Learn more about the product
See DORApp in action.
The full feature list, the live product tour, partner logos, the 14-day free trial, and the link to book a 45-minute demo with the team that built it — all at dorapp.eu.
Case study · Regtech · SaaS · Financial services
From Excel cycles to provable resilience.
DORApp is the platform we built for European financial institutions wrestling with the EU's Digital Operational Resilience Act. Continuous controls, automated regulatory reporting, an audit trail for every change — and the move from "compliant on paper" to provably resilient in practice.
DORAppby HoliSentra · a U-centrix venture
Live · EU-wideForbes Slovenija
— Business · 03 May 2026 —
"Finančnike zaradi novih pravil boli glava. Mariborčani v njih vidijo priložnost."
New European rules on digital resilience created a major challenge for financial institutions — and a Maribor-based company saw an opportunity to develop a dedicated application for easier reporting to European institutions.
"Companies previously treated risk and compliance in annual cycles. DORA requires continuous monitoring — something companies must control every day."
The article identifies Joachim Heidebrecht, Matevž Rostaher, and Uroš Orešič as the people behind DORApp, the platform now used by more than 30 financial institutions across Slovenia and Germany.
forbes.n1info.si · DORApp · regtech
PressForbes Slovenija · 3 May 2026
"A Maribor-based company saw an opportunity where everyone else saw a regulatory headache."
"DORApp is not a tool for intrusion scanning or technical security testing — it's a GRC tool for management-level monitoring, analysis, and decision-making. The real competitor isn't another platform. It's Excel."Read the full Forbes article
What we created
The end of checkbox compliance.
DORA created a major shift for European banks, insurers, and investment firms — they have to understand and control their digital dependencies, ICT third-party providers, risks, incidents, and evidence trails. Annual spreadsheets don't cut it any more.
The original push came from a German insurance association that recognised how difficult it would be to maintain accurate, up-to-date DORA records with Excel or generic GRC tools. We built DORApp as the answer — a cloud-based platform that moves institutions from "checkbox compliance" to "provable resilience", with traceable workflows, approvals, data quality controls, and audit-ready records.
It's modular. An institution can start with the most urgent pain point — usually the Register of Information — and expand into risk management, incident reporting, and AI-assisted contract review as they grow into the regulation. Each module works independently. Together, they create automation, consistency, and an audit trail nobody else has to maintain by hand.
The six modules
One platform, six critical pillars.
DORApp covers every DORA pillar through interconnected modules. Pick what you need now, add the rest as you go.
— Module 01
Register of Information (RoI).
Keeps your RoI always up to date, validated, and regulator-ready — eliminating spreadsheets and fragmented data, fully aligned with DORA requirements.
- Import from Excel, CSV, XBRL, RMM or contract management systems
- Manage all ICT third-party providers, contracts and key details
- Auto-enrich from public sources (LEI database) to fill gaps and confirm accuracy
- Validate against ESA rules automatically
- Generate fully compliant reports with one click
— Module 02
Third-Party Risk & Questionnaire Automation.
Identify, evaluate, and track third-party risks in one place — fully aligned with DORA's risk management framework. Achieve complete automatic ICT supply chain oversight and stop validating LEI by hand.
- Send and manage questionnaires automatically
- Collaborate with ICT third-party providers
- Assess third-party risks and compliance
- Business impact analysis (BIA) for critical services
- Assign tasks, set deadlines, monitor progress
- Periodic review reminders built-in
— Module 03
Incident Management & Reporting.
A straight path to capture, track, and report ICT-related incidents — fully aligned with DORA's strict timelines and formats.
- Log incidents in real time, categorize and track status until resolution
- Generate regulator-ready reports (initial notifications, follow-ups, final summaries)
- Meet DORA timelines (24h, 72h, 1-month reporting)
- Assign tasks and monitor accountability
— Module 04
Risk Management & Governance.
Create transparency across all DORA compliance activities. Document policies, assign responsibilities, and keep evidence ready for audits and supervisory reviews.
- Document and monitor policies, processes, risks, assets, controls and projects
- Assign responsibilities and approvals
- Support governance bodies with dashboards
- Keep evidence ready for audits and supervisory reviews
— Module 05
ICT Resilience Testing.
Document ICT resilience testing, findings, and corrective actions — keeping complete audit-ready evidence for every test cycle.
- Plan and record ICT tests
- Capture findings and weaknesses
- Assign remediation actions
- Track closure and acceptance
- Maintain audit-ready evidence
— Module 06
DORAssistant — AI agent.
DORAssistant is our AI agent, designed specifically around clients' needs in the field. It's like having a compliance expert by your side: instant answers, guided data entry, and automated reporting.
- Reviews contracts for DORA compliance in seconds
- Independently enters contracts into the RoI
- Answers DORA questions in the context of your institution
- Guided data entry and automated reporting
How it fits
Between the institution and the regulator.
DORApp sits as the single source of truth between financial institutions and the European supervisory authorities — automating the flow of evidence, registers, and incident reports both ways.
— DORApp system architecture · regulatory data flow —
30+
Institutions
Slovenian banks, German insurers, Latvian investment firms — and growing.
27
EU countries
Guaranteed regulator-ready filings across the full EU footprint.
€100K
Year-1 revenue
Market validation in the conservative financial-services buyer base.
100%
SLA met
Every DORA incident report filed inside the 24h / 72h / 1-month window.
Why teams choose DORApp
Confidence in compliance, without the complexity.
Built for compliance officers who can't afford a missed deadline — and for boards who need to see resilience, not paperwork.
— 01
Compliance, guaranteed.
With a few clicks DORApp generates regulator-ready reports in XBRL, XML, XLSX, or other mandated formats — validated against official taxonomies and guaranteed to be accepted by national and EU authorities.
— 02
Smarter data entry, auto-enriched.
An intuitive web interface with built-in validation. The platform automatically enriches records with verified data from public sources like the LEI database — minimal manual effort, maximum accuracy.
— 03
Proactive risk management.
Step-by-step risk assessments, business impact analyses, and mitigation planning — with reminders for scheduled reviews. Risks stay tracked, updated, and linked to controls.
— 04
Stress-free incident reporting.
Structured workflows for logging, classification, and escalation. Auto-generated regulator-ready incident reports tracked through to resolution — DORA's 24h, 72h, and 1-month deadlines met without overtime.
Client voices
What clients actually say.
Three customers, three countries, one consistent message: the support behind the platform matters as much as the platform itself.
"
★★★★★
"We've had an absolutely fantastic experience with DORApp and the team behind it. DORApp is more than software — the team has proven time and again to be excellent professionals with deep knowledge of EU regulation. The support is stellar."
"
★★★★★
"I'm still thrilled. We were looking for a simple solution for the DORA Register of Information reporting. I doubted DORApp could be tailored so quickly to deliver such a polished result. Instead of creating a maintenance burden, DORApp is precisely what we need — a streamlined reporting platform."
"
★★★★★
"DORApp is an excellent solution for managing DORA RoI requirements — intuitive, transparent, clearly built with regulatory practitioners in mind. The fantastic support team is responsive, knowledgeable, and genuinely helpful throughout onboarding and day-to-day usage."
Outcomes
Be fully compliant, confident, transparent.
DORApp's promise to every institution: every requirement covered, every action logged, every report defendable.
— 01
Fully
compliant.
Every DORA requirement covered: Register of Information, risk management, incident reporting, outsourcing, audit trails — all in one place. EBA Guidelines on Outsourcing included.
— 02
Fully
confident.
Guaranteed compliance, validated reporting, complete oversight. DORApp gives compliance officers and boards peace of mind at every step — and a guarantee written down.
— 03
Fully
transparent.
Every action logged immutably, every risk monitored, every dashboard giving management and auditors instant visibility. Prove compliance at any moment, to any regulator.
— Let's talk —
Got a regulation that won't sit still?
A 30-minute call with our CEO or technical lead. No sales script, no obligation — just a real conversation about what you're trying to solve.
Book a call