Compliance Software Cannot Make You Compliant — And Buying It Once Raises a Question Worth Asking
Deadline timers and audit records are software problems. Legal sufficiency is not. Here is the honest line between them, why a one-time licence suits one side and not the other, and the question to ask any vendor in this category.
Every vendor in this category is selling you the same implied promise, and almost none of them say it out loud: buy this and you will be compliant.
None of them can deliver it. What they can deliver is narrower, genuinely useful, and worth paying for — and the distinction matters more here than in any other software category, because getting it wrong has a regulator on the other end.
The line
What software can actually do:
- Count days. A request arrived on the 3rd; the duty says thirty days; the deadline is the 2nd. That is arithmetic.
- Keep a record. Who asked, when, what was done, by whom, and when it closed — in a form you can export and hand over.
- Prompt somebody. Before the deadline, not after.
- Enforce a workflow. So a request cannot quietly sit in an inbox nobody owns.
What software cannot do:
- Decide whether your response was legally sufficient.
- Know what your regulator expects of your sector.
- Notice that the law changed.
The first list is a records-and-timers problem. The second is a professional-judgement problem. Any vendor blurring them is selling you a feeling, and you should read their disclaimer before their feature list.
Credit where it is due: three products that say so themselves
We read three self-hosted compliance tools' own FAQs on 1 August 2026. All three refuse the implied promise in the first answer:
Privara — "Does this make me GDPR-compliant?" — "No — it helps you meet the deadline and maintain an auditable record of every request; whether your responses are legally sufficient is your responsibility and depends on your jurisdiction and the specifics."
Complia — "Does this make me DUAA-compliant?" — "No tool can claim that. Complia implements the record-keeping and acknowledgement mechanics the duty describes; your policies, responses, and legal position are yours."
Safora (food safety) — "Is this a legal guarantee of compliance?" — "No, and any tool claiming that should worry you."
"Any tool claiming that should worry you" is the correct instinct for buying in this category, and it applies to hosted vendors just as much — Enzuzo, Osano, Whistlelink and FaceUp are subject to exactly the same limit.
The question a one-time licence has to answer
Here is the uncomfortable part, and we would rather raise it than have you discover it.
Most software we sell has stable logic. A rota is a rota; the arithmetic of who works Thursday does not change when a parliament sits. A one-time licence fits that perfectly.
Compliance tools are different: some of their logic is legislated, and legislation moves. If a duty's acknowledgement window changes from thirty days to forty-five, or a new field becomes mandatory, a tool you bought once needs an update to stay correct — and "12 months of updates" answers a security question, not a legal one.
So ask any vendor in this category — including us — two things:
- Which parts of the product encode a legal rule (a deadline length, a required field, a retention period), and which parts are just record-keeping?
- What happens when that rule changes? Who tells you, and what does the update cost?
This is the single most useful question in this whole article, and almost nobody asks it at purchase.
Why these particular tools survive it reasonably well
Look at what each one actually encodes:
- Privara tracks "All five GDPR rights — Access, Deletion, Rectification, Portability, and Objection" with deadline tracking and an audit log. The five rights and the deadline are the legislated parts; the portal and the log are not.
- Complia runs "a 30-day acknowledgement timer and audit CSV export." The 30 is the legislated part. The timer, the register and the export are not.
- Confida does "anonymous case codes and EU Directive 2019/1937 SLA tracking." The SLA durations are legislated; the case handling is not.
In each case the legislated surface is small and numeric — a count of days, a list of request types. That is the best possible shape for a one-time purchase in a moving legal area: when the number changes, the change is a configuration or a small update, not a re-architecture.
*A tool that instead claims to encode legal judgement* — to tell you whether a response is adequate — would be both more impressive and far more dangerous.** None of these do.
The most honest thing we found in the category
Complia's FAQ does something we have not seen another vendor do: it dates the legislation, states the commencement position, and tells the reader to go and check it themselves.
"The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and the complaints-handling duty in s.103 was set to commence 12 months later. Verify the current commencement position on legislation.gov.uk."
A compliance vendor pointing you at the primary source rather than asking you to trust its summary is the behaviour you should look for. And you should do it — commencement dates move, and a vendor's page is not the statute.
What the hosted options cost
| Vendor | Published price | Note |
|---|---|---|
| Enzuzo | $9/month (Starter, monthly) — includes 10 DSARs/month | (read 2026-07-05) |
| Whistlelink | EUR 79/month (0–49 employees tier, billed annually) | (read 2026-07-05) |
| Osano | No public price — quote-gated | (read 2026-07-05) |
| FaceUp | No public price — quote-gated | (read 2026-07-05) |
Note Enzuzo's unit: ten DSARs a month. For most small organisations that is generous; for one having a bad quarter it is a cap, and caps are where hosted pricing surprises people.
Against those, the self-hosted registers are $49 (Privara), $69 (Complia) and $119 (Confida), one time (product pages, read 2026-08-01).
One product detail worth reading before buying anonymity
Confida makes a trade-off that most whistleblowing vendors would hide, and states it plainly:
"A reporter lost their case code or passphrase — can we recover it?" — "No — there's no account and no email, so there's no reset; that's the trade-off for genuine anonymity, and it's stated clearly on the 'save these' screen."
That is what real anonymity costs, and a vendor who offers both perfect anonymity and password recovery is offering one of them falsely. Decide whether your reporters can live with it before you deploy it, because you will not be able to help them afterwards.
Who should self-host compliance registers
Yes if: you are a small organisation with a real but low-volume duty — a handful of DSARs a year, a whistleblowing channel you must legally provide, a complaints register you must be able to produce. The record is the deliverable, and a one-time register produces it.
Yes, particularly, for whistleblowing: a report that never leaves your infrastructure is a materially different privacy posture, and the free incumbent in that space (GlobaLeaks) is described even by its own reviewers as "best suited to media organizations and NGOs handling high-risk disclosures rather than standard corporate HR compliance."
No if: you need legal advice, sector-specific certification support, or a vendor who will stand behind your regulatory position. Buy a platform with a compliance team, or hire an adviser. Software is not either of those.
No if: you have not asked the update question above and got an answer you are happy with.
The honest costs
The record is the point, so backups are the obligation. If a regulator asks for your complaints register and you cannot produce it, "the server failed" is not a defence.
Deadline alerts must actually fire. Monitor the cron. A missed thirty-day acknowledgement is the exact failure the tool was bought to prevent.
You still own the legal judgement. Every one of these products says so; we are repeating it because it is the thing people forget by month three.
Hosting. All run on ordinary shared hosting. For a concrete number from a named provider: Hetzner's own pricing — machine-read from the price API behind their pricing pages on 10 Aug 2026 — lists web-hosting plans from €1.60 to €16.72 a month and entry cloud servers from €3.99 a month (prices as returned for their German datacenters; confirm current pricing and VAT treatment at checkout). Any comparable host works — the point is that the "own" side of this comparison costs single-digit euros a month.
The short version
Compliance software counts days and keeps records. It does not know the law and it cannot vouch for your answers — and the three self-hosted tools we read all say so in their own first FAQ answer, which is the right instinct.
Before buying anything in this category, ask which parts encode a legal rule and what happens when that rule changes. The tools that survive that question are the ones whose legislated surface is a number — a deadline, a list of rights — rather than a judgement.
And if a vendor tells you their product makes you compliant, believe the one that told you it cannot.
Next steps
- Privara — self-hosted GDPR DSAR portal
- Confida — self-hosted whistleblowing portal
- Self-hosted compliance tools
- The SaaS Price Observatory — where quote-gated vendors are recorded as quote-gated
This article is about software, not law. Nothing here is legal advice, and commencement dates and duties change — check the primary source for your jurisdiction, as one of the vendors quoted above explicitly tells its own customers to do.