Skip to content
SPECIFICTION
Get listed

Eramba

eramba.org

From €208.33/mo Free plan WebLinuxAPISelf-hosted
Visit eramba.org
Spec score 9.1 #1 of 60 in Internal Controls Software

What it is

Eramba is governance, risk, and compliance software for organizations managing activities such as risk, compliance, data privacy, incidents, awareness programs, account reviews, and online assessments. It lists more than 70 ready-to-import compliance packages, and teams can upload a custom framework as a CSV file. Common tools include notifications, granular access controls, status tracking, custom fields, reporting, automations, and REST APIs. Eramba can accept API requests and send webhooks to other systems, with examples involving SIEM incident creation and Jira issue creation. Authentication options include LDAP, SAML, and Google OAuth; its documentation also describes LDAP synchronization. Community and Enterprise can be installed on-premises using Docker or VMware, while SaaS is also available. For SaaS, Eramba says it hosts systems in Europe or the USA and manages daily backups and upgrades when releases become available. Community is free; Enterprise On-Premise starts at €2,500 a year, and Enterprise SaaS starts at €5,000 a year. Eramba is not a network scanner; its documentation recommends syncing asset data from a CMDB through the REST API.

Spec sheet

What it does
Eramba is a governance, risk and compliance application covering compliance, risks, incidents, projects, exceptions, policies and controls.Read 14 Oct 2026 · eramba.org
Purpose
Eramba is GRC software designed to help organizations manage governance, risk and compliance activities.Read 28 Sep 2026 · eramba.org
Intended users
The access management guide describes GRC team members as managing information such as risks, controls and policies, while other departments and suppliers may provide review feedback.Read 28 Sep 2026 · eramba.org
Integrations
Authentication integrations include LDAP, SAML and Google OAuth, with SCIM, CSV and LDAP synchronization options for accounts.Read 14 Oct 2026 · eramba.org
Support
Community users receive forum and documentation help, while Enterprise customers receive unlimited email support during European business hours.Read 14 Oct 2026 · eramba.org
Headquarters
London, United Kingdom, and Bratislava, Slovak RepublicRead 28 Sep 2026 · eramba.org
Founded
2007Read 28 Sep 2026 · eramba.org
Account reviews
Enterprise includes automated account-review use cases and connectors for systems such as AWS and LDAP.Read 14 Oct 2026 · eramba.org
API documentation
API documentation is exposed through Swagger within each module to administrators or members of the Admin group.Read 14 Oct 2026 · eramba.org
API limitations
The API documentation notes pagination but no sorting, and PATCH requests require the full object fields.Read 14 Oct 2026 · eramba.org
Automation extensibility
Automations run user-provided PHP code, can use Composer dependencies and can execute on schedules or record-change events.Read 14 Oct 2026 · licenses-dev.eramba.org
Awareness programs
Enterprise includes awareness training programs that track participation and results.Read 14 Oct 2026 · eramba.org
Company founded
LinkedIn lists Eramba as founded in 2011.Read 14 Oct 2026 · linkedin.com
Company headquarters
LinkedIn lists London, United Kingdom as headquarters, with 11–50 employees and a Bratislava location.Read 14 Oct 2026 · linkedin.com
Company history
Eramba’s about page says the team started building and sharing the tool in 2007 and describes its first version as emerging from that effort.Read 28 Sep 2026 · eramba.org
Company legal entity
Eramba is managed by Eramba Limited, a business registered in the United Kingdom.Read 14 Oct 2026 · eramba.org
Company origin
The company story says the first eramba version was built in 2007 and the team became full-time in 2015.Read 14 Oct 2026 · eramba.org
Compliance management
The compliance module supports imported requirements such as ISO 27001, PCI-DSS, NIST, SOC 2 and other frameworks.Read 14 Oct 2026 · eramba.org
Customisation
Enterprise supports custom fields, custom module associations and configurable forms.Read 14 Oct 2026 · eramba.org
Data privacy
Data Privacy is listed as a supported eramba use case alongside risk, compliance and incidents.Read 14 Oct 2026 · eramba.org
Deployment components
The Docker stack includes eramba, MySQL, Redis, cron, Caddy, triggers Caddy and an MCP server.Read 14 Oct 2026 · eramba.org
Documentation
The vendor publishes free installation, implementation and operating courses, plus a public forum and release notes.Read 14 Oct 2026 · eramba.org
Dynamic statuses
Dynamic Status lets administrators define conditions that label records, create KPIs, filter views and trigger notifications or automations.Read 14 Oct 2026 · eramba.org
Features
Common features include custom notifications, granular access controls, dynamic status, custom fields, REST APIs, reporting and automations.Read 28 Sep 2026 · eramba.org
Frameworks
The maker lists more than 70 ready-to-import compliance packages and says users can upload a custom framework as a CSV.Read 28 Sep 2026 · eramba.org
Funding and ownership
The company says it declined venture investment and operates independently without debt or outside investment.Read 14 Oct 2026 · eramba.org
Identity
The product supports external authentication using LDAP, SAML or Google OAuth, and its documentation describes LDAP synchronization.Read 28 Sep 2026 · eramba.org
Incident management
Incident Management records incidents, analysis stages, response actions, evidence, owners, deadlines and closure.Read 14 Oct 2026 · eramba.org
Licence
Eramba states that Community and Enterprise are source-available but not open source; modification, reverse engineering and redistribution are prohibited.Read 14 Oct 2026 · eramba.org
Limit: complexity
The same independent evaluation said the system is complex enough that training can take a long time.Read 14 Oct 2026 · local.cis.strath.ac.uk
Limit: dashboards
The independent evaluation criticized dashboards for mainly showing unexplained numbers without enough trends or high-level visualization.Read 14 Oct 2026 · local.cis.strath.ac.uk
Limit: development resources
The G2 reviewer warned that community-driven applications can develop gaps when committed development time is limited.Read 14 Oct 2026 · g2.com
Limit: review transparency
Trustburn states that company information is not verified and notes that the company solicits reviews without replying to negative ones.Read 14 Oct 2026 · trustburn.com
MCP integration
The current product includes an MCP server and AI assistant for interacting with eramba data in natural language.Read 14 Oct 2026 · eramba.org
Notable limit
The product documentation states that Eramba is not a network scanner and recommends syncing asset information from a CMDB through its REST API.Read 28 Sep 2026 · eramba.org
Offline operation
Eramba cannot operate fully offline because it must reach support servers for licence validation and updates.Read 14 Oct 2026 · eramba.org
Online assessments
Enterprise includes online assessments for collecting questionnaire responses from stakeholders.Read 14 Oct 2026 · eramba.org
Praise: documentation
An independent evaluation found Eramba documentation thorough, with linked modules, reports, notifications and understandable risk calculations.Read 14 Oct 2026 · local.cis.strath.ac.uk
Praise: price and value
The G2 reviewer praised eramba as inexpensive and said its price-to-features ratio provides substantial functionality.Read 14 Oct 2026 · g2.com
Praise: usability and support
Trustburn reviewers repeatedly describe easy navigation, broad functionality and helpful or responsive support.Read 14 Oct 2026 · trustburn.com
Rating on G2
4.0 out of 5 from 1 reviewRead 14 Oct 2026 · g2.com
Rating on Trustburn
4.1 out of 5 from 10 reviewsRead 14 Oct 2026 · trustburn.com
Reporting
Reporting is an Enterprise feature, with the comparison page listing basic reporting for Enterprise editions.Read 14 Oct 2026 · eramba.org
REST API
REST APIs can receive CRUD requests and send webhooks from most modules, including objects, comments, attachments and custom fields.Read 14 Oct 2026 · eramba.org
Risk management
Risk workflows support asset, third-party and business risks, scoring matrices, treatments, owners, reviews and reporting.Read 14 Oct 2026 · eramba.org
SaaS hosting
SaaS runs on Amazon AWS infrastructure with customer-selectable European or United States data centres.Read 14 Oct 2026 · eramba.org
SaaS operations
For SaaS, Eramba says it hosts systems in Europe or the USA and handles daily backups and upgrades when releases become available.Read 28 Sep 2026 · eramba.org
Security certification
Eramba says it holds a UKAS-valid ISO 27001:2022 certificate covering software production, distribution and SaaS services.Read 14 Oct 2026 · eramba.org
Security controls
The user documentation says locally authenticated accounts have brute-force protection by default, which blocks further login attempts after incorrect credentials.Read 28 Sep 2026 · eramba.org
Self-hosted platforms
Community and Enterprise on-premise installations are documented for Docker and VMware; the Docker guide covers Linux host configuration.Read 28 Sep 2026 · eramba.org
Self-hosting
Community runs on customer servers, while Enterprise can run on customer infrastructure or as eramba-hosted SaaS.Read 14 Oct 2026 · eramba.org
System requirements
The Docker deployment requires a 64-bit host, at least 1 vCPU, 4 GB RAM plus 10 GB swap and 3 GB storage; 2 vCPUs and 8 GB RAM are recommended.Read 14 Oct 2026 · eramba.org
Use cases
Its listed use cases include risk management, compliance management, data privacy, incident management, awareness programs, automated account reviews and online assessments.Read 28 Sep 2026 · eramba.org

Plans and prices

Community Free Free Open and free version · Self-hosted deployment Read 21 Sep 2026 · eramba.org
Enterprise On-Premise €2,500 a year From 2500€/year Unlimited users and data · All modules included · Email support included Read 21 Sep 2026 · eramba.org
Enterprise SaaS €5,000 a year €5,000 per year unlimited users · unlimited data · EU or US hosting · backups and updates managed by eramba Read 14 Oct 2026 · eramba.org
Community On Premise Free Unlimited users and data · manual upgrades and backups · no support included Read 28 Sep 2026 · eramba.org
Community on-premises Free self-hosted · no user limit · no time limit · 4 of 7 use cases Read 14 Oct 2026 · eramba.org
Implementation workshop €800, paid once €800 each optional fixed-price workshop Read 14 Oct 2026 · eramba.org
Enterprise On Premise €2,500 a year €2,500 / year Unlimited users and data · all modules included · email support Read 28 Sep 2026 · eramba.org
Enterprise on-premises €2,500 a year €2,500 per year unlimited users · unlimited data · all modules · email support · updates Read 14 Oct 2026 · eramba.org
Enterprise SaaS €5,000 a year €5,000 / year Unlimited users and data · hosting in Europe or USA · updates and backups handled by Eramba · email support Read 28 Sep 2026 · eramba.org

Every Eramba plan and price →

Strong points and limits

Strong points

  • Includes more than 70 compliance packages.
  • Custom frameworks can be uploaded as CSV.
  • Supports REST APIs and outgoing webhooks.
  • Authentication options include LDAP, SAML, and Google OAuth.
  • Free Community version supports self-hosting.

Limits

  • Eramba is not a network scanner.
  • Community has no support included.
  • Community on-premises requires manual upgrades and backups.
  • Enterprise SaaS starts at €5,000 a year.

Who it suits

It suits GRC teams managing risks, controls, policies, compliance, and related review activities. Other departments and suppliers can provide review feedback, while administrators can choose on-premises or SaaS deployment.

Eramba in depth

Read the full write-up

Eramba is governance, risk and compliance software for organizations coordinating risks, controls, policies and compliance work. It suits GRC teams that need configurable workflows and input from other departments or suppliers. Its breadth and deployment choices are compelling, but it does not scan networks for assets.

Overview

Eramba brings together work spanning risk and compliance management, data privacy, incident management, awareness programs, automated account reviews and online assessments. The company says its team began building and sharing the tool in 2007. Its focus is managing GRC information, not discovering assets: organizations that need asset data can sync it from a configuration management database (CMDB) through the REST API.

Key features

Custom fields, granular access controls, notifications and dynamic status let teams shape how GRC information is recorded and tracked. Quantitative analysis, custom risk fields, workflow automation and scheduled risk reporting make it a fit for ongoing risk programs, not just static registers. The trade-off is that teams need to decide how their own processes should be represented.

More than 70 ready-to-import compliance packages provide a starting point for framework work; organizations can also upload a custom framework as a CSV. REST API requests and webhooks connect Eramba with other systems. Examples include creating SIEM incidents and Jira issues, while LDAP, SAML and Google OAuth support external authentication. LDAP synchronization is also documented.

Locally authenticated accounts have brute-force protection enabled by default, blocking further login attempts after incorrect credentials. That is a useful account safeguard, but it does not change the need to manage asset discovery separately.

Pricing

Eramba uses a freemium model, with free self-hosted Community options and paid Enterprise deployments. The free tier is most suitable for organizations able to operate the software themselves; Enterprise is the better fit when support or managed hosting matters.

Community: free, billed Free. The open, free version is self-hosted. Community On Premise is free and includes unlimited users and data, but upgrades and backups are manual and support is not included.

Enterprise On-Premise: From 2500€/year; also shown as €2,500 / year. It includes unlimited users and data, all modules and email support. Choose it when the organization wants to run Eramba on its own infrastructure but needs vendor support.

Enterprise SaaS: From 5000€/year. Eramba hosts the service, manages updates and backups, and provides cloud hosting in Europe or the USA. It includes unlimited users and data, making it the option for organizations that prefer managed operations.

Community saves the subscription cost but leaves upgrades, backups and operational responsibility with the organization. Enterprise On-Premise adds support and all modules; SaaS also shifts hosting and routine maintenance to Eramba.

Platforms

Eramba supports API, Linux, self-hosted and web access. Community and Enterprise on-premise installations are documented for Docker and VMware, with the Docker guide covering Linux host configuration. Organizations preferring hosted deployment can choose SaaS, with systems hosted in Europe or the USA and daily backups and upgrades handled by Eramba when releases become available.

Who it's for

Eramba is best suited to GRC teams managing risks, controls and policies, with other departments and suppliers contributing review feedback. It is a practical choice for organizations that want framework packages, configurable workflows and the ability to self-host or use SaaS. It is not the right standalone choice for teams whose primary need is network scanning; those teams should plan a separate discovery tool and can feed asset information from a CMDB into Eramba.

Pros and cons

Pro: More than 70 importable compliance packages plus CSV framework uploads give teams a broad starting point and a way to work with custom frameworks.

Pro: API requests, webhooks and external authentication options can connect GRC work to other systems and identity providers.

Pro: Unlimited users and data across Community and Enterprise plans avoid seat and data caps in the stated plan terms.

Con: Community has no support and requires manual upgrades and backups, which makes it a poor fit for organizations without the capacity to operate it.

Con: Eramba does not scan networks, so asset discovery must come from another system such as a CMDB.

Con: SaaS starts at twice the annual price of Enterprise On-Premise, a material premium for shifting hosting and maintenance to Eramba.

Alternatives

Internal Controls Software, Risk Management Software and Governance, Risk and Compliance Software offer broader category comparisons.

SmartSuite Enterprise Service Desk is worth considering for teams seeking a paid, cross-platform option with a free trial and a Team plan priced at $15 a month billed annually.

AssurAI may suit teams looking for a paid alternative with a free trial and project- and control-based Starter limits.

Soxify is an alternative for teams needing a free tier capped at five controls and 25 evidence requests per month, with evidence-pack export and an audit trail.

Workiva Audit Management is another paid option, with customized pricing and packaging based on organizational needs.

iShield GRC ICFR & SOX Compliance is a paid, self-hosted and web-based alternative.

Protecht may suit organizations seeking an annual-license ERM product with marketplace templates; pricing depends on named active users, and some modules cost extra.

RiskWatch SOX Compliance offers a paid alternative with a free trial and custom quotes based on team size, frameworks, deployment, integrations and contract length.

Sox Armor is another paid option with a free trial and a Starter plan priced at $299 a month.

Verdict

Choose Eramba if your GRC team wants broad framework support, configurable risk workflows and a choice between self-managed and hosted deployment. Its main advantage is the combination of that breadth with unlimited users and data across plans; look elsewhere or add a separate tool if network asset discovery is central to your requirements.

Verdict

Eramba combines GRC workflows, framework packages, integrations, and self-hosted or SaaS deployment. Organizations should account for the lack of network scanning and compare Community's manual operations with Enterprise support and hosting.

Where Specifiction places it

Alternatives to ErambaAll alternatives →