Third-party risk management, built for DORA.
A self-hosted platform that covers the full ICT third-party lifecycle: governance, risk, contracts and the EBA register of information, entirely on your own infrastructure.
One platform for the whole DORA Pillar IV obligation
tprm.mlab.sh is a self-hosted Third-Party Risk Management platform covering both sides of DORA: the day-to-day governance of ICT providers, and the regulatory production of the Register of Information.
TPRM governance
The full lifecycle: due diligence, contracts, risk assessments, audits, exit strategies and third-party incidents, for every ICT provider you depend on.
DORA Register of Information
The 15 EBA ITS templates (Reporting Framework 4.0) with controlled eba_* codes, referential integrity validation, and a deposit-ready xBRL-CSV .zip package matching the official structure.
The four-stage lifecycle
Register, Assess, Contract, Report: one consistent platform from onboarding to deposit.
Who is it for?
Everyone who owns a piece of DORA Pillar IV, from the people who file the register to the people who answer to the board.
Compliance Officers
Stop rebuilding the register by hand. A consolidated register, 15 EBA templates generated automatically, integrity validation and a deposit-ready package.
Risk Managers
Defensible risk scores per provider across five dimensions, with history and review dates, plus concentration analysis by category and geography.
DPOs
Track data-storage flags, locations at rest and in processing, data sensitivity and applicable-law country: captured per contract and surfaced in the register.
CISOs & Management
One consolidated picture of your ICT third-party ecosystem and regulatory readiness: live dashboards, compliance progress and top-risk providers.
Mapped to the regulation, not bent into shape
Every module maps to a DORA article and an EBA ITS template. Here are the highlights.
- B_06.01
- Business functions. Identify critical/important functions supported by ICT providers, with RTO/RPO and discontinuity impact.
- B_05.02
- Subcontracting chains. Map ICT supply chains with rank, LEI and one of 19 official ICT service-type codes.
- Art. 30
- Exit strategies. Document, version and test exit plans for critical ICT dependencies.
- Pillar IV
- Third-party incidents. Report, investigate and resolve incidents involving providers, with lessons learned.
- B_01.01
- Reporting entity info. Identify the financial entity maintaining the register, with LEI, country and entity type.
- Art. 30
- Article 30 checklist. Verify contractual clauses required by Art. 30(2) and Art. 30(3) for critical functions.
Self-hosted, private, yours
Your compliance data never leaves your infrastructure. Deploy the full stack with one command. No SaaS dependency, no vendor lock-in.
docker compose up brings up app and databases. Built and shipped via GitHub Actions to GHCR.Why not spreadsheets, GRC suites or generic SaaS?
Enterprise GRC suites charge six figures. Spreadsheets cost zero but lose every thread. Generic TPRM SaaS wasn't built for DORA. tprm.mlab.sh sits where they don't.
| Alternative | tprm.mlab.sh |
|---|---|
| Not spreadsheets | DORA didn't ask for another spreadsheet. It asked for a register you can defend, with referential integrity and controlled EBA codes, not formulas that break. |
| Not enterprise GRC | GRC-grade compliance without the GRC price tag or the year-long rollout. Self-hosted, no per-seat extortion, running in five minutes. |
| Not generic SaaS | Every module maps to a DORA article and EBA code: B_05.01, Art. 30, B_07.01. Not a generic vendor-risk tool with a compliance sticker. |
Ready to take control of your third-party risks?
Free tier included. No credit card. Up and running in under 5 minutes.