Validate your DORA Register of Information without ever uploading your sensitive vendor data.
DORA is a focused workbench for the four jobs that actually consume your compliance hours: the Register of Information, Article 30 contract clauses, major ICT incident reporting deadlines and vendor due diligence.
- EU hostedSaved data stays in the EU
- Your data, isolatedRow-level security per workspace
- TLS 1.2+In transit
- AES-256At rest
- Files never uploadedParsed in your browser
How exposed are you to a DORA supervisory review?
Four quick questions. Get your risk rating and a gap-by-gap action plan.
How is your ICT Third-Party Register of Information maintained today?
Privacy-first by architecture
Your spreadsheet never leaves your machine
Every other register tool asks you to upload the file first. Here the parsing and validation run inside your own browser, so the sensitive vendor data in that spreadsheet is never sent to a server at all.
What happens on your machine
- The .xlsx, .xls or .csv file is decoded in this browser tab
- Template detection against RT.01.01, RT.02.01 and RT.02.02
- Mandatory-field, date and code-list checks
- Inline error highlighting, row by row
What leaves the browser — and only then
- LEI codes you ask us to verify, sent to the public GLEIF directory
- The checked rows, if you press Save to account, so you can reopen them
- Nothing else. The original file is never transmitted
Why it matters to your buyer
- No supplier contract data sitting in a vendor's upload queue
- “Does our data leave our estate?” answers itself on the questionnaire
- Saved records stay in the EU, encrypted, isolated per workspace
The full boundary is written out on the security & trust page.
Four modules
Each one works standalone. Your file is never uploaded — parsing and validation run in your browser. Only the results you save, and the LEI codes you check, ever leave it.
Register of Information Validator
Drop in the spreadsheet procurement sent you. We map it to the ESA templates, flag every mandatory gap, fix date and code-list drift, verify each LEI against the global directory and export a submission-ready file.
Open moduleArticle 30 Clause Generator
A guided wizard that turns your service facts into a DORA contract schedule your financial-institution clients can attach to the master agreement — with audit rights, exit assistance and notification SLAs.
Open moduleICT Incident Countdown & Triage
Classify an incident against the RTS thresholds, then watch the statutory clocks: 4 hours to initial notification, 72 hours to the intermediate report, one month to the final report.
Open moduleVendor DORA Passport
One shareable trust profile: LEI status, services and criticality, the subcontracting chain, certifications, notification commitments and exit plan — with a readiness score.
Open moduleHow DORA Workbench fits your workflow
Enterprise GRC platforms track high-level policy. DORA Workbench delivers the technical heavy lifting: schema-validated registers, statutory incident clocks, and contract schedules you can't run in a generic spreadsheet.
Raw vendor data
Disparate spreadsheets, contracts and ICT subcontractor lists — exactly as procurement and your vendors send them today.
DORA Workbench
Local-first validation against the ESA ITS templates RT.01/02, GLEIF LEI checks, Article 30 schedules and statutory countdowns — all in-browser, nothing sensitive uploaded.
Enterprise GRC
Clean, normalized CSV and markdown exports feed ServiceNow IRM, Archer, OneTrust and your regulatory reporting — with no reformatting by hand.
Trust & data protection
Built for a supervised environment
You are handing us your third-party risk picture. Here is exactly where it lives and who can reach it.
EU data residency
Everything you save — registers, contract schedules, incident logs and vendor passports — is stored in the European Union. No copies are kept outside the EEA.
Your data, isolated with row-level security
Every record is bound to your workspace at the database level. Row-level security policies mean another customer's query physically cannot return your rows.
Spreadsheets never leave your browser
Vendor files are parsed and validated on your own machine. Only the LEI codes you choose to check are sent out, to the public GLEIF directory.
Encrypted in transit and at rest
TLS 1.2+ on every connection, AES-256 at rest, 12-character minimum passwords screened against known breach lists.
Full detail in the privacy & data protection notice.
Frequently asked questions
Do I need to keep the app open while an incident clock is running?
No. Each countdown is calculated from the time you logged the incident, so closing the tab or losing your connection doesn't stop it. Reopen the incident and the remaining time is correct.
How do I stop the clock?
The statutory clock stops when your competent authority receives your notification — not when you draft it. Record the submission in the activity log (for example, “Initial notification submitted to the CBI portal”) so the exported summary shows exactly when each deadline was met.
Can the app submit to the Central Bank of Ireland portal automatically?
No. The CBI has no open submission interface, so the app prepares the notification summary for you to upload or paste into the portal by hand.
Will I get reminded before a reporting deadline?
Yes. Switch on email reminders when you save an incident and your workspace owners and admins receive an email ahead of the 4-hour, 72-hour and one-month deadlines — even if nobody has the app open.
How does this connect to our broader risk assessments?
Each module produces an artifact your risk team can drop straight into its existing process: a row-by-row findings report for the register, a DORA contract schedule that attaches to the master agreement, a supervisor-ready incident summary with the statutory deadline timeline, and a shareable vendor passport. Everything exports as CSV or markdown, so it slots into whatever GRC tool or risk register you already run. DORA Workbench doesn't replace your risk assessment — it does the mechanical, time-consuming part (mapping, validating, formatting) so your team spends its judgement on the decisions that actually need it.
Who validates your template logic?
The template structure — field codes, mandatory flags, code lists — is taken directly from the ESA implementing technical standards (the ITS templates RT.01.01, RT.02.01, RT.02.02, Commission Implementing Regulation (EU) 2024/2634). The validation rules check those fields against the published specs: mandatory presence, ISO date format, country-code shape, and LEI checksum against the GLEIF ISO 17442 standard. No independent third party has audited the implementation, and we do not claim otherwise. The parsing and checking code runs in your browser, so a technical reviewer on your side can inspect it directly rather than taking our word for it.
Benchmark templates
Blank ESA-shaped CSV templates with one example row each, so your vendors can send data in the right shape the first time.
RT.01.01
Entity information
The financial entities in scope of the register, their identifiers and their place in the group hierarchy.
RT.02.01
ICT third-party service providers
Contractual arrangements with direct ICT third-party service providers, including criticality and data location.
RT.02.02
Sub-outsourcing chains (4th party)
The chain of sub-contractors supporting each contractual arrangement, so 4th-party concentration is visible.
Questions before you start?
Ask about plans or onboarding.