Digital resilience
DORA without
disruption
ROOTKey maps DORA requirements directly onto your existing infrastructure - ICT risk management, incident reporting, resilience testing - with machine-verifiable cryptographic evidence.
Compliance Overview
€5M
Maximum fine
or 1% of global annual turnover
4H
Initial notification
after classification of a major incident
20+
Entity types
financial entities covered by the regulation
Jan'25
Mandatory application
in force across the European Union
ROOTKey covers the articles that matter
Each platform feature addresses specific regulation requirements. Auditable cryptographic evidence - not reports, proofs.
Articles 5–16
ICT risk management
Financial entities must implement a robust ICT risk management framework with documented policies, controls, and business continuity mechanisms.
ROOTKey
Immutable ICT policy registry with verifiable cryptographic hash per version and anchored history - retroactive tampering cryptographically impossible.
Articles 17–23
Incident classification
Classification, monitoring, and reporting of major ICT incidents with defined criteria and stipulated notification deadlines.
ROOTKey
Cryptographically signed timestamps for every event. Irrefutable chain of custody with structured export to regulators in seconds.
Articles 24–27
Resilience testing
Regular digital operational resilience testing programme, including vulnerability assessments and threat-led penetration testing.
ROOTKey
Recovery Points with cryptographic integrity verification - verifiable evidence that recovery systems have not been compromised before being tested.
Articles 28–44
ICT third-party risk
Rigorous management of ICT third-party vendor risk, including due diligence, contractual arrangements, and audit rights.
ROOTKey
Cryptographic access verification by design: every third-party access is authenticated with a cryptographic proof and recorded immutably, with no implicit trust.
Articles 45–49
Information sharing
Participation in information-sharing arrangements on cyber threats and vulnerabilities between financial entities.
ROOTKey
Structured and exportable logs with cryptographic evidence - ready for secure sharing with authorities and sector peers.
Articles 19–20
Notification to authorities
Initial notification to the competent authority within 4 hours of classifying a major incident; final report within 1 month.
ROOTKey
Logs with immutable timestamps and structured export - verifiable evidence of detection and classification time, ready in minutes.
On top of your infrastructure. Not instead of it.
ROOTKey does not replace existing systems. It adds a cryptographic verification layer via API - no migrations, no vendor lock-in.
Auditable cryptographic evidence
Every critical action generates an independent proof, verifiable by external auditors without accessing the original data. Compliance that is proven - not described.
Verifiable recovery points
Backups with cryptographically-guaranteed integrity. The regulator asks for evidence; ROOTKey delivers proof - date, content, integrity, all verifiable.
ICT risk management
Robust framework with versioned policies and immutable cryptographic hash per version. Auditable at any time, with no possible tampering.
Incident reporting
Chain of custody for every ICT event with cryptographic timestamp. Notification to authorities with irrefutable evidence in minutes.
Operational resilience
Recovery Points with cryptographic integrity verification before any restore. Guaranteed integrity of recovery systems.
Third-party risk
Every ICT vendor access is authenticated and recorded with immutable cryptographic proof. Cryptographic access verification by design.
Live in days, not months
Documented REST API, available SDKs, dedicated enterprise support. ROOTKey adapts to your stack - not the other way around.
01
API integration
Documented REST API, SDKs for major languages. Live in days. Without replacing existing infrastructure.
02
Automatic anchoring
Every critical event automatically generates an immutable, auditable cryptographic anchor. Zero additional operational effort.
03
Instant reporting
Real-time compliance dashboard. Export evidence to regulators in seconds - not weeks of audit work.
Your DORA resilience
starts today
Talk to our team. In 30 minutes you'll know exactly where you stand on DORA and what ROOTKey resolves - without operational disruption.