Your third-party risks deserve a real platform.
A self-hosted TPRM platform built for DORA compliance: manage ICT third-party providers, assess risks, track contracts and generate your EBA register of information, entirely on your own infrastructure.
Score and monitor, don't guess.
Score risk across operational, security, compliance, financial and concentration dimensions.
- Operational
- Security
- Compliance
- Financial
- Concentration
- Contractual arrangements
- Art. 30 compliance
- SLAs
- Renewal dates
One register, always audit-ready
Every ICT provider in one place: criticality, risk score, contract and exit-plan status, all mapped to the DORA register.
ICT third-party providers · 48 registered
register up to dateMade for the people who own the risk
Whatever your seat at the table, tprm.mlab.sh gives you exactly what you need to meet DORA Pillar IV.
Stop rebuilding the register by hand.
Compliance Officer"Every reporting cycle I rebuild the register of information from a dozen spreadsheets and hope nothing's stale."
- A consolidated register, 15 EBA templates generated automatically, referential validation, and a deposit-ready xBRL-CSV package.
Score and monitor, don't guess.
Risk Manager"I need a defensible risk score per provider and a clear view of where we're over-concentrated."
- Five-dimension scoring with history and review dates, plus concentration analysis by category and geography.
A view you can take to the board.
CISO & Management"I want one consolidated picture of our ICT third-party ecosystem and our regulatory readiness."
- Live dashboards, compliance progress bars, top-risk providers and expiring contracts, exportable on demand.
All 15 templates, generated for you
Every module feeds the register. tprm.mlab.sh aggregates your data into the complete set of EBA ITS templates with controlled eba_* codes.
GRC-grade compliance, without the GRC price tag
Enterprise GRC suites charge six figures. Spreadsheets cost zero but lose every thread. tprm.mlab.sh sits between: a proper, DORA-specific platform you actually own.
Your infrastructure, your data
Runs entirely on your servers. We never see your providers, contracts or assessments. No SaaS, no exfiltration risk.
5 minutes to running
docker compose up and you're done. App, MySQL and ClickHouse included. Migrations run on startup.
DORA-specific, not generic
Every module maps to a DORA article and EBA code. Not a generic vendor-risk tool bent into shape.
Stop using spreadsheets for DORA compliance
| Spreadsheets & drives |
Enterprise GRC |
Generic TPRM SaaS |
tprm.mlab.sh | |
|---|---|---|---|---|
| Self-hosted | ||||
| Deploy in < 5 min | ||||
| DORA-specific | ||||
| EBA ITS export | ||||
| Risk scoring | ||||
| REST API | ||||
| Free tier | ||||
| No vendor lock-in |
A register you can defend
docker compose up · App, MySQL and ClickHouse includedeba_* codes"DORA didn't ask for another spreadsheet. It asked for a register you can defend, where the provider, the contract, the risk and the exit plan all live together. That's the whole product."
Common questions
- Is my compliance data sent to mlab.sh?
- No. The only outbound call is a license check every hour. No provider, contract, assessment or register data ever leaves your infrastructure.
- Does it produce a real DORA register of information?
- Yes. It generates all 15 EBA ITS templates (Reporting Framework 4.0) with controlled EBA codes, runs a referential integrity validation, and builds the deposit-ready xBRL-CSV (
.zip) package matching the official structure. - Can I run it fully offline?
- Yes, for up to 7 days at a time: the instance keeps the signed license from its last check. Beyond that it locks until you restore outbound HTTPS to mlab.sh for the hourly license check.
- What does the free tier include?
- Up to 5 ICT providers and 3 users, with dashboard, provider management, contracts, risk assessments and third-party incidents. DORA register, EBA export, exit strategies, due diligence, audits and analytics are unlocked on the Licensed tier.
- What stack does it run on?
- Rust / Actix-web with MySQL for business data and ClickHouse for analytics. Deploy the whole stack with a single
docker compose up. Database migrations run automatically on startup.
Ready to take control of your third-party risks?
Free tier included. No credit card. Up and running in under 5 minutes.