Verbu Due Diligence

Run due diligence on Verbu: monitor compliance and get alerts when suppliers, ownership or leadership change.

Denmark · owned by Independent (Denmark) · verbu.com · 8 vendors

Verbu is a Danish AI-powered customer service platform that handles customer inquiries via phone and chat, acting as an AI receptionist and first-line support agent. It automates routine tasks such as answering FAQs, booking appointments, updating CRM systems, and qualifying leads — 24/7 and in 32+ languages. Built from the ground up for European businesses, with full GDPR compliance and 100% EU data residency.

Resilience scores

Technology vendors

Insights

Last updated 2026-09-28 · revision 3

8 direct vendors, 99 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 5/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Verbu's modern internal tech stack, including Next.js, webhook-based workflow automation, and API key-based integrations, suggests a modular architecture that could facilitate migration. The company's existing use of EU-hosted data centers (Sweden & Germany) indicates experience with cloud or co-location environments, which is a positive foundation for further cloud adoption or migration. The explicitly stated "Medium Vendor Lock-in Risk" is a primary challenge for migration, as it could complicate the disentanglement from existing vendor services. Verbu's strong commitment to "GDPR-compliant data processing" and an "EU AI Act compliance framework," coupled with the implied EU data residency from its EU-hosted data centers, means any migration strategy must strictly adhere to these regulatory and data sovereignty requirements, potentially limiting the choice of migration targets or cloud providers. The absence of data on financial stability (growth history, revenue concentration) makes it impossible to assess Verbu's capacity to fund a potentially complex migration project. While the total number of vendors (8) is moderate, their limited geographic diversity (2 countries) could also pose challenges if critical vendors are concentrated.

Compliance

6 in-scope frameworks identified; showing 3.

SOC 2 (source) — Assessment Required

SOC 2 is an assurance framework particularly relevant for technology service providers that store or process customer data. It provides assurance on controls related to security, availability, processing integrity, confidentiality, and privacy.

Similar to ISO 27001, a SOC 2 report is a common customer expectation for a SaaS company. The lack of a report could be a barrier to acquiring larger enterprise customers, making the risk medium.

NIS2 (source) — Assessment Required

As a technology company providing digital services in the EU, Verbu could fall under the scope of the NIS2 Directive as an 'Important Entity' if it meets the size-cap thresholds (50+ employees or EUR 10M+ turnover).

If Verbu is considered a 'digital provider' under NIS2, non-compliance could lead to significant fines and mandatory incident reporting. The risk is medium as applicability is likely, but the company's size and specific services need to be fully assessed against the directive's criteria.

ISO 27001 (source) — Assessment Required

ISO 27001 is a widely recognized international standard for information security management. While not legally mandated, it is a common requirement in the technology sector for demonstrating a commitment to security.

For a technology company handling customer data, ISO 27001 certification is often a customer requirement and a competitive differentiator. The absence of a certification could be a commercial disadvantage. The risk is medium as it primarily impacts customer trust and sales.

Evidence: https://whereby.com/blog/whereby-certified-with-iso-27001-certification/, https://certification.bureauveritas.com/needs/information-security-management-system-iso-27001-certification, https://www.probo.com/hub/iso27001, https://www.varonis.com/blog/iso-27001-compliance, https://www.urmconsulting.com/blog/everything-you-need-to-know-about-iso-27001-certification

Financials

Financial Resilience Score: 3/10

Verbu ApS is a newly incorporated Danish startup (founded 2 September 2025) with no published financial statements as of the report date. The first accounting period is extended and runs until 31 December 2026, with the first annual report not due until approximately 30 June 2027. This means there is zero visibility into revenue, cash burn, profitability, or equity position. The company is capitalised only at the DKK 20,000 statutory minimum for an ApS, which provides very thin equity cushion against any operating losses. Despite the absence of financials, there are qualitative positives: the company shows early commercial traction with named paying customers (Robotservice Danmark reportedly generating 1,000+ calls per month), a recurring SaaS revenue model with tiered pricing (€57/€254/€701 per month), and a differentiated GDPR/EU data residency positioning in the AI voice agent market. However, key-person risk is high with only two co-directors, no independent audit assurance (audit opt-out), and the company faces well-funded global competitors like PolyAI, Retell, and Vapi. Overall resilience is low due to minimal capitalisation, unproven financials, and startup-stage fragility, partially offset by early customer traction and a defensible niche.

Key strengths: Early commercial traction with named paying customers, Recurring SaaS revenue model (€57-€701/month tiers), GDPR-compliant EU data residency as competitive moat, Founder-holding ownership structure ring-fences risk, Anchor customer generating 1,000+ calls/month

Risk factors: No published financials - zero visibility into revenue, burn, or equity, Thin capitalisation at DKK 20,000 statutory minimum, Audit obligation opted out - no independent assurance, Key-person risk with only two co-directors, Highly competitive AI voice agent market with well-funded global players, First annual report not due until mid-2027

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report