CERRIX Due Diligence

Run due diligence on CERRIX: check compliance and get alerts when suppliers or ownership change.

Netherlands · owned by Independent (Netherlands) · www.cerrix.com · 13 vendors

CERRIX is Europe's leading GRC (Governance, Risk, Compliance, and Audit) SaaS platform, offering an integrated solution for risk management, compliance, audit management, GDPR, incident management, and AI-powered regulatory monitoring. The platform serves 100+ organizations across 20+ countries, including financial institutions, pension funds, and insurance companies, helping them embed compliance and risk management into everyday operations. Headquartered in The Hague, Netherlands, CERRIX is built specifically for EU regulation frameworks such as DORA, DNB, and AFM requirements.

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 13 sub-vendors.

Insights

Last updated 2026-09-29 · revision 2

13 direct vendors, 218 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 8/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

CERRIX exhibits high migration readiness, largely due to its highly modern and cloud-native internal tech stack. Operating on Microsoft Azure with microservices, event-driven architecture, and Infrastructure as Code, the company is already well-positioned in a flexible and scalable cloud environment. This architecture significantly reduces the complexity and effort typically associated with migrating from legacy systems. The low vendor lock-in risk, stemming from a diverse base of 14 vendors across 5 countries, provides substantial flexibility in adapting or changing vendor relationships during any migration effort. Clear data residency requirements for the EU (Netherlands) streamline planning by defining specific compliance boundaries. Additionally, CERRIX's strong existing regulatory compliance framework (GDPR, ISO 27001, SOC 2) means that robust processes are already in place to manage compliance during a migration. While the ongoing NIS2 assessment might introduce some additional considerations, the overall readiness is very high. The primary challenge, if any, would be the lack of detailed public financial data to fully assess the capacity to fund a large-scale migration, though the current tech stack suggests any future 'migration' would likely be an evolution or optimization within their existing cloud infrastructure rather than a fundamental shift.

Compliance

7 in-scope frameworks identified; showing 3.

GDPR (source) — Evidence found

CERRIX is established in the Netherlands (EU) and processes personal data of its employees, customers, and website visitors, making GDPR directly applicable.

Evidence: https://www.cerrix.com/en/legal/privacy-statement, https://www.cerrix.com/en/solutions, https://www.cerrix.com/en, https://www.capterra.com/p/10019219/CERRIX/, https://slashdot.org/software/comparison/CERRIX-vs-otris-compliance/

DORA (source) — No public evidence

DORA applies to financial entities and their critical ICT service providers in the EU. As CERRIX provides a GRC platform to banks and insurance companies, it is likely in scope.

Evidence: https://www.cerrix.com/en/insights/blog/dora-compliance-checklist-for-beginners, https://www.dnv.com/cyber/challenges/regulation/digital-operational-resilience-act-dora/, https://www.cerrix.com/en, https://sourceforge.net/software/compare/CERRIX-vs-GRC-Toolbox/, https://slashdot.org/software/comparison/CERRIX-vs-otris-compliance/, https://www.cerrix.com/en/solutions

SOC 2 (source) — No public evidence

SOC 2 is a voluntary compliance standard for service organizations, developed by the American Institute of CPAs (AICPA), specifying how organizations should manage customer data.

Evidence: https://www.cerrix.com/en/insights/news/cerrix-successfully-completes-iso-27001-surveillance-audit-in-2025, https://www.cerrix.com/en/grc-software/isms-tooling, https://docs.cerrix.com/about-cerrix/trust-and-compliance

Financials

Three-year financials

Financial Resilience Score: 6/10

CERRIX shows solid qualitative resilience for a small private SaaS company, underpinned by institutional backing from Fortino Capital (Growth Private Equity Fund II) since April 2024, which provides fresh capital, professionalization, and access to add-on M&A. The company operates a recurring-revenue GRC SaaS model in a regulated-industry niche (banks, insurers, telcos), which tends to produce sticky, contracted revenue. Strong regulatory tailwinds from DORA, NIS2, ISO 27001, GDPR and ISQM drive demand for GRC platforms across Europe. However, resilience is difficult to fully assess due to very limited public disclosure — as a small Dutch BV, CERRIX only files a limited balance sheet, and no revenue, EBIT, cash or leverage data is publicly verifiable. The company is also materially smaller than global competitors like Palantir, LexisNexis, and Vanta (which raised $150M in July 2025), creating a war-chest asymmetry. Execution risks include internationalisation and M&A integration under a new CEO installed only ~9 months before the March 2026 Ruler acquisition, plus customer concentration in cyclical financial services and a Belgian subsidiary still operating as a cost centre with €0 turnover.

Key strengths: Fortino Capital growth-equity backing (April 2024), Recurring-revenue SaaS model in regulated verticals, Regulatory tailwinds (DORA, NIS2, ISO 27001, GDPR, ISQM), Reported >40% annual growth rate around Fortino investment, Sticky customer base of 14,000+ users across 20+ countries, Successful bolt-on M&A execution (Ruler, March 2026), New CEO with scale-up mandate and board reinforcement

Risk factors: Very limited public financial disclosure (small Dutch BV filing regime), Small absolute scale (~34 employees, estimated ~$5M revenue), Competitive asymmetry vs. well-funded rivals (Palantir, Vanta, LexisNexis), Execution risk on internationalisation and M&A under new CEO, Customer concentration in cyclical financial services, Belgian subsidiary still pre-revenue (€0 turnover, 1 FTE)

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report