Frequently asked questions

eramba is used by GRC teams to run compliance (ISO, NIST, SOCx, etc.), risk, incident, project, exception, policy, and control management, among other things.

With over a decade of history, mentioned by the likes of Gartner (2020, 2021) and used by organizations around the world, eramba has become a very popular GRC option.

Our key difference to other GRC vendors:

• We are an open project: our code is open, we have free and paid versions, documentation is open, forum is open, etc. Our community exceeds 10k organizations around the world.
   
• Our software can run on your premises or on our premises.
   
• We are affordable: our paid version is not meant to make this company rich but to pay for the cost of running this project. This makes our pricing unbeatable.

eramba is typically the next step from spreadsheet-based workflows. Check our learning platform to understand what eramba can do, and how, in detail.

While Community and Enterprise share the same code base, Enterprise has some features that are not available in Community and includes support.

Click on "Get Started" on this website to see a full comparison of both products.

Both the Community and Enterprise versions are accessible with open code but are not open source. As per the license agreement, the software's code may not be modified, reverse-engineered, or redistributed. The license permits use solely for internal business purposes under a non-exclusive, non-transferable agreement. For further details, please refer to the Terms and Conditions on our website.

Generally speaking the answer is "NO", we do not allow code modifications or redistributions (partial, complete, derivatives, etc).

You should always read our Terms & Conditions which are public at:

• This website
• The source code
• The login page of our application

Both options are available, you can run eramba on your premises or on our premises.

We typically get asked how eramba compares to other products, such as MetricStream, Archer, etc. We do not know the answer to that because their software and documentation is not open. But what we do know is that they are far, far more expensive than us.

eramba is managed by eramba limited, a business registered in the UK.

Follow an install guide on the learning platform: Docker or the VMware image.

As the install guides (Docker, VMware image) explain, installing eramba takes some technical skills: Docker, networking, Linux and OVF images. Like any production system, it also needs ongoing maintenance: availability, backups and upgrades of the application and the systems under it. Installing eramba is not a one-time task.

If that is more than your team can handle, your options are:

• Find IT help in your organisation.
• Troubleshoot and post the details on the forum: logs, screenshots and the steps you tried. A post that only says it does not install cannot be answered.
• Use our SaaS, where we install and run eramba for you.
• Use another tool.

eramba is installed 1,000–2,000 times a year and we have been doing this since 2012. An install package can fail, but then many people hit the same problem at once, so we learn about it quickly, fix it and re-package.

A software library, package, etc., is a collection of many many "books" (hundreds, etc), each delivering something specific. eramba and all applications on the planet make extensive use of libraries.

If a vulnerability scanner mentions an "outdated library" version, they don't just mention the version but also which "book" within the library is vulnerable. If the application (in our case eramba) does not use that specific vulnerable "book", then there is no vulnerable code affecting the application.

If a "book" within a library is vulnerable and eramba is using that particular "book", you can always simply exploit the vulnerability in the library by hitting the application and then, and only then, report a security issue (see guidelines in our website FAQ).

Courses and documentation are free on the learning platform, and live trainings are listed on Training. If your team prefers a guided start, Enterprise customers can book a fixed-price workshop.

Community users do not get support from the core team. Enterprise customers get unlimited email support during European business hours. While our Terms & Conditions explain how support works in detail, typical support scenarios are:

• 99% of our customers use support the first couple of months, on average less than 10 tickets. This is because eramba is very well documented and the tool is pretty simple to use.
   
• While not obliged by our terms and conditions, we sometimes help customers install eramba or migrate it to other servers, etc.
   
• You will find some bug or some feature idea which you will report to us.

Bugs are reported to the forum (https://discussions.eramba.org/) or to our support email (support@eramba.org), either case we need to know the following:

• What version of eramba you are using (System / About)
• A brief explanation of the issue
• What steps, one by one, including screenshots if needed, we must follow in order to reproduce the issue

We need those three things in order to understand and try reproducing the issue. If we conclude that there is a bug then we'll assign a Github issue and the problem will be moved to our roadmap. Based on many factors we'll know more or less by when the bug will be resolved.

Feature requests must be reported to the forum (https://discussions.eramba.org/) with the following information:

• What version of eramba you are using (System / About)
• A brief explanation of the feature goal

After a couple of days we will review the request and if we feel is something that is useful to the majority of the community and it somehow aligns with our roadmap we will assign a Github issue. This means most likely, this request will eventually become a feature some day.  If at the time we review the request we don't believe is something we need to include on the roadmap the core team will make a note on the post.

Please note that our roadmap is composed of hundreds of feature/bug requests and we process them as we think best for the community. Don't be surprised if your accepted request sits in the queue for months and even years.

We do not work on custom features for a single customer, our software roadmap applies to the entire community.

A security bug is treated the same way as a functional bug, the difference is that while a bug affects a functionality described on our documentation a security bug clearly affects the following:

• Unauthorised access to data or functionalities: the bug you found lets you access data you should not have access to.
   
• Affects the availability of the software: the bug you found makes the software unavailable to everyone.
   
• Affects the integrity of the data on the software: the bug you found can affect the integrity of the data on the system.

If the bug you are reporting does not achieve any of the three possibilities above we do not consider it a security bug. If what you found "could potentially lead" to any of the three above, we might consider it and log it into our backlog but will simply not be considered a security bug which requires us to immediately work on it and communicate it appropriately to the community.

Security bugs are reported to our support email (support@eramba.org) to protect users until a release is done with a software fix. On that email we will need to know:

• What version of eramba you are using (System / About)
   
• A brief explanation of the issue
   
• What is affected: Confidentiality, Integrity or Availability
   
• What steps must we follow to reproduce the issue? This is most likely going to require: Screenshots, HTTP requests used, Payloads Used, Scripts used, etc.

If we conclude that there is a bug then we'll assign a Github issue and the problem will be moved to our roadmap. Based on many factors we'll know more or less by when the bug will be resolved.

NOTE: Security reports from automated tools are not accepted as bug reports as they do not exploit the software on its own, we need clear instructions on how the vulnerability is exploited. The software must be breached to consider Security bugs.

The key difference between Community and Enterprise is email support and extra features found in Enterprise such as: Notifications, Reporting, Online Assessments, etc.

The particular business model used by this project makes Enterprise extremely affordable for most organizations around the world and for that reason it is sometimes not worth using Community at all.

Without the income this project makes from Enterprise subscribers there would not be enough funds to support our free Community edition.

This is all explained in detail on our "Get Started" page found on this website. As a summary, our Enterprise and Community offering (no matter if SaaS or On-Premise) is:

• Billed yearly
   
• Does not renew automatically (you need to request a renewal)

Once you submit a purchase order using our website, a human will contact you back, typically within a couple of days, with an invoice, Terms and Conditions, etc. You can pay your invoice using credit card or bank transfer.

We offer both options, you can host eramba in your data center keeping full control of data storage, encryption, backups, software updates, etc. or you can chill and let our SaaS infrastructure do everything for you.

If you are planning to use on-premise, have your technical teams review our install guide on the Learning portal to understand how eramba is installed.

Our Terms and Conditions prohibit the use of automated tools for testing our licensed software, including functional, security, load, and performance testing. This applies in particular to SaaS customers.

If your organization would like to conduct this type of testing, it must first provide eramba with the terms under which the testing will be performed. This must include, at minimum, when the testing will start and end, and who will have access to the results.

These terms must be communicated to and agreed upon by eramba before any testing begins. If eramba accepts the proposed terms, the customer will be provided with a non-production instance for conducting the testing.

Results of the testing are strictly confidential between the customer and eramba. Their communication to third parties must first be agreed with eramba.

eramba does not guarantee that the results of such testing will lead to corrections in the software.

Our terms and conditions state that we support the application we built, that is eramba. If eramba has a bug we will try fixing it because it is what is under our control.

eramba runs on top of the following layers:

• PHP, JavaScript
• MySQL, Apache
• Docker, VMware
• Linux kernel
• Servers, CPU, memory, storage
• Networks

Layers underneath eramba (the application we build) are not under our control and therefore we cannot support them. We cannot fix PHP, MySQL or Apache (if we could we would not be here!). We cannot know how each customer's infrastructure operates or spend hours and hours trying to figure it out. So, we do not get there.

While we try helping customers with install questions if they are very obvious, we cannot guarantee we will solve your install issues. What should you do?

• If you are an enterprise customer, contact support@eramba.org, we'll try guiding you.
   
• Try installing Community, it uses the same installer as Enterprise and is free.
   
• Use our SaaS service, no install, backups or upgrades involved for you.

Always read the applicable terms and conditions available on our website (look at the foot of every page), but generally speaking you can contact us as many times as you want over email (support@eramba.org) when you have a "problem" with the software. A "problem" is something that does not work as per the documentation.

Support examples:

• Our documentation says that when you click "add" a form shows up and in your instance it does not work
   
• Our SaaS service is simply not available when you try to log in

Sometimes you might have problems that relate to eramba AND other systems (your servers, infrastructure, Active Directory, etc.) your organisation manages. Since we do not know every customer's infrastructure and we certainly don't manage it, in those scenarios we can provide very limited support and we cannot be responsible for such integrations working for you. Your teams must use the documentation to configure eramba and their infrastructure to be compatible.

Examples are:

• Can you connect eramba to our Active Directory or SSO?
• Active Directory does not work with eramba, can you fix it?
• Can you install eramba on our SaaS infrastructure?
• eramba is slow, can you tell me why?

We also get questions about how eramba works, opinions on GRC implementation, ISO 27001, etc. While not covered by our terms and conditions, we try to help you based on our availability and know-how.

Our support is email-based and we work Monday to Friday (excluding general European bank holidays) during standard CET business hours.

Our Terms and Conditions are public at the following locations:

• The foot of this website
• Our Get Started page (where you download community or buy a service)
• Our software "Login" page
• Our software code

It depends on what you have purchased:

• If you bought an Enterprise Subscription (on-premise), the software will switch to read-only mode. You will still be able to access your data, but you will no longer be able to use the system (for example, adding or editing data). You also will not receive updates or support.
• If you bought an Enterprise Subscription (SaaS), your entire service is cancelled and your data is eliminated one day after your license is due.

eramba is not a typical GRC company that operates for a profit to pay its shareholders. Over a decade ago the core team built this project to (finally) provide the world with an open enterprise-class GRC software.

The money this project makes from selling services is used in its entirety to pay for the project costs (employees, services, etc.).

Our fees are not based on what the market charges for a GRC tool but on the yearly cost that this project incurs to function. There is next to no markup on our pricing.

Read our story in the About Us section of this page for detailed information on the business model.

We do not have sales or marketing teams because we do not need them. We do not need to impress anyone based on our customer base or financial growth. You can determine whether our tool works for you by reviewing our open documentation, trials, demos, community, etc.

We build code for the community, not for a single customer or user. It would be too expensive to customize code for every second customer.

If you have an idea for a feature, post it on the forum and we will evaluate and perhaps implement.

Yes. Monthly live webinars and instructor-led courses are free and run by the core team; see Training. Enterprise customers can also book consulting hours, delivered by us or our partners.

eramba is certified in ISO 27001:2022, the scope of our certificate includes the production and distribution of software and SaaS services. Our certificate is UKAS valid and is available on their website

No. Once your Enterprise license expires, you will still be able to access the Enterprise software, but you will no longer be able to use it (for example, adding or editing data). A direct migration path back to the Community edition is not available. If you want to move your data, you must export it in CSV format and then import it into eramba Community.

A proper POC takes a lot of time from our core team, in relation to our fees this type of exercise simply becomes a loss of money to the project. For that reason, we do not offer automatic trials.

Initially, we suggest you:

• Read our open documentation in detail and learn all there is to eramba
• Check our open forum for feedback and current topics
• Use our community software for free
• Test our online demo Enterprise and Community versions of eramba (including APIs)

If you still need a trial we can offer you two services, a do-it-yourself Trial or a Supported PoC. You can read the details in the Trial vs PoC comparison (PDF).

eramba cannot operate entirely offline, as it requires an internet connection to access our support servers for license validation and updates.

eramba is currently localized in English, English (British), English (United States), Spanish, Spanish (Latam), French, Portuguese, Portuguese (Brazil), Norwegian Bokmål, German, Dutch, Arabic, Bulgarian, Catalan, Chinese, Croatian, Czech, Danish, Hungarian, Indonesian, Italian, Japanese, Korean, Polish, and Slovenian. While translations may not be perfect, users can improve them and add new languages by editing a .pot file available in Settings.

Community is free: self-hosted, no user or time limit, help on the community forum.

• Enterprise on-premises: €2,500 per year
• Enterprise SaaS, hosted in the EU or the US: €5,000 per year
• Implementation workshops: €800 each, optional

A flat yearly fee with unlimited users. Full comparison on the pricing page.

Go to our website's "Get Started" section and use the online form. A team member will process your request and contact you over email, typically within 48 hours.

This project runs on high efficiency in order to deliver optimal pricing and still be able to fund the community which serves thousands of companies around the world with free (community) GRC software, libraries and documentation.

In comparison to our yearly service rates, reviewing terms and conditions with solicitors and admin work would be prohibitively expensive and therefore, unless the deal value exceeds 10k EUR, terms and conditions cannot be negotiated.

If you think there is something very wrong with them, please report the issue to support@eramba.org

eramba will automatically email all your contacts many times (60 days before, 50, etc.) to remind you about the renewal of your license.

We need your company to notify eramba at support@eramba.org well in advance of its deadline, ideally, 60 days before whether you intend to renew the license or not.

On the last day of your subscription, your cloud instance data will be automatically deleted. If you are an enterprise user, your system will stop working.

By default we do not engage with any sort of Supplier Vendor Portal, they are insanely time-consuming in comparison to our fees. The absolute majority of our customers do not need them and therefore factoring in the cost of working with them makes no sense.

If your finance department has a simple form asking any of the following questions, we can help:

• Company information (Address, Name, Incorporation Date, etc.)
• Bank Information (Bank Certificates, Bank Account Data, etc.)
• Insurance Policies
• VAT Certificate

We are not able to help with the following documents:

• Share private information of eramba employees
• Share financial information of eramba
• Company Incorporation, Tax, etc. documents

If your company requires eramba to log in to a software portal to upload the information we can share (see above), we can do so without any fees. Please bear in mind that if the software portal requires information we cannot share (see list above), we will not be able to use the platform.

No, there are too many countries in the world for us to handle something like this. Our fees are very small, so even paying a local tax would still make our software ridiculously cheap.

Our default currency is EUR. Payments in any other currency (GBP or USD) will incur a 3% commission to offset the charges that we pay to banks for moving money in between currencies.

If you pay with a credit card, you will incur a 100 EUR charge (or its equivalent in USD or GBP). Again, this is to offset the charge that we get from our credit card processor.

You can avoid both fees by paying with bank transfers in EUR. 

Please review our Terms and Conditions, in general the rule is:

• For SaaS services, there is no refund available except for those that are requested within 5 days of the order being placed
• For On-Premise, refunds are not possible

Certain customers are subject to legal requirements that mandate them to obtain third-party Cloud service availability reports. If required, eramba provides such reports based on the availability metrics we continuously monitor for each customer.

We maintain historical availability data for up to 12 months, and customers can request a formal availability report at any time.

• Report Fee: €1000 per report request.
• Coverage: The report will include relevant availability metrics based on our monitoring data.
• Delivery Time: Reports will be provided within a reasonable timeframe upon request.

For further details or to request a report, please contact our support team.

Yes. When you complete the order form, a team member will contact you.

By default we do not engage with any sort of Vendor Assessments, they are insanely time-consuming in comparison to our fees. The absolute majority of our customers do not need them and therefore factoring in the cost of responding to VAs for everyone makes no sense.

Bear in mind:

• eramba develops and publishes software, for some customers eramba hosts that software in our SaaS infrastructure. If the reason you need vendor assessments is that you are worried something could go wrong in that regard, then please read our public and technical standards to understand in detail how all that is done.
   
• Every (non-hotfix) release we complete includes a pen test using AppSec tools and of course, the results are public on our forum. To find them, go to the Release Category in our forum and search for the latest major release post. Inside you will find the result of the scan.
   
• eramba is certified in ISO 27001:2022, the scope of our certificate includes the production and distribution of software and SaaS services. Our certificate is UKAS valid and is available upon request from support@eramba.org.

If you still need a vendor assessment:

• email support@eramba.org with your vendor assessment, we'll look at it and estimate the number of hours it will take us to respond to it (we bill our technical hour at EUR 100) and when you will get the completed documents. Typically this is done at a rate of 15 minutes per question (although sometimes it is done quicker and your bill will be adjusted accordingly). The exception to this rule is multi-year licenses (your company buys our yearly license for the following three years) or purchases above EUR 10k.
   
• Notes:
  • While we can answer questions, we do not submit any type of documents requested by these Vendor Assessments (policies, certificates, etc.). The exception is our ISO 27001 certificate and any document which is already public on our platforms.
     
  • The fee assumes a one-time response process. If you have additional questions, we'll estimate that effort and update our billing.
• When you purchase the software we will include an item on the bill for "Consulting" that includes those hours we spent on the Vendor Assessment. If you decide not to buy the software, you will be invoiced anyway for those hours.

To receive an official quote for eramba, please submit a quote request through our website: https://www.eramba.org/get-started-grc

First, select the product you are interested in. You can then choose an Implementation Workshop (recommended) or No Implementation Workshop.

After that, fill out the form with your company details and select Quote in the last step.
Once submitted, our team will manually review and process your quote request and get back to you with the official quotation.

If you have any questions, you can contact us at support@eramba.org.

If you are currently using eramba Community and want to upgrade to Enterprise, you are eligible for a 10% migration discount.

To request it, go to https://www.eramba.org/get-started-grc and select the Enterprise product you are interested in. You can then choose an Implementation Workshop (recommended) or No Implementation Workshop.

Fill out the form with your company details, and in the last step, write community discount and the email address you registered your Community instance with in the Notes field.

Once submitted, our team will review your request and apply the 10% discount.

If you have any questions, you can contact us at support@eramba.org.

We use Amazon AWS services. At the time of ordering the SaaS service, you can choose to use their European or USA datacentres for data storage and processing.

A proper POC takes a lot of time from our core team, in relation to our fees this type of exercise simply becomes a loss of money to the project. For that reason, we do not offer automatic trials.

Initially, we suggest you:

• Read our open documentation in detail and learn all there is to eramba
• Check our open forum for feedback and current topics
• Use our community software for free
• Test our online demo Enterprise and Community versions of eramba (including APIs)

If you still need a trial, we can offer you two services, a do-it-yourself trial or a supported PoC. You can read the details in the Trial vs PoC comparison (PDF).

In regard to Data Agreements (a term commonly used under the GDPR regulation), eramba has built-in conditions and definitions in its standard terms and conditions (for SaaS services only). You might also find the following links useful:

• Data Privacy
• How we keep the software secure and our ISO 27001 certificate

Your instance in eramba will be making outgoing connections when you use LDAP or WebHooks. The IP addresses we'll be using for these connections are the following:

EU instances:

• 3.75.4.24
• 3.126.58.157
• 63.177.146.63

US instances:

• 54.211.234.66
• 32.195.165.120
• 3.218.189.224

 Please contact support@eramba.org for more information.

We build and run a very sophisticated infrastructure (details here) to run eramba for you. 

While it is in our interest to achieve the maximum availability targets possible, it is expected that planned and unplanned outages will occur.

• Planned outages include upgrades on the underlying infrastructure and your instance's software.
• Unplanned outages include AWS issues we cannot remediate, internet connectivity issues and human error.

In both cases we will always try to fix things as quickly as possible and report when they occur on our forum.

eramba is certified in ISO 27001:2022, the scope of our certificate includes the production and distribution of software and SaaS services. Our certificate is UKAS valid and is available on their website

No, we use our own email servers. Emails sent by our cloud instances will come from no-reply@cloud.eramba.org.

Yes - every tenant (customer) action is logged: what click (function in eramba) was done by whom (partially masked user login in eramba) and when (GMT time).

This log file is accessible by our customers using their web interface. Logs can be downloaded but cannot be deleted.

No, it is not possible to use your own DNS or custom domain name for your eramba instance. All instances use the format customname.cloud.eramba.org. This standardized format applies to all SaaS instances.

You can check the Terms and Conditions for the SaaS service on our website. Scroll down in our website and you will find an option "Terms and Conditions", click there and select the terms and conditions for the service you are interested in.

We have been in this business for over a decade and have acquired expertise in how to run it professionally, serving thousands of customers around the world.

As part of our values we are open and honest in terms of how we build and distribute software. You can read in detail how that works in a public forum post.

eramba is certified in ISO 27001:2022, the scope of our certificate includes the production and distribution of software and SaaS services. Our certificate is UKAS valid and is available upon request from support@eramba.org.

If you want to take a backup of your data for any reason (you plan not renewing the SaaS service, want to do a backup, etc.) you can download any view as a PDF or CSV, and you can also use eramba’s built-in database export and file export features.

The majority of our partners are, by far, consulting businesses and they typically mention to us the following benefits of eramba:

• Deliver customers something more than spreadsheets - a platform that scales over time and guarantees the end-customer follows up with the platform they got.
• Focus the customer allocated budget on consulting, not software. If a company has a GRC budget of $10 to implement GRC, you (the consulting business) don't want $6 to go to the software that will be used to manage GRC, as that would only leave you with $4. By using a cost-effective solution, budgets can be used toward consulting rather than software.
• Some consulting businesses can host eramba for their customers (especially if they don't know how or want to do that) and add additional revenue through that service.
• Partners get discounts.

We partner with different types of businesses (location, size, specialisation, etc.) and to accommodate the needs of each one of them we have defined different types of partners:

• Reseller: these are companies that act as an intermediary between eramba and the end customer and do not add any value in the sense of consulting, support, etc. These companies have little understanding of eramba.
• Certified Partner: these are companies in the GRC consulting space that add value to their customers with implementation services, advisory, etc. These companies understand eramba well.
• Certified Gold Partner: these companies add similar value to the ones on the Certified Partner scheme but are significantly larger in terms of volume. They basically sell many licenses of eramba every year.

If you want to understand more about these tiers, please download our partner handbook.

Benefits vary slightly depending on which partner tier your company belongs to, generally speaking:

• We help you develop new business with joint marketing initiatives
• We provide you access to training and support
• We can offer rebates based on your sales performance
• And more!

If you want to understand more about these tiers, please download our partner handbook.

Every partner typically gets access to one country - the one that they understand and operate from. There are no exclusive partners per country. If you wish to become a partner in multiple countries, you will need to:

• Purchase a license for each country.
• Demonstrate that you have the staff and skills for each country that you want to operate from.

As with benefits, requirements to become a partner vary slightly depending on which partner tier your company belongs to, generally speaking:

• You will need to understand very well how eramba works and purchase a license of eramba that will be used exclusively for you (to learn, do demos to your customers, etc.).
• We expect your company to have GRC professionals that speak the local language.
• We expect to meet you often during the year to understand how you are doing business in the context of eramba.
• In some cases, we will ask for your help to develop and launch marketing events in your region.
• You will need to sign our partnership agreement.

If you want to understand more about these tiers, please download our partner handbook.

Certified Partners and Resellers are not required to meet any sales target. Gold Certified Partners are expected to keep a minimum level of sales throughout the year.

If you want to understand more about these tiers, please download our partner handbook.

Let's say that Acme is an existing partner that has sold a license to a customer of theirs called FooBar:

The process is as follows:

• eramba will invoice Acme for this new license without any rebate. The license will clearly state that the end-user for this license is actually FooBar.
• Acme immediately invoices eramba for the agreed rebate (depending on the partner tier).
• Immediately after the partner pays the eramba invoice, eramba pays the Acme invoice.

The rebate goes from 0% to 30% or more depending on the partner tier and their sales volume. This rebate only applies to software (On-Prem or SaaS) and does not apply to any additional consulting delivered by eramba.

Requirements vary depending on the tier scheme you would like to have, please review our partner handbook for details.

You will need to meet all requirements before you will be granted partner status. You can contact support@eramba.org once you have decided to become a partner.

We expect a partner to do their job (consulting) and us to do ours (software and support). Generally speaking, we cannot "review", "complete" or "answer" partners' RFPs.

RFPs, RFIs, etc. received by the partner should be responded to by the partner using their regional know-how and our documentation and training.

It is not unusual for an RFP or RFI to have very specific or unclear questions relating to a feature or to the roadmap or to our company. In these scenarios, the partner can ask us the question (support@eramba.org) and we will give them our opinion, but we won't officially answer third-party RFPs received by partners.

A little bit like with the RFP, RFI, etc. scenario, we expect partners to be able to address sales calls on their own. Typically these are demo calls where local know-how (regulations, etc.) is very important and eramba might not have that background.

Partners have a copy of our software or can use our demo environment for demo calls (we use that all the time), and we have partner sales materials that provide an idea of how a typical demo call is conducted (ask support@eramba.org).

If the partner is new, we might assist them on one initial sales call, but it is not normal for us to participate in every sales opportunity they encounter.

We offer fixed-duration, fixed-price consulting in two main areas:

• Learning how eramba works
• Helping you implement eramba

We offer, through our partner network, time-and-materials consulting in the areas of:

• Implementation of a Risk Management & Compliance (ISO 27001 and SOC 1/2) framework (end to end)
• Yearly operational tasks to maintain and improve the Risk & Compliance frameworks mentioned above

You can go into detail by looking at our Consulting brochure.

When purchasing fixed-time and fixed-price workshops, the following conditions apply:

• The delivery of services will be online over Zoom
• The default delivery language is English unless agreed otherwise
• The service is only available to customers that own Enterprise software licenses
• Unless agreed otherwise at the time of purchasing consulting services, the service is available for the first 6 (six) months from the start date of the software license. If your license start date is 5th September 2023, you must utilise all your consulting hours by 5th February 2024.

When purchasing consulting services billed based on time and materials (typically when we implement or operate Risk and Compliance frameworks for you), terms and conditions are negotiated between the parties.