{"head":{"title":"DORA for Software Teams: ICT Risk and Incidents | OceanLab","description":"What DORA means for software teams: ICT risk management, incident reporting clocks, resilience testing and third-party risk. Not legal advice.","canonical":"https://oceanlab.in/compliance/dora"},"slug":"dora","stats":{"builds":8,"industries":7,"countries":7},"featured":[{"meta":{"slug":"skanse","industry":"regtech","projectType":"GRC platform","country":"dk","tags":["fintech","enterprise"],"compliances":["DORA","ISO/IEC 27001:2022","EBA Outsourcing Guidelines","TIBER-DK","ISAE 3402","GDPR","Danish Data Protection Act","NIS2"],"cover":{"src":"/case-studies/skanse/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Skanse - GRC Platform for Risk, Controls and DORA Incident Reporting","description":"Designed and built a clickable GRC platform for a Danish bank and pension group: a risk register scored inherent and residual against the board's appetite, a dashboard with DORA readiness, and an ICT incident log that classifies incidents against the DORA criteria and runs the reporting clock to Finanstilsynet.","category":"RegTech / GRC Platform","client":"Nørrevig Finansgruppe"}}},{"meta":{"slug":"riegel","industry":"web3","projectType":"Institutional MPC custody","country":"de","tags":["web3","wallet","fintech","enterprise"],"compliances":["KWG","MiCA","Transfer of Funds Regulation (travel rule)","GwG","DORA","GDPR","ISAE 3402 / SOC 1","ISAE 3000 / SOC 2","FIPS 140-2 / 140-3 Level 3"],"cover":{"src":"/case-studies/riegel/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Riegel - Institutional MPC Custody Platform with Quorum Approvals and Client Policies","description":"Designed and built a clickable client console for a German crypto custodian's MPC custody platform: institutions see their vaults and holdings, follow every transaction from request to final confirmation, approve with a security key against a quorum per approver group, and test their own first-match withdrawal policy before it goes live.","category":"Web3 / Institutional Custody","client":"Hochwarth Verwahrung"}}},{"meta":{"slug":"lotse","industry":"banking","projectType":"Open banking aggregator","country":"de","tags":["fintech","saas","enterprise"],"compliances":["PSD2","ZAG","PSD2 RTS on SCA","eIDAS","GDPR","BDSG","DORA"],"cover":{"src":"/case-studies/lotse/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Lotse - Open Banking Aggregator Operations Console","description":"Designed and built a clickable operations console for a Hamburg account information service provider that connects fintechs to German bank accounts under PSD2: bank connector health, incidents, and every consent from grant to the 180-day re-authentication.","category":"Banking / Open Banking","client":"Elbtal Konto GmbH"}}},{"meta":{"slug":"kindlus","industry":"web3","projectType":"Smart contract admin","country":"ee","tags":["web3","saas","enterprise"],"compliances":["MiCA","DORA","GDPR"],"cover":{"src":"/case-studies/kindlus/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Kindlus - Smart Contract Admin Console with Reviewed, Simulated and Multi-Signed Changes","description":"Designed and built a clickable smart contract admin console for a Tallinn infrastructure company that serves protocol teams and token issuers: a registry of deployed contracts across chains, a role map that flags single keys with admin power, and a queue where every upgrade, role change, parameter change or pause is reviewed, simulated and signed through a Safe and a timelock.","category":"Web3 / Smart Contract Admin","client":"Loodemaa Labs"}}},{"meta":{"slug":"sonde","industry":"ai","projectType":"AI evaluation dashboard","country":"fr","tags":["ai","enterprise","insurtech"],"compliances":["EU AI Act","GDPR (Article 9 health data)","DORA","HDS health data hosting","ACPR AI governance","OpenTelemetry GenAI conventions"],"cover":{"src":"/case-studies/sonde/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Sonde - LLM Evaluation and Observability Platform with Release Gates","description":"Designed and built a clickable LLM evaluation and observability platform for the AI team of a French health mutual: redacted production traces span by span, release gates that block a prompt or model change when quality regresses, alerts with owners and ageing, and the monitoring record its risk and compliance teams can show a supervisor.","category":"AI & Automation / LLM Evaluation","client":"Mutuelle Serpolet"}}},{"meta":{"slug":"pegel","industry":"devtools","projectType":"Status page & incidents","country":"at","tags":["saas","enterprise"],"compliances":["GDPR","NIS2","DORA"],"cover":{"src":"/case-studies/pegel/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Pegel - Incident Management and Status Page for a Payroll SaaS","description":"Designed and built a clickable incident management console for a Vienna payroll SaaS serving about 1,400 employers in Austria, Germany and Switzerland: one alerts inbox, an incident room with roles, timeline and update cadence, and a regulatory tracker that keeps GDPR, NIS2 and DORA contract notices on their deadlines.","category":"Developer Tools / Incident Management","client":"Kahlbergau Lohnsysteme GmbH"}}}],"all":[{"slug":"grantbook","title":"Grantbook - Grant applications"},{"slug":"kindlus","title":"Kindlus - Smart contract admin"},{"slug":"lotse","title":"Lotse - Open banking aggregator"},{"slug":"lukturis","title":"Lukturis - AI knowledge search"},{"slug":"pegel","title":"Pegel - Status page & incidents"},{"slug":"riegel","title":"Riegel - Institutional MPC custody"},{"slug":"skanse","title":"Skanse - GRC platform"},{"slug":"sonde","title":"Sonde - AI evaluation dashboard"}],"byIndustry":[{"id":"web3","label":"Web3 wallets & infrastructure","href":"/case-studies/industry/web3","count":2},{"id":"ai","label":"AI agents & automation","href":"/case-studies/industry/ai","count":1},{"id":"banking","label":"Banking & lending","href":"/case-studies/industry/banking","count":1},{"id":"devtools","label":"Developer tools & APIs","href":"/case-studies/industry/devtools","count":1},{"id":"internal","label":"Internal tools & ops","href":"/case-studies/industry/internal","count":1},{"id":"regtech","label":"RegTech & compliance","href":"/case-studies/industry/regtech","count":1},{"id":"science","label":"Science & research","href":"/case-studies/industry/science","count":1}]}