Tools, training and advice for cybersecurity, GDPR & AI Act compliance

Free open-source AI tools to check where you stand, hands-on AI trainings to build skills, and cybersecurity and data privacy consultancy to close the gaps.

Take the 60-second readiness check

60-second readiness check

Three questions · the result updates as you choose

You process personal data?

Your AI use?

Your sector?

Your likely starting pointsUpdates as you choose · not legal advice

One starting point per area · a consultant confirms what appliesGet a scoped quote

AI tools

All on Hugging Face →

LIVE

Arx

Computer security audit

Audits a Mac, Windows or Linux computer against ISO 27001, GDPR and the EU AI Act. A small AI writes the report. Nothing is uploaded.

Checks70RunsOfflineFixes1-click

EXPERIMENT

Caveat

EU AI Act risk check

Two models place an AI use case in an AI Act risk tier, side by side, with a 14-lesson course. Not legal advice.

Model36 MBLessons14RunsBrowser

LIVE

Nox

AI assistant

A free AI assistant for chat and questions about your documents, with an offline mode that keeps them on your device.

Languages5CostFreeOfflineYes

🥇

Arx Model

endpoint-auditor-0.5b

542downloads

🥈

Arx Dataset

endpoint-auditor-releases

249downloads

🥉

Caveat Model

eu-ai-act-classifier-experiment

162downloads

Downloads in the last 30 days · 17 Oct 2026

Upcoming trainings

With

OPEN

14Dec

Cybersecurity for Beginners using agentic AI and n8n

Digital Learning Hub · 14–17 Dec 2026

Build an AI agent that checks events against ISO 27001 guidance and keeps the risk register up to date.

Length4 days Price€112 LevelBeginner

OPEN

12Jan

Digital Marketing for Beginners using AI and n8n

Digital Learning Hub · 12–14 Jan 2027

From brand identity to a full campaign plan, with AI for content and n8n to organise the work.

Length3 days Price€84 LevelBeginner

ON REQUEST

LLL

GDPR for Beginners

Lifelong Learning · dates on request

Data protection law and the GDPR explained through real court cases, for teams that book a session.

FormatTeam LanguageEnglish LevelBeginner

ON REQUEST

LLL

Digital Marketing for Beginners using AI and Automation

Lifelong Learning · dates on request

Digital marketing with AI tools and simple automation, for organisations that book a session.

FormatTeam LanguageEnglish LevelBeginner

Also at DLH: Project Management for Beginners using AI and n8n, 7–11 Dec 2026 · Sold out

Consultancy services

Order any one · quoted per service

Service	Area	Based on	Quote
	Privacy	GDPR Art. 6, 13–22, 28	Quote →
Foundational A legally sound starting point: we review your key legal documents and tell you exactly what to change. What's included Terms of Use and Privacy Policy review Refund Policy and General Terms & Conditions review Consolidated GDPR observations and prioritised actions Feedback document, findings presentation and follow-up meetings Based on GDPR Articles 6, 13/14, 15–22 and 28 Scope Four documents of up to 15 pages each, for one legal entity. Larger organisations get a tailored estimate. Request a quote →
	Privacy	GDPR Art. 30	Quote →
Foundational A complete, CNPD-aligned record of how your organisation processes personal data. What's included Purposes and legal basis for each processing activity Data, data-subject and recipient categories Retention periods, security measures and international transfers Sub-processor list and procedures for keeping the RoPA up to date Based on GDPR Article 30, with Articles 5, 6 and 28 Scope Up to 15 processing activities, for one legal entity. Larger organisations get a tailored estimate. Request a quote →
	Privacy	GDPR Art. 1–99, CNPD	Quote →
Comprehensive A full picture of where you comply and where you don't, with a roadmap to close the gaps. What's included Article-by-article mapping and control effectiveness review Gaps rated Critical, High, Medium or Low Prioritised remediation plan with owners and timelines Presentation of findings and stakeholder support Based on All GDPR Articles (1–99) and CNPD expectations Scope One legal entity and site, up to 15 processing activities. Larger organisations get a tailored estimate. Request a quote →
	Privacy	GDPR Art. 25, 35	Quote →
Advanced Find out whether a DPIA is required and, if so, carry out a proportionate one that the CNPD would recognise. What's included Necessity and proportionality assessment Risk identification and severity scoring Technical and organisational measures, privacy by design and by default Formal DPIA report, board presentation and prior-consultation guidance Based on GDPR Articles 25 and 35 Scope One processing operation (or a set of similar ones). Larger organisations get a tailored estimate. Request a quote →
	Privacy	Reg. 2024/1689	Quote →
Advanced Know which AI systems you use, how the AI Act classifies them, and what you must do about it. What's included Inventory of AI systems you build, use or buy, and your role for each Risk classification and prohibited-practice screening Gap analysis: AI literacy, high-risk duties, deployer and transparency obligations AI governance framework: policy, AI register, human oversight, vendor checklist Based on Regulation (EU) 2024/1689, with GDPR Articles 22 and 35 Scope Up to 5 AI systems. Larger organisations get a tailored estimate. Request a quote → Try Caveat →
	Cyber	Annex A · 93 controls	Quote →
Comprehensive Assess your organisation against ISO/IEC 27001 and put in place an information security management system ready for certification. What's included ISMS scope and context, and a gap audit against all 93 Annex A controls Risk assessment, risk treatment plan and Statement of Applicability Information security policy and topic-specific policies Implementation support, internal audit preparation and a certification-readiness report Based on ISO/IEC 27001:2022 clauses 4–10 and Annex A, ISO/IEC 27002 and 27005 Scope Up to 50 employees, one site and one ISMS scope. Larger organisations get a tailored estimate. Request a quote → Try Arx →
	Cyber	NIS2 · DORA · CRA	Quote →
Advanced Find out which cyber regulations apply to you and get a clear roadmap to meet them. What's included Applicability: essential or important entity, financial entity, products with digital elements Gap analysis for the regime that applies Incident reporting workflow (24 h / 72 h / 1 month) and supply-chain requirements Prioritised readiness roadmap with budget estimates Based on NIS2 Directive and Luxembourg law, DORA, Cyber Resilience Act Scope One regulatory regime (NIS2, DORA or CRA). Larger organisations get a tailored estimate. Request a quote →
	Cyber	MONARC · EBIOS RM	Quote →
Advanced A structured risk assessment with a recognised method, ending in a prioritised and costed treatment plan. What's included Business context, security objectives and asset identification Threats, vulnerabilities, likelihood and impact, with a risk register and heat map Treatment plan with priority, owner and budget per measure Plain-language report and presentation for management Based on MONARC, EBIOS Risk Manager, ISO 31000 and ISO/IEC 27005 Scope One site, up to 30 assets. Larger organisations get a tailored estimate. Request a quote → Try Arx →
	Cyber	OWASP · LLM Top 10	Quote →
Comprehensive Find the technical weaknesses in your SaaS or AI system before attackers do, with clear fixes. What's included Cloud and server configuration audit against CIS Benchmarks Source-code review, dependency and secrets scanning Web, API and AI-specific testing (prompt injection, data leakage) Findings by severity, corrective measures and one retest of critical issues Based on OWASP Top 10, OWASP ASVS, OWASP Top 10 for LLM Applications, CIS Benchmarks Scope One SaaS application or AI system. Testing only with your written authorisation. Larger organisations get a tailored estimate. Request a quote →

What's new

Arx 0.5.6 released15 Oct 2026 · password and lockout fixes on Mac, Linux and Windows

New course: Cybersecurity with agentic AIStarts 14 Dec 2026 · Digital Learning Hub

Caveat runs classifier v636 MB, in your browser · experimental

Trusted in Luxembourg

Training partners, innovation programmes and our own open-source solutions

For trainings

For innovation

For solutions

Questions we often get

Not answered here? Ask us below

Does NIS2 apply to my organisation? Cyber

It depends on your sector and size. NIS2 mainly covers medium and large organisations (50 or more employees, or over €10 million turnover) in sectors such as energy, transport, health, digital infrastructure, ICT services and manufacturing, and some smaller ones whatever their size. Our NIS2, DORA and Cyber Resilience Act readiness service starts with exactly this check.

We only use tools like ChatGPT. Does the EU AI Act apply to us? AI Act

Yes, in part. Since February 2025 every organisation that uses AI must make sure its staff have enough AI literacy, and some uses are banned outright. Using AI in high-risk areas such as recruitment, credit decisions or education brings stricter duties. Caveat, our free tool, gives a first, experimental indication for a use case; our EU AI Act assessment covers up to five AI systems.

Can you certify us for ISO/IEC 27001? ISO 27001

Certification is done by an accredited certification body, which must be independent of whoever prepared you. We take you up to that point: a gap audit against the 93 Annex A controls, the Statement of Applicability, policies and an information security management system ready for the certification audit.

How much does a service cost? Quotes

Each service is quoted for your organisation, because the work depends on your size and scope. Every service has a standard scope, for example up to 15 processing activities for a GDPR audit, and larger organisations get a tailored estimate. Send the contact form and we reply with a scoped quote, usually within three working days.

Is our data safe when we use Arx or Caveat? Tools

Arx runs on your own computer and nothing leaves it. Caveat runs its classifier in your browser. Both are open source on Hugging Face, so anyone can check what they do.

Do you need access to our systems for a penetration test? Pentest

We only test with your written authorisation, and we agree the scope, dates and rules before we start. One retest after your fixes is included.

Can you run a training for our team only? Training

Yes. GDPR for Beginners and Digital Marketing with AI are available as team sessions through lifelong-learning.lu, and we also put together custom trainings. Ask through the contact form.

Still have a question?Ask us →

Contact us

We reply with a scoped quote, usually within three working days

Tell us what you need: one service, a package, or a training for your team. The first conversation is free.

Emailhello@devseis.com
Phone+352 621 489 496
Office39A Chemin du Camping
L-9022 Ettelbruck, Luxembourg
ScopeSMEs up to 50 people as quoted; larger organisations get a tailored estimate. On-site work in Luxembourg included.

Tools, training and advice for cybersecurity, GDPR & AI Act compliance

60-second readiness check

AI tools

Arx

Caveat

Nox

Upcoming trainings

Cybersecurity for Beginners using agentic AI and n8n

Digital Marketing for Beginners using AI and n8n

GDPR for Beginners

Digital Marketing for Beginners using AI and Automation

Consultancy services

What's included

Based on

Scope

What's included

Based on

Scope

What's included

Based on

Scope

What's included

Based on

Scope

What's included

Based on

Scope

What's included

Based on

Scope

What's included

Based on

Scope

What's included

Based on

Scope

What's included

Based on

Scope

What's new

Trusted in Luxembourg

For trainings

For innovation

For solutions

Questions we often get

Contact us