and is bringing into its Epiq AI agentic suite through Epiq…
- HHolistic AIHolistic AI sells an AI governance platform built from three modules.
- RRelyance AIRelyance AI maps where personal and sensitive data goes inside an organization and ties each flow to the obligation that governs it.
Ordered by how closely the graded profiles match across the 15 capability axes, inside the same categories. See how each axis is graded in the methodology.
Capability grades
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
What DataGuard sells is a policy and control library, a risk register with prebuilt treatment plans, an asset inventory, framework templates for ISO 27001, GDPR, NIS2, TISAX and the EU AI Act, evidence collection, and the statutory privacy workflows. All of that works without the models, as the platform did before AI. In the published plan comparison, an AI Co-pilot is a feature line under Admin and Access Controls, and a questionnaire processing tool that uses AI sits under Trust Management, available only with the advanced security platform.
Automation using AI is named as a platform pillar from the Base tier, with a headline claim of up to forty percent of tasks automated.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Nothing published addresses the accuracy or grounding of DataGuard's AI features. They are an AI Co-pilot and a questionnaire processing tool that uses AI, the latter limited to the Advanced tier in the plan table, and no accuracy figure, test set, evaluation, method, grounding description or hallucination statement attaches to either. The percentages on the site are operational rather than accuracy claims: up to 40 percent of tasks automated, certification 75 percent faster and a 100 percent first try pass rate.
Every page carrying them adds that the data is for information only, based on internal estimates, not indicative of KPIs, and given without warranty as to accuracy or reliability.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
DataGuard sells oversight as Experts-in-the-Loop: automate when you want it, get expert help when you need it, with certified consultants stepping in for complex decisions and strategic review, and a dedicated page for the concept. It is a paid tier: the humans in that loop are DataGuard's consultants, not the customer's own reviewers, and access to them is what separates Pro from Base, so a Base customer buys no oversight.
Nothing published identifies a review point inside the product, no confidence or uncertainty signal is described for AI output, and nothing states which automated actions need approval before taking effect. Nothing addresses what happens when the AI Co-pilot is wrong in a record that later supports a certification audit.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
DataGuard claims more than 4,000 organizations in 50 or more countries, up to forty percent of tasks automated, certification seventy five percent faster and fifty percent lower costs, and compliance in as little as three months with a hundred percent first try pass rate on certification. G2 shows Data Privacy Management leader badges for Europe, EMEA and the United Kingdom and a Consent Management high performer badge, the rating is 4.6 on both G2 and Capterra, and there is a Gartner Peer Insights listing.
DataGuard's own footer, on every page, says all data is for information only, based on internal estimates, not indicative of KPIs and given without warranty as to accuracy or reliability, which leaves the outcome claims without a stated basis. No named customer appears on the home, product or pricing pages.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
DataGuard runs a trust center publishing an ISO 27001 Statement of Applicability with reports on request, offers single sign on and granular user permissions as plan features within an Admin and Access Controls feature group, and is a Munich company selling data protection compliance under German and EU law. No statement on customer content is published outside its two privacy policies, a general one and a separate platform privacy policy: nothing says whether customer content trains models, no retention or deletion position is given, and no model provider is identified.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
No position on advice versus tooling is published. Under one add on the customer appoints DataGuard as its external Data Protection Officer, a role with statutory duties and independence requirements under Articles 37 to 39 of the GDPR. There is an equivalent external Information Security Officer offering, and consultants give information and advice on regulatory obligations and certification requirements. Nothing published says where the tooling stops and advice begins, or whether the guided workflows and template libraries amount to advice.
Nothing addresses how a nominated DPO stays independent when the same company sells the compliance platform being assessed, or what the customer remains responsible for.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
No governance position for DataGuard's own AI is published. On the product side, the EU AI Act is a named framework alongside GDPR, ISO 27001, TISAX and NIS2, the platform combines AI governance workflows with the customer's ISMS and privacy program, and the template library includes an AI system assessment, all tooling the buyer runs over its own systems. No responsible AI statement, named owner accountable for model behavior, evaluation before release, testing result, or anything on bias in the AI Co-pilot or the questionnaire tool is published, and the footer lists no responsible AI page.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Access control comes as product features: single sign on, granular user permissions and a dedicated Admin and Access Controls feature group in the plan comparison, with role based permissions in the platform's feature set. A trust center at trust.dataguard.com publishes an ISO 27001 Statement of Applicability and reports, and states its access route: documents are requested by entering an email address and the team reviews requests within 24 hours.
No retention period, deletion commitment, subprocessor list or incident or breach notification practice for DataGuard's own processing is published outside its two privacy policies, though the product sells incident and breach management to others.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
No customer agreement is published on DataGuard's site. The footer carries exactly four legal links: Privacy Policy, Legal Notice, Cookie Policy and Trust Center. The Legal Notice is the Impressum German law requires of any commercial website and does not govern the customer relationship. There are no terms of service, general terms and conditions, master subscription agreement, service level document or acceptable use policy in the navigation, footer or site map.
No indemnity, liability cap, warranty, uptime commitment or insurance position is published, for a platform that holds a customer's record of processing, breach register and certification evidence and may supply its Data Protection Officer.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
The developer documentation for DataGuard's Consent and Preference Management product gives a setup guide for each named integration. For CRM it covers Salesforce, HubSpot and Microsoft Dynamics, and for marketing automation Braze, Brevo, Mailchimp and Salesforce Marketing Cloud. Identity runs through Auth0 and Ping Identity, data warehousing through Snowflake, and forms through FormAssembly, Formstack and WordPress Contact Form 7.
It also documents a REST API with an OpenAPI reference and Postman collection, webhooks, bulk export, import and deletion endpoints, embeddable JavaScript widgets, mobile integration paths, and single sign on via Azure Active Directory, SAML and OpenID Connect. The documentation covers only the consent module, which is sold as an add on rather than as the core platform, and it sits on a separate domain carrying an acquired product's branding, last updated November 2024.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Munich is the base for DataGuard, which describes itself as the European leader in security and compliance software and markets secure hosting and infrastructure built to meet strict GDPR requirements, but names no country, region or data center for where customer data is stored or processed. An Enterprise tier reference to multinationals needing region specific configurations describes a configuration capability rather than a residency option a buyer could select.
Nothing states whether the platform is single or multi tenant, no dedicated or private deployment is offered at any tier, and no separation is drawn between where data sits and where any AI processing happens.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
The trust center at trust.dataguard.com is linked from the site footer and states its access process plainly: a document is requested by clicking it and entering an email address, the team typically reviews requests within 24 hours, and anything not listed can be requested by email, so requests are fulfilled without a sales conversation. One artifact is named, DataGuard's own ISMS document rather than a badge: an ISO 27001 Statement of Applicability, alongside a Resources section listing Reports.
No certifying body or auditor is named, no certificate number, scope or observation period is published, no date or validity period appears, and the Reports entry is generic, so which reports exist is not stated before asking.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
AI-Powered Automation is a named DataGuard platform pillar, the AI Co-pilot and a questionnaire processing tool using AI appear as line items in the plan table, and automation powered by AI is the phrase used in the organization description carried in schema markup on every page. No model, provider or version is named, no hosting or processing location is stated for the AI, and no commitment to notify customers of changes is published. DataCo GmbH of Munich sells on European data protection positioning, and where its AI processing runs is not stated.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Each of the three tiers has a stated audience: Base, the platform alone for teams with internal expertise; Pro, adding direct access to in house experts; and Enterprise, for complex needs across multiple entities. A feature comparison runs across roughly fifteen areas, from ISMS documentation, training, risks and controls to vendor management, trust management, onboarding, the annual security program and information security officer support, and marks which capabilities need the advanced platform or a dedicated expert.
Seven named add ons show what costs extra, including consent management, cookie management, whistleblowing, global legal analysis, exposure management, and external Information Security Officer and Data Protection Officer services. Every tier resolves to Get a quote, and no figure, range or charging unit appears; nothing states whether pricing runs per seat, entity, framework or employee.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Coverage is organized by framework, with GDPR and UK GDPR, ISO 27001, NIS2, TISAX and the EU AI Act each on their own page; operation across multiple entities and frameworks is named as a capability, and 4,000 organizations in 50 or more countries are claimed. The Solutions menu has exactly two entries, DataGuard for SMEs and DataGuard for Corporates, so the only buyer dimension published is headcount. No page exists for legal, in house counsel, data protection officers or compliance, no role is addressed by title, and nothing published shows who inside a customer owns the tool.
1 public document
The public pages on file for DataGuard, with the recorded signals each one supports and the date it was last read. Open any of them and check the reading against the record.
-
Fabricated Citation Record
Read Sep 4, 2026
No published figure
- DataGuard does not publish any prices. Every plan says get a quote.
- There are three plans: Base is the software on its own, Pro adds access to DataGuard's own experts, and Enterprise is for large or complex organizations.
- DataGuard's website shows clearly what is in each plan and what costs extra.
- Seven things are sold as add ons, including cookie and consent tools, whistleblowing, and having DataGuard act as your Data Protection Officer.
- The site never says how the price is worked out, so you cannot tell whether you pay per person, per company or per framework.
Package structure is published in detail, and no figure or charging unit appears anywhere. Three tiers are named with stated audiences. Base is the SaaS platform alone, for teams confident managing security and compliance themselves. Pro adds direct support from in house experts, with an optional upgrade to a dedicated advanced expert. Enterprise offers tailored features and support for large organizations with needs across multiple entities, countries or frameworks.
A feature comparison runs across roughly fifteen areas and marks which items need the advanced security platform or a dedicated advanced expert. Seven add ons fall outside the tiers: consent and preference management, cookie management, whistleblowing management, global legal analysis, actionable exposure management, external Information Security Officer and external Data Protection Officer. The AI Co-pilot is included from Base; questionnaire processing with AI needs the advanced security platform.
Every tier and call to action resolves to Get a quote. No figure, range, currency or unit of charge is published, so a buyer cannot tell whether billing runs per seat, entity, employee or framework. No self serve purchase route exists.
Legal Signals
What each signal meansA signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
A published agreement or policy exists and none of it addresses the question either way, or the document that would answer it could not be read and the summary names the retrieval limit. The summary states which shape the silence takes: an improvement right granted that never names training, or no improvement right granted at all.
DataGuard publishes a general Privacy Policy and a separate Privacy Policy: Platform at /privacy-policy-platform/, which would govern customer content in the product, and neither was available to read, so the silence takes the form of a retrieval limit rather than a stated position. Nothing readable addresses training on customer content: the AI Co-pilot and the questionnaire processing tool are described as plan features with no data commitment. This is not a finding that DataGuard permits training or that it says nothing.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
No located public material states how long prompts and outputs are retained.
No retention period for prompts, outputs or uploaded content is published outside DataGuard's two privacy policies, the Privacy Policy and the Privacy Policy: Platform. The AI features are described by function and never touch retention: the plan table lists the AI Co-pilot and the questionnaire processing tool without data handling terms, and the product pages cover evidence collection, control monitoring and assessment templates rather than what happens to material after processing. No deletion route, configurable window or default period appears on those pages.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
The product maintains its own permission model, documented, requiring the firm to keep it aligned.
A permission model of DataGuard's own is offered as product features. The plan comparison names single sign on and granular user permissions together under an Admin and Access Controls feature group available across tiers, and role based permissions appear in the platform's documented feature set. The consent module's developer documentation adds single sign on via Azure Active Directory, SAML and OpenID Connect, API authentication and separate environments.
Operation across multiple entities is published as a capability, which is how a group separates one subsidiary's compliance program from another's. How those permissions map to a wall in practice is not published, and nothing addresses separation between engagements where DataGuard's own consultants have access under the Pro tier or as a nominated external Data Protection Officer.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
No located term or policy addresses third party requests for customer data.
No compelled disclosure or customer notice position is published outside DataGuard's two privacy policies. DataGuard publishes no customer agreement, and no transparency report, government request statement or disclosure practice appears on the home, product, framework or pricing pages. The question sits within DataGuard's own subject matter, since it is a German privacy specialist whose customers buy it to handle data subject and authority interactions.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Coverage is described by jurisdiction with no identification of the underlying corpus.
GDPR, UK GDPR, ISO 27001, NIS2, TISAX and the EU AI Act are named consistently and delivered through policy templates, ready made risk and control libraries and guided workflows, with a global legal analysis add on tracking regulatory developments. No regulatory data source, publisher or feed is named, and no update cadence is published for the libraries or the legal analysis add on. No licensing basis is stated for any standard reproduced in the platform, though ISO 27001 and TISAX content are both proprietary and the site separately disclaims any affiliation with the ENX Association that owns TISAX.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history.
Staying current with changing regulation is sold as a product capability: a global legal analysis add on that tracks legal requirements, framework libraries maintained for GDPR, ISO 27001, NIS2, TISAX and the EU AI Act, and monitoring and periodic review workflows. Nothing states how or how often the regulatory content is updated, no effective date or version is shown on template or control content, nothing flags when a requirement a customer has mapped has changed, and no verification prompt exists.
The product does not retrieve or cite primary legal authority; for a compliance platform the equivalent risk is a control library that has fallen behind a regulation.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
No located public material addresses what the product does when it cannot ground an answer.
No public material describes what DataGuard's AI does when it cannot answer reliably: no way to abstain or return no answer, and no confidence or grounding signal on output from the AI Co-pilot or the security questionnaire tool. The nearest concept is the Experts-in-the-Loop tier, under which DataGuard's certified consultants step in for complex decisions and strategic review; that is a paid escalation to human help, available only from the Pro plan upward, not a description of how the system behaves when unsure.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
No court order, opinion or disciplinary record addressing fabricated or hallucinated legal citations produced by this product has been located as of the date shown. This is a statement about the public record on that one subject, not a finding about the product, and this signal is not a litigation history.
The AI Hallucination Cases database maintained by Damien Charlotin records no court order, opinion or disciplinary record naming DataGuard or its corporate name DataCo GmbH. The database tracks fabricated legal citations in court filings, and this product supports compliance program management rather than producing court submissions, so its exposure to that specific failure is low. This is a statement about the public record rather than a finding about the product.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No located public material engages with bar or ethics guidance.
No public material engages professional guidance or any professional authority. The regulatory frameworks DataGuard serves are named throughout, but they are the subject matter of the compliance work rather than guidance on how a professional should use software in that work. No bar association, law society, supervisory authority, data protection authority or professional body is named, no guidance or opinion is cited, and nothing addresses the professional obligations of a Data Protection Officer using the platform or of DataGuard's own personnel when nominated to that statutory role under the external Data Protection Officer add on.
The European Data Protection Board and national supervisory authorities publish directly relevant guidance, and none is referenced.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product does not touch a fee between a lawyer and a client. It operates before an engagement exists, or it is bought by a team that bills no client for the work. Savings claims aimed at the buyer’s own cost are recorded in the summary and do not make the row a savings claim, because no client bill is in the loop.
DataGuard's stated savings are specific and repeated across pages: up to forty percent of tasks automated, seventy five percent less manual effort, fifty percent lower costs, and certification reached up to seventy five percent faster. Nothing addresses what happens to a fee when that work compresses. DataGuard sells advisory time alongside software through the Pro tier, the dedicated expert upgrades and the external officer add ons, so automation of the platform work bears directly on the advisory hours a customer buys, and nothing published addresses that relationship.
No record of work done with AI for each engagement is described. DataGuard's own site footer states that all such figures are internal estimates given without warranty as to accuracy.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
The material exists behind a sales conversation or an executed agreement.
An access process for the publicly linked trust center at trust.dataguard.com is set out: documents are requested by entering an email address, requests are typically reviewed within 24 hours, and anything not listed can be requested by email. An ISO 27001 Statement of Applicability is named and a Reports section exists, so documents can be requested without a sales conversation. No subprocessor list or data processing agreement is published, no model provider is identified, and nothing forwardable on data handling is published outside the two privacy policies.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of the record are available, short of a document level export.
DataGuard's platform produces automated evidence collection, control monitoring, reporting ready for audit, periodic reviews, internal audit functions on the expert tiers, and, in the consent module, an audit trail of consent transactions with a documented data export endpoint, so a customer can show what its compliance program did and when. Nothing states that output from the AI Co-pilot or the questionnaire tool is marked as AI output in the record, no model or version is captured against an entry, no record of what a human reviewed or amended before an entry became evidence is described, and no guidance exists for disclosing AI involvement to a certification auditor or supervisory authority, though the evidence the product generates goes to auditors.