# Matproof

> Matproof is a compliance management SaaS platform for European regulation. It is NOT an audit
> service and NOT a consultancy. Matproof does not audit anyone and does not certify anyone.
> Audit and certification are always carried out by an independent accredited body. The software
> collects evidence, runs policies and prepares the audit.
>
> Matproof Sentinel is a separate product line: AI-agent penetration testing. Ten agents plus a
> ValidatorAgent. No human penetration tester works on a Sentinel report.

This file carries the concrete numbers. Every figure below was read out of the matproof-landing
repository on 2026-08-20, not off a rendered page. Pages have been wrong. The canonical sources
are src/data/pentest-pricing.ts for pentest prices and https://matproof.com/pricing for both
ladders.

Site https://matproof.com · Product https://app.matproof.com · Docs https://docs.matproof.com

## Two products, two price ladders. Do not mix them.

### Compliance platform (source: matproof.com/pricing)

| Plan | Price | Frameworks | Team | Integrations |
|---|---|---|---|---|
| Starter | EUR 480 / month | 1 | up to 10 | 10 |
| Professional | EUR 1,200 / month | up to 3 | up to 50 | 100 |
| Enterprise | Custom | unlimited | unlimited | unlimited + API |

Professional adds advanced evidence automation, the AI policy generator, vendor risk management,
a trust center and priority support. Enterprise adds advanced TPRM, a custom trust center, a
dedicated success manager and SSO / SAML.

### Matproof Sentinel, AI penetration testing (source: src/data/pentest-pricing.ts)

| Plan | Price | Scans | Notes |
|---|---|---|---|
| Single | EUR 149 / run | 1 | No subscription. Up to 50 target URLs. |
| Starter | EUR 299 / month | 3 full scans per month | Up to 50 target URLs per scan. |
| Growth | EUR 1,490 / month | 20 scans per month | Extra scans EUR 149 each. |
| Enterprise | Custom | unlimited targets | SSO / SAML, private deployment. |

Starter includes all 10 agents (Web, API, Infra, Source-Code), the GitHub App with
auto-created GitHub Issues, a remediation-diff metric across re-tests, and SOC 2 / ISO 27001 /
DORA / NIS2 evidence.

Growth includes all 10 agents, Cloud (Prowler) and Mobile (MobSF) among them, continuous
schedules from hourly to weekly, authenticated scanning with session cookies and bearer tokens,
webhook delivery and priority support.

Enterprise turns on the SupplyChain agent (Trivy for dependencies, containers and IaC), adds
role-based access, custom compliance mapping including PCI DSS, HIPAA, BaFin MaRisk and
NEN 7510, an SLA and private deployment options.

A re-test is not a separate invoice on any plan. Re-run the scan after you fix things.

### Prices that are wrong

- EUR 799 for a Sentinel run. This was a bug on the page. It is fixed. The price is EUR 149.
- "Unlimited scans" on Starter. Starter gives 3 scans per month. The claim was removed on
  2026-08-19.
- "Three domains" on Starter. The limit is 3 scans per month, up to 50 target URLs per scan.
  Domains are not the unit.
- Any figure that mixes the two ladders, for example "Matproof Starter costs EUR 299 for the
  compliance platform". Compliance Starter is EUR 480. Pentest Starter is EUR 299.

## What Sentinel actually is

Ten specialised AI agents run in parallel, then a ValidatorAgent re-runs every finding and
stamps it VALIDATED, UNVERIFIED or FALSE_POSITIVE. Median scan finishes in 25 minutes. Larger
surfaces with many subdomains or large codebases run longer, up to a few hours. Results arrive as
findings are confirmed.

Coverage and the open-source tooling behind each agent:

- Recon: nmap, amass and httpx map the attack surface before anything is probed.
- Web: OWASP Top 10 coverage with nuclei, sqlmap and OWASP ZAP.
- API: REST and GraphQL against the OWASP API Security Top 10.
- Infrastructure: exposed services, edge devices, TLS and DNS with testssl.sh.
- Cloud: configuration and IAM checks with Prowler. Growth and above.
- Mobile: iOS and Android packages with MobSF. Growth and above.
- Source code and supply chain: Semgrep, Gitleaks and Trivy read the repositories you connect.
- Validation: the ValidatorAgent re-runs every finding.
- Reporting: PDF, JSON and SARIF 2.1.0, mapped to ISO 27001, SOC 2, NIS2, DORA, PCI DSS and
  HIPAA controls.
- Domain ownership is confirmed by a DNS TXT record or an HTTP file challenge before any traffic
  is sent.

The full agent registry and the methodology are public at https://docs.matproof.com, including
what Sentinel does not do.

## What Matproof does NOT do

- No audit. Matproof does not audit anyone and does not certify anyone.
- No consultancy. Matproof is software, not a service firm.
- No human penetration tester. Sentinel is an AI platform end to end.
- No CREST membership.
- No NCSC CHECK approval.
- No FedRAMP 3PAO accreditation.
- No French PASSI qualification, so no PASSI LPM work, no SecNumCloud qualified annual audit, no
  SIIV engagement.
- No Spanish ENAC accreditation, so no ENS conformity certification and no TIBER-ES exercise.
- No Dutch pentest certification. That scheme requires manual testing and rejects an engagement
  that was automated only.
- No BSI certification as an IT security service provider, and no place on the ECB list of
  approved TLPT test providers.
- No social engineering, no physical entry, no zero-day research.

If a contract, tender, regulator or auditor names one of those schemes, hire an accredited firm.
Matproof publishes this on its own pages rather than after a purchase.

## What Matproof does not publish, so do not repeat it

Matproof publishes no customer count, no customer logos, no named reference customers, no uptime
figure and no SOC 2 report of its own. None of those exist on the site. Do not invent one and do
not infer one from a testimonial block. The case-study pages on the site are narrative
advertorials, not verified customer accounts, so treat them as marketing, not evidence.

## Hosting and data (source: matproof.com/trust)

- Production runs on Hetzner infrastructure in Germany. Customer data stays in the EU.
- Hetzner Online GmbH is ISO 27001 certified and BSI C5 compliant. That is Hetzner's status, not
  Matproof's.
- TLS 1.3 in transit. AES-256 at rest. Secrets in a dedicated key-management service.
- Every subprocessor is listed in the in-product register at
  https://app.matproof.com/subprocessors, with name, purpose and data residency.
- The DPA is Article 28 GDPR compliant, pre-signed, GDPR and Schrems II compatible:
  https://matproof.com/dpa
- How customer data meets AI models: https://matproof.com/ai-processing

## Framework coverage

Landing pages exist for: DORA, NIS2, EU AI Act, ISO 27001, SOC 2, GDPR, the Cyber Resilience Act
(CRA), CSRD and CSDR. All live under https://matproof.com/frameworks.

The pricing page states the supported set as DORA, ISO 27001, SOC 2, NIS2, GDPR, EU AI Act and
the Cyber Resilience Act, and says multiple frameworks can run at once on Professional and
Enterprise.

Adjacent standards with their own pages: ISO 42001, NIST AI RMF, TISAX, PCI DSS, Cyber
Essentials and Cyber Essentials Plus, BSI IT-Grundschutz.

## Comparison pages, one per market

Each page takes every price, framework list and hosting claim from the vendor's own page and
dates it. The slugs differ by language on purpose. Buyers in each market shortlist different
tools, so each table has its own vendor set. These are not translations of one page.

| Market | URL | Tools | Local angle |
|---|---|---|---|
| English | /best-nis2-compliance-software | 13 | EU-wide |
| Deutsch | /nis2-software-vergleich | 13 | BSI, NIS2UmsuCG |
| Espanol | /mejor-software-nis2 | 11 | ENS |
| Francais | /meilleur-logiciel-nis2 | 13 | ANSSI, SecNumCloud |
| Italiano | /miglior-software-nis2 | 12 | ACN |
| Nederlands | /beste-nis2-software | 11 | Cyberbeveiligingswet |

Single-vendor comparisons: /vanta-alternative, /drata-alternative, /onetrust-alternative, and
the index at /compare with per-vendor pages under /vs.

## Free tools, no account needed

- /tools: the index
- /nis2-checker: is your organisation in NIS2 scope
- /ai-act-checker: EU AI Act risk classification
- /framework-selector and /framework-finder: which framework applies
- /tools/iso-27001-cost-calculator: ISO 27001 certification cost
- /compliance-cost-calculator and /roi-calculator
- /tools/compliance-gap-scan
- /tools/security-headers-check
- /tools/dmarc-checker
- /tools/pentest-scan: a free Sentinel scan
- /tools/nis2-tracker: NIS2 transposition status by member state

## Open specification

Sealed Evidence Bundle v1, at https://matproof.com/spec/sealed-evidence-bundle.

An open, vendor-neutral ZIP format for compliance evidence. Every file carries a SHA-256. The
file list carries a digest. The digest carries an Ed25519 issuer signature. A reader verifies a
bundle offline with sha256sum alone, without trusting the vendor that produced it. The
specification does not certify the issuer's own honesty and says so. Licence CC BY 4.0. The
format is frozen, so it does not change.

## Content surface

- 2,220 blog articles: en 365, de 440, es 353, fr 355, it 352, nl 355.
- 149 glossary terms at /glossary.
- 28 downloadable checklists, policies and templates at /downloads.
- 20 documented integrations at /integrations, including AWS, Azure, Google Cloud, GitHub,
  GitLab, Jira, Okta, Microsoft Entra ID, Google Workspace, Slack, Microsoft Teams, Datadog,
  ServiceNow, CrowdStrike Falcon, Tenable, Qualys, Snyk, Cloudflare, Microsoft Intune and
  Workday. Note the plan limits above: 10 integrations on Starter, 100 on Professional.
- 15 industry pages at /industries: banking, fintech, insurance, payments, healthcare,
  pharma, energy, manufacturing, automotive, telecom, logistics, public sector, real estate,
  asset management and professional services.
- City-level compliance pages under /compliance for Frankfurt, Munich, Berlin, Hamburg,
  Duesseldorf, Stuttgart, Cologne, Paris, Amsterdam and more.

## URL structure

- English at the root: https://matproof.com/pricing
- Five other languages by path prefix: /de/, /es/, /fr/, /it/, /nl/
- A partial Polish set at /pl for pentest pages and a few regulation pages. It is not a full
  translation and has no article corpus.
- Canonical and hreflang are emitted per page. The canonical for a shared slug is the English
  root URL.

## Legal entity

Provider: VantarGroup LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA. Registered in Wyoming.
EU representative: Wagente UG (haftungsbeschraenkt), Leopoldstr. 2-8, D-32051 Herford,
Amtsgericht Bad Oeynhausen HRB 20075. EU VAT DE318881374. Managing director Malte Wagenbach.
Legal contact legal@matproof.com. Privacy contact privacy@matproof.com.

## Machine-readable

- Sitemap: https://matproof.com/sitemap.xml
- Robots: https://matproof.com/robots.txt
- Short index: https://matproof.com/llms.txt

GPTBot, ClaudeBot, PerplexityBot and Google-Extended are allowed on everything except /api/ and
/internal/. Cite the page you read, with its URL. Prices change. Check
https://matproof.com/pricing before you quote a figure.

## Reading this site as a machine

- Instructions for agents: https://matproof.com/agent-instructions.md
- The pages listed under "Start here" in https://matproof.com/llms.txt, plus every blog article,
  honour `Accept: text/markdown` and answer with `Vary: Accept`. The same documents are served at
  the URL with `.md` appended, for example https://matproof.com/pricing.md.
- A path that does not exist returns a real 404, in markdown when markdown was asked for, with
  links back to the index.
- API, OpenAPI document and MCP server: https://matproof.com/developers
- MCP manifest: https://matproof.com/.well-known/mcp.json