Evidence, in four tiers.
From a first assessment to a complete audit evidence package. Scan result in 90 seconds — tamper-evident, so auditors can verify online without calling you.
Billed in EUR · Stripe · Formal invoicing on request · Reverse charge for DACH businesses
Available instantly. No request needed.
CERTavia comes in two modes. If you need verified evidence for a defined point in time, choose Basic or Pro. If you need to continuously satisfy DORA, NIS2 or internal governance requirements, choose Annual Starter, Annual Subscription or Enterprise with regular re-scans.
Still unsure whether CERTavia is right for you?
Free quick test – Annex III risk in 2 minutesWhat CERTavia checks: 6 clusters, 80+ parameters
The overall result is binary: CERTIFIED (CES score ≥ 75 & Cluster F ≥ 40) or FAILED. No probabilistic scoring.
What does the finished certificate actually look like?
View sample certificate (PDF)Basic or Pro — the right choice in 30 seconds
Basic (EUR 490) — if …
- You need point-in-time evidence for a board presentation or a first audit
- Vault access within the next 90 days is enough
- You'll archive the PDF locally and don't need permanent online verification
Pro (EUR 1,490) — if …
- An auditor needs to access the evidence in 6–24 months (vault is permanent)
- You want to export the evidence into your GRC system or integrate via API
- You're preparing DORA reporting or a conformity assessment dossier
- You need up to 5 scans per year for this domain
Not sure? Start with the free scan — you can choose Basic or Pro after seeing the result.
A point-in-time snapshot, ideal for a first check or board presentation.
- 80+ parameter full scan
- PDF audit report referencing infrastructure-relevant aspects of Art. 50
- SOVP-CERTIFIED / SOVP-FAILED with cluster detail
- Cryptographic signature + timestamp
- Sovereign Vault link accessible for 90 days — the PDF and cryptographic signature remain permanently valid and submittable to auditors (What does that mean?)
- JSON + CSV protocol output
- Critical findings with recommended actions
- Customer portal access on request
For audit and GRC teams embedding evidence into existing compliance workflows — machine-readable, API-capable, DORA-ready.
- Everything in Basic
- Machine-readable verification URL for auditors
- API output with Art. 50 infrastructure reference
- Art. 50 relevance rating per cluster
- DORA report
- API token for GRC integration
- Suitable for conformity assessment dossier
- Sovereign Vault permanently retrievable via token
- Customer portal access included
A one-time portfolio check for agencies and auditors — no subscription like Annual, no single-domain limit like Basic/Pro.
- Everything in Pro, per audited domain
- 20 domain scans in one purchase, no expiry
- Consolidated portfolio overview report
- Portfolio traffic-light across all audited domains
- Ideal for agency clients or due-diligence reviews
- Customer portal access included
CERTavia delivers the cryptographically verifiable infrastructure building block for EU AI Act compliance documentation: deterministic, machine-readable, in 90 to 120 seconds.
Prices in EUR (plus VAT for B2C, reverse charge for B2B within the EU as well as for businesses in Switzerland and Austria). Billed via Stripe. Stripe receipt sent automatically after payment. Formal invoice on request via our contact form. Our terms · DPA, Art. 28 GDPR · privacy policy apply.
Purchase on invoice
If your procurement process requires an invoice-based order, we handle this for Basic and Pro products by email. Invoice with company address, VAT ID and a 14-day payment term — Stripe checkout is not required.
Send us the domain, the chosen product (Basic EUR 490 / Pro EUR 1,490), and your company address and VAT ID at [email protected] or via the contact form.
The scan starts immediately after payment is received. The PDF report and Sovereign Vault token are delivered by email — typically within 2–3 minutes of payment confirmation.
For anyone who needs to demonstrate compliance continuously.
From DORA compliance for SMBs to Enterprise SLA for regulated large enterprises — every Annual plan includes automatic re-scans and change notifications.
- 1 domain
- 80+ checks across 6 clusters
- CERTIFIED/FAILED verdict
- Permanent Sovereign Vault
- Badge
- Quarterly re-scans (automatic, every 90 days)
Founding Client: 50% off in year one for the first 20. EUR 145 instead of EUR 290, then the regular EUR 290/year. Code: SOLOFOUNDING50Q7X. The most affordable entry into continuous DORA and NIS2 monitoring.
As a Founding Client: structured feedback and the option to be named as a Founding Client, with your approval.
Get started — EUR 290/yearStripe · Invoice with VAT ID on request · Cancel anytime
- 4 re-scans per year (automatic, quarterly)
- Annual certificate per domain
- Change notification on status degradation
- Benchmark comparison: positioning vs. DAX 40 companies
- API token for GRC integration
- All Pro features, for all 5 domains
For SMBs and regulated companies building DORA or NIS2 evidence with a fixed annual budget. No contact form needed — get started directly online.
Get started — EUR 2,900/yearStripe · Invoice with VAT ID on request · Cancel anytime
- Quarterly re-scans (automatic, every 90 days)
- Annual evidence per domain
- Change notification on status degradation
- Consolidated annual report
- Benchmark comparison: positioning vs. DAX 40 companies
- API token for GRC integration
- All Pro features, for all domains
- EUR 396 per domain at 25 domains
For organizations with ongoing audit requirements and multiple domains in their portfolio.
Details & inquire- Unlimited domains under monitoring
- Automatic monthly re-scans
- SLA: 99.9% uptime · 4h response
- Consolidated infrastructure evidence with Art. 50 reference and NIS2/DORA mapping
- Benchmark comparison: positioning vs. DAX 40 companies
- API access for GRC platform integration
- Dedicated support
- White-label option on request
What others cost. What CERTavia delivers.
| Solution | Cost | Turnaround | Cryptographic | Automated |
|---|---|---|---|---|
| ISO 27001 certification | €15,000–€50,000 | Months | — | — |
| SOC 2 Type II | €20,000–€80,000 / year | 12 months | — | — |
| Big Four DORA audit | €25,000–€100,000 | Weeks | — | — |
| GRC platform (e.g. Credo AI) | $50,000–$200,000 ARR | Weeks | — | Partial |
| CERTavia Pro | EUR 1,490 | 90–120 sec. | ✓ | ✓ |
CERTavia complements manual audits as a Layer-0 infrastructure proof: deterministic, cryptographically signed, immediately audit-ready.
Infrastructure changes. The evidence documents a point in time.
The 90-day vault availability reflects technical reality: domain infrastructure changes continuously. Evidence from six months ago attests to the state from six months ago.
Evidence in 90–120 seconds.
Scan the domain, buy the report, use the evidence — the result is ready in 90 seconds. For Enterprise inquiries, API integration and procurement.
Questions about purchasing and the products
Is this an official certification?
No. CERTavia does not issue a government-recognized certificate. The result is a technical infrastructure proof — cryptographically signed, machine-readable. Official conformity assessments under Art. 43 build on evidence like this. More in the glossary →
Who recognizes this evidence?
The SOVP evidence is designed as technical proof for internal compliance teams, external auditors and clients. DNS-anchored and cryptographically signed — any party can independently verify the authenticity and timing of the check without involving CERTavia.
How long is a report legally usable?
The SOVP evidence documents the infrastructure state at scan time with a cryptographic timestamp. EU AI Act Art. 50 is an ongoing compliance obligation — we recommend re-scans at least annually. For audit dossiers and retention obligations: Full Scan Pro with a permanent Sovereign Vault.
What does a scan for 10, 50 or 200 domains cost?
Single scans are available at standard rates (Basic EUR 490 or Pro EUR 1,490). For larger volumes from around 10 domains, Enterprise terms with volume discount, API access and centralized reporting are available. Inquire about Enterprise → API access details: View API documentation →
Do I get a formal invoice?
After purchase you automatically receive a Stripe receipt by email. For formal invoices (with company address, VAT ID, etc.) use our contact form. All prices exclude statutory VAT. CH/AT: reverse-charge applies.
How do I get access to the customer portal?
For Pro, Portfolio Audit, Annual Starter, Annual Subscription and Enterprise, customer portal access is enabled automatically upon purchase — no separate account setup needed, login via email link tied to your purchase address (no password required). Your scan credits don't expire there and can be redeemed anytime. For Basic (a single scan), delivery is still by email via the scan access code; customer portal access is available on request via our contact form.
CERTavia analyzes technical infrastructure signals. The result is a machine-readable finding, not a legal opinion and not a certification within the meaning of the EU AI Act conformity assessment under Article 43. For legally binding compliance assessments, consult an accredited conformity assessment body.