CyberGrant: empowering your compliance with smart security

The regulations change, the underlying requirement stays the same

GDPR, NIS2, DORA, the AI Act, plus sector rules like IVASS and EIOPA in financial services and HIPAA for organizations handling US health data: the obligations have multiplied, each with its own language, deadlines, and penalties.

Underneath, though, they converge on a single technical point: making sure data stays confidential and verifiable even when it leaves the systems that created it. Encryption at the source and control over who has access are the common denominator of almost every requirement. That is where compliance is best built, before you get to the individual obligation.

GDPR AND ENCRYPTION

When data is unreadable, a breach weighs far less

Article 32 of the GDPR calls for appropriate technical measures and puts encryption near the top. There is a practical effect that often gets overlooked: if exfiltrated data stays encrypted and unintelligible, the obligation to notify data subjects of the breach (Article 34) may no longer apply. Encryption pays off twice: it satisfies the requirement and it reduces the impact when something goes wrong.

For organizations handling US health data, the HIPAA Security Rule points the same way.

FileGrant encrypts files at creation and keeps that protection even outside your systems; with EmailGrant, the same logic covers messages and attachments. The encryption we use already looks to the post-quantum standards being adopted at NIST, built for data that has to stay confidential for years.

NIS2

NIS2 pushes accountability all the way to the top

Directive (EU) 2022/2555, transposed in Italy through Legislative Decree 138/2024, raises the bar for essential and important entities and assigns direct accountability to management bodies. Among the requirements: access control, activity logging, and prompt incident notification.

Here you need two safeguards working together, on files and on endpoints. FileGrant governs who opens each document and allows immediate revocation when something looks off; RemoteGrant monitors devices and records activity, so an incident becomes detectable and reportable within the timelines the directive sets.

DORA

DORA: resilience applies to the data you hand to third parties too

Regulation (EU) 2022/2554 requires the financial sector to achieve digital operational resilience and to keep tight control over ICT third-party risk.

The moment a file goes out to a supplier, a consultant, or a counterparty, responsibility for the data still rests with you..

FileGrant extends control beyond the company boundary: role-based access, expiration dates, revocation after sharing, and a trace of every open.

RemoteGrant applies encryption and policies on endpoints and blocks unauthorized transfers in remote sessions, a sensitive point for banks and insurers also subject to IVASS and EIOPA

AI ACT E SHADOW AI

AI compliance starts before the data reaches the model

The AI Act adds new obligations while the GDPR's remain fully in force. The most concrete risk, meanwhile, has a name: Shadow AI, employees pasting confidential documents into public chatbots.

Data leaves your control the instant it is sent to an external LLM.

AIGrant brings artificial intelligence inside the perimeter: it queries your documents in natural language without exposing them to public models, and it inherits permissions and classification from the files themselves.

The productivity of AI stays available, and so does the confidentiality of the data.

AUDIT AND CHAIN OF CUSTODY

Audits ask for evidence, and evidence lives in the logs

GDPR, NIS2, and DORA converge on a very practical demand: proving who did what, when, and with what authorization. The HIPAA Security Rule adds the same expectation for US health data, with audit controls that require recording and examining activity in systems that hold electronic PHI.

The hardest threat to catch here is the legitimate insider, someone who holds valid access and uses it beyond what the role requires.

Every action on files protected with FileGrant leaves an unalterable trace (creation, opening, editing, sharing, revocation), ready to present during an audit. SecretGrant applies the same principle to credentials and API keys, among the first targets for anyone trying to move laterally across the network.

Compliance doesn’t have to be complicated

CyberGrant solutions integrate data protection, access management, AI governance, and process auditing within a secure, centralized ecosystem.

We simplify compliance and reduce risks while ensuring full control, traceability, and transparency across every device and user.

GDPR_w NIS2_w DORA_w HIPAA_w

Explore the solutions

Domande frequenti

Which regulations require encrypting company data?

No regulation mandates a specific algorithm, but several require encryption appropriate to the risk. Article 32 of the GDPR explicitly names encryption among appropriate technical measures; NIS2 and DORA require protection, access control, and traceability. In practice, organizations use AES-256 for data at rest and TLS 1.3 in transit, with a transition toward post-quantum standards for data that must stay confidential for years.

Does encryption remove the obligation to notify a data breach?

Not always, but it makes a real difference. Article 34 of the GDPR provides that notifying data subjects of a breach may not be required if the data involved was protected by measures, such as encryption, that make it unintelligible to anyone unauthorized. Other obligations still apply, including notification to the supervisory authority under Article 33.

What does NIS2 require of companies?

Directive (EU) 2022/2555 was transposed in Italy through Legislative Decree 138/2024. It requires essential and important entities to adopt risk management measures, access control, activity logging, and prompt incident notification, with direct accountability for management bodies. In Italy, the most current implementing reference is the National Cybersecurity Agency (ACN) Determination 127437 of 13 April 2026.

How does DORA apply to ICT third-party risk? Regulation (EU) 2022/2554, applicable since 17 January 2025, requires the financial sector to achieve digital operational resilience and to keep tight control over ICT providers. Responsibility for the data stays with the financial entity even when a file is entrusted to a supplier or counterparty: it calls for role-based access, revocation after sharing, and a trace of every open.

What is Shadow AI, and why is it a compliance problem?

Shadow AI is the ungoverned use of public AI tools by employees, for example pasting confidential documents into an external chatbot. Data leaves company control the instant it is sent to an external LLM, creating risk under the GDPR and the AI Act. A private, on-premise AI keeps documents inside the perimeter.

How do you demonstrate compliance during an audit?

GDPR, NIS2, and DORA converge on a practical demand: proving who did what, when, and with what authorization. It requires unalterable logs of actions on data (creation, opening, editing, sharing, revocation), extendable to credentials and API keys as well. The hardest threat to catch is the legitimate insider, who uses valid access beyond what the role requires.

How does CyberGrant support HIPAA compliance for US health data? HIPAA's Security Rule sets technical safeguards for electronic protected health information (ePHI): access control, audit controls, integrity, and transmission security. File-centric protection maps directly to these. FileGrant encrypts ePHI, controls who can open it, keeps an unalterable audit trail of every action, and lets you revoke access after sharing. Encryption is currently an addressable specification under HIPAA; a proposed 2025 update, still pending as of mid-2026, would make it mandatory, with AES-256 at rest and TLS 1.2 or higher in transit. CyberGrant provides the technical controls; full HIPAA compliance also depends on your administrative safeguards and policies.

Compliant because protected: compliance that starts with the data