Instead of Protecht ERM
Stop renting Protecht ERM. Own your risk records.
We shape your version around the registers, rating scales and obligations you configured in Protecht, move your exports across and keep it running for you.
Protecht does not publish a price. It is an annual subscription agreed in a sales conversation. Bring your renewal notice to the call.
- check_circleYour data in a database you own
- check_circleOpen source, no lock-in
- check_circleBuilt and run by Enterprise DNA
Where the annual fee goes
Look at what the renewal covers
Protecht sells a platform you configure: registers, forms, alerts and dashboards set up without code. The records inside them are a few lists. Here is what the renewal really pays for.
A fee set in a sales call
The pricing page has no figures, only a demo request. You cannot compare the renewal with anything public.
A suite sized for a bank
Vendor risk, cyber, audit, health and safety, ESG, treasury and more come in one platform. Count which ones your team actually opens.
The no-code builder
Registers and forms are built on screen. In your own version you ask for a new field or register in a sentence and it is added.
Dashboards and analytics
Charts drawn from the registers. Your own version reads the same records and answers the question directly.
Getting your data back
Protecht's UK government listing gives 30 days after expiry to extract, and a full copy with attachments at an agreed cost.
Access for occasional users
Risk owners who only sign in to attest still need access. Your own version can send them a list and record the reply.
What you run instead
The risk team's week, without the platform
Registers
Your registers, your scales
Risks, controls, obligations and incidents sit in plain records, rated on the matrix your board already approved.
- check Every risk checked against the appetite set for its category
- check Controls with a lapsed test date, and the risks leaning on them
- check Risks that had an incident since anyone last reviewed them
- check A new field or register added by asking, not configuring
Incidents
The clocks start when you become aware
Log when the organisation found out, and the deadlines that follow are worked out and kept in front of the owner.
- check APRA told within 72 hours of a material operational risk incident
- check APRA told within 24 hours when a critical operation falls outside tolerance
- check Australian data breaches assessed within 30 days
- check New Zealand privacy breaches flagged until the Commissioner hears
Resilience
CPS 230 kept up to date
Critical operations, tolerances, continuity tests and material service providers, each finding tied to the paragraph it comes from.
- check Critical operations without a continuity test in the past year
- check Operations missing outage or data loss tolerances
- check Provider changes still owed a notice to APRA
- check The whole check switched off for organisations outside APRA
Reporting
The board pack from the live records
The quarterly risk report is drafted from the same records the team works in, so nobody copies numbers between systems.
- check Risks over appetite and how their ratings moved
- check Incidents for the quarter with each finding and its source
- check Attestations and actions overdue, owner by owner
- check Draft notices to regulators, held until a person signs off
Make it yours
Design your own Protecht ERM replacement
Everything starts from the open-source base. Then it gets your name, the parts you run, your rules and your data from Protecht ERM. Try it here, and we build the real one.
2. What it runs
3. Make it fit
4. Your colour
Answered from your own database
Good morning. Here is what needs you today.
We build it from the open-source base, bring your Protecht ERM data across and run it for you.
Switching
How to switch from Protecht ERM
The move involves exporting the records you need, mapping Protecht’s configured fields and rules, and checking the new database before you retire Protecht ERM.
- 1
Export the records you need
Export your risk register from Protecht ERM as a CSV. Protecht says registers can be exported to CSV, while reports can be exported to spreadsheets and other formats. Export the controls, actions, incidents, obligations and other records you need in formats your account allows. Protecht also offers an API and SFTP. Check with Protecht about your options, including a full CSV copy with attachments, which may have an agreed cost.
- 2
Test the import first
Start with the risk register CSV import and run its test without saving changes. The free version reads a risk register CSV and keeps the original columns. Review the test output before loading records. Other registers and reports may need separate handling because they can have different formats and fields. If you are not sure how to prepare them, check with Enterprise DNA or ask Claude Code to help map them.
- 3
Review flags and mappings
Check every warning or flagged row from the test, then confirm that Protecht’s column headings map to the right fields. Protecht registers are configured differently at each organisation, so do not assume a heading or choice list has the same meaning in the new database. Confirm that records and ratings make sense, and decide which registers you still use. The fields, choice lists and rating scales of those registers can be rebuilt.
- 4
Run both systems briefly
Keep Protecht ERM available while you use the new database for a short, agreed period. Check that the records you need are present and that your team can complete its regular risk and compliance work with the new setup. Compare the results with Protecht, and note anything missing or mapped incorrectly. Resolve those issues before treating the new database as your main system.
- 5
Switch off Protecht ERM
Once you have checked the records and agreed that the new setup is ready, move your team to it and stop using Protecht ERM for ongoing work. Keep any exports and attachments you need under your own recordkeeping arrangements. If you need a full CSV copy with attachments from Protecht, confirm the process and any agreed cost with Protecht before ending the contract. Protecht says data can be pulled for 30 days after the contract ends.
Where the real effort goes
The main work is usually mapping your own register fields, choice lists, rating scales and rules, then deciding which records and how much history to bring across. Protecht’s registers are configured differently at each organisation, so this needs checking rather than a blind copy. Enterprise DNA handles the mapping and migration work when you have them install and run the system for you.
Not ready for a call?
Get your Protecht ERM switch plan by email
We will send you the step-by-step plan for moving your business off Protecht ERM, what the move really involves, and how we would do it for you.
Sent. Check your inbox.
Your Protecht ERM switch plan is on its way.
Rather talk it through? Book a call arrow_forwardThree ways to own it
Try the free version or have yours built for you
Open source
Do it yourself
Free, open source
- 1 Clone the repo and run npm install
- 2 Run npm run demo to see the fictional mutual's records
- 3 Open the folder in Claude Code, Codex, OpenCode or Cursor
- 4 Export a Protecht risk register to CSV and dry-run the import
Built around your business
We customise it
A setup fee, then a retainer for ongoing work
- check The registers, fields and rating scales you set up in Protecht
- check Your Protecht exports mapped and brought across
- check Key risk indicators and their thresholds, if you track them
- check A web front end for attestations and approvals if people want one
Omni by Enterprise DNA
We run it for you
One setup fee, then a retainer
- check Installed and looked after through Omni by Enterprise DNA
- check Access, backups and recovery set to your own policies
- check The weekly review and the quarterly board pack drafted for you
- check Someone to call when APRA or your framework changes a rule
Questions
Instead of Protecht ERM, answered
Can we get our records out of Protecht? expand_more
Yes. Protecht's own UK government listing says registers export to CSV and reports export to spreadsheets, and an API is available. The free version reads a risk register CSV and keeps every original column. Protecht registers are configured differently at each organisation, so their headings need mapping: Enterprise DNA does that for you, or you ask Claude Code to map them.
We configured a lot of custom registers. Do we lose that work? expand_more
No. The design of each register (its fields, choice lists and rating scales) is the useful part, and it carries across as the shape of your own records. We rebuild each register you still use and leave out the ones nobody opens.
Protecht has its own built-in assistant. Why switch? expand_more
Protecht's assistant works inside Protecht, on Protecht's terms. Here, Claude Code or any other agent works on a database you own, and it can read your other systems too. Nothing about the records ties you to one vendor.
Who decides whether an incident goes to APRA? expand_more
A responsible person, always. They record whether the incident is material or the breach is likely to cause serious harm. The system then works out the deadline, drafts the notice for checking and keeps it on the list until someone records that it was sent.
How do we compare the cost? expand_more
Protecht's price is agreed privately, so bring your current renewal. Our installed version is a setup fee and then a retainer for the work we agree. If you run the free version yourself, you pay for hosting and your agent and nothing else.
Take your registers with you
Book 30 minutes with Sam. Bring your Protecht renewal, one register export and the list of rules you report against. We will show you what your own version holds and what moving it involves.
Risk and Compliance for Claude Code is free and open source, published by Enterprise DNA.
Done paying for Protecht ERM?
Get your version built