Durava AI features, pricing and GDPR (October 2026)

Durava is AI-supported software for internal control systems, built in Cologne for banks, insurers, listed companies, public bodies and critical infrastructure. It reads policies and process documents, identifies controls, checks them against evidence and keeps a risk control matrix up to date.

Durava documents an internal control system from a company's existing documents. It builds and maintains a risk control matrix and maps controls to frameworks such as SOX 404, ISO 27001, MaRisk, DORA, Solvency II and NIS-2. A dashboard tracks control status and corrective actions. Every result links back to the passage in the source document. The software supports the German audit standards IDW PS 261 and PS 982. Durava GmbH is based in Cologne, holds ISO 27001 certification and runs the service in German data centers. On request, it can be installed in the customer's own Azure environment.

• Finds controls in existing documentsDurava analyzes policies, work instructions and process descriptions and identifies control activities, responsible roles and frequencies. Teams building or refreshing an internal control system avoid reading hundreds of pages to fill the control inventory by hand.
• Checks control effectiveness against evidenceThe software compares documented controls with the evidence already available and assesses whether they are effective, linking each result to its source passage. Internal control and audit teams get audit-ready documentation that external auditors can trace.
• Keeps controls current when documents changeWhen a policy or process document changes, Durava detects the change and updates the affected controls. The risk control matrix stays current without a yearly manual review of every document.
• Maps controls to several frameworksControls are mapped automatically to multiple frameworks, including SOX, ISO 27001 and MaRisk. Companies subject to several regimes can reuse one control and show coverage for each framework separately. This reduces duplicate testing.

• Builds the control inventory from existing documents and links every result to the source passage.
• Supports German audit standards IDW PS 261 and PS 982 and sector rules such as MaRisk, KWG, VAG and DORA.
• Runs in German data centers or, on request, in the customer's own Azure environment, and Durava itself holds ISO 27001 certification.

Durava is based in Cologne, hosts in German data centers and addresses German requirements such as MaRisk, KWG, VAG and the audit standards IDW PS 261 and PS 982.

Durava works from your documents, so check that policies and process descriptions are complete and current before a pilot. Decide whether the hosted service in Germany or an installation in your own Azure environment fits your IT rules. Ask which language models are used and request the data processing agreement under Art. 28 GDPR. Agree with your auditor how AI-generated effectiveness assessments will be reviewed and documented.

No reviews yet. Be the first to share how your team uses it.

Every review shows its verification level. We read each one before it goes live. How we check reviews