Your ISMS — your server, your data.
A self-hosted Information Security Management System for ISO 27001, NIS2, GDPR/DSGVO and BSI IT-Grundschutz — with business continuity (ISO 22301) and an Android companion app. Built by a CISO, for CISOs.
admin@example.com / adminpassciso@example.com / cisopassbob@hr.example / bobpass
Compliance shouldn't cost a fortune.
SMEs and mid-sized companies face an impossible choice when it comes to ISMS tooling.
Enterprise tools are too expensive
Commercial ISMS platforms typically cost €5,000–30,000 per year — unaffordable for most organisations.
Spreadsheets aren't auditable
Excel-based ISMS documentation can't enforce workflows, track policy acknowledgements or produce audit evidence automatically.
SaaS means giving up control
Storing sensitive security documentation in a third-party cloud contradicts the very principles of a sound ISMS.
Everything your ISMS needs.
313 controls across 8 frameworks. One platform. Fully self-hosted. Click a tile for details and examples.
Your ISMS in your pocket.
The Android companion app takes policies, risks, assets, findings and measures with you — also where there is no network — and syncs with your own server.
- Offline first. Read and edit on the go; changes are merged when you are back online.
- Set up with a QR code. One-time code from the admin page, no passwords typed on a phone.
- Your rights, enforced. The server decides per module who may read or write; the app follows.
- Locked by default. App lock with the device screen lock, no screenshots, HTTPS only.
Currently in beta and not yet available in an app store. Works with servers using the default JSON storage.
Your server. Your data. Your rules.
ISMS Builder runs entirely on your own infrastructure — no cloud dependency, no vendor lock-in.
Self-hosted
Run it on your own server — full control, no dependencies.
- Docker Compose in minutes
- SQLite, MariaDB or PostgreSQL backend
- SSL/TLS out of the box
- Over 1,200 automated tests
- Full source code on GitHub
Community
Built in the open — contributions, bug reports and feedback are always welcome.
- Report bugs or request features on GitHub
- Contribute code, policies or translations
- Browse the architecture and API docs
- Read the full changelog
- Reach out directly with questions
A tool, not a subscription.
ISMS Builder is not a monitoring service. It is a structured, methodical instrument that guides you step by step through the PDCA cycle — auditable, self-hosted, without vendor lock-in.
ISMS Builder This tool
- Pragmatic & modular — no overhead, no permanent subscription
- Guides you through the PDCA cycle step by step
- Template-based documentation — structured and auditable
- Self-hosted — your data stays on your infrastructure
- Built for SMEs, public authorities and European compliance (GDPR, NIS2, BSI)
- No vendor lock-in — open source, AGPL-3.0
Typical SaaS ISMS tools Others
- Designed for permanent operation and continuous monitoring
- Heavy automation and integrations — complex to set up
- Recurring licence costs, often per user
- Data stored on third-party infrastructure
- Often US-centric — GDPR and BSI compliance requires workarounds
- Vendor dependency for updates, support and availability
"The pragmatic and modular approach of ISMS Builder makes it particularly suitable for German and European SMEs and public authorities. Compared to heavily automated SaaS tools, it offers a structured, methodical and process-oriented approach to building a comprehensive and auditable ISMS."
From risk to report — in one platform.
A quick tour through ISMS Builder: from the login screen to dashboard, risks, SoA, GDPR, business continuity and reports.
Built in the open, for the community.
AGPL-3.0 — free to use, fork and improve.
ISMS Builder is fully open source. The AGPL-3.0 license ensures that any modified version running as a network service must also remain open source — keeping the ecosystem transparent and auditable.
Built by a practising CISO and DPO with 35+ years of IT experience. Every feature exists because it was needed in the real world.
Get in touch.
Questions or consulting?
Need help getting started, want to discuss your ISMS setup or have a consulting enquiry — reach out directly.
✉ claude.hecker@pm.me🔑 PGP public key — encrypted mail welcome