A DORA register
you can defend.
Mlab TPRM manages your ICT third-party providers end to end — identification, risk scoring, contracts and exit plans — and generates the complete EBA register of information, on your own infrastructure.
EBA ITS Templates
Risk Dimensions
To Deploy
Self-Hosted
From onboarding to compliance.
Four stages, one platform. Every module maps to a DORA article and an EBA code — it is not a generic vendor-risk tool bent into shape.
Register
Onboard providers with DORA identification: category (ICT, BPO, non-ICT), criticality, services, data access level, LEI or alternative code, and multi-country subcontractors.
Assess
Score risk across five dimensions with versioned, approved assessments, run B_07.01 service assessments and annual provider reviews with a monitoring questionnaire.
Contract
Track arrangements and the services under each, verify the Art. 30(2) and 30(3) checklists, map subcontracting chains and attach exit plans.
Report
Generate the 15 EBA ITS templates, check the Register Readiness verdict, validate referential integrity and produce the deposit-ready package.
Due diligence & audits
Pre-contractual due diligence where every checklist item records a verdict, comment, assessor and date, plus audit-right tracking with findings and corrective actions.
Exit strategies
Versioned exit plans with triggers, transition duration, data handling, owner and scheduled tests, attached to the contractual arrangement they cover.
Outsourcing & proportionality
An outsourcing register covering every third-party arrangement, ICT or not, and a proportionality register to record mitigation decisions.
Third-country branches
Declare the register-keeping entity as a branch of a non-EU head office, with a DORA applicability test and competent-authority scope warnings.
Score and monitor, don't guess.
Five dimensions per provider, each with its own history and review date, aggregated into one composite score you can put in front of a regulator. Assessments are versioned, go through an approval workflow and link back to their source document and contract. Concentration is analyzed by category and by geography, with high and medium thresholds, so an over-reliance shows up before an auditor finds it.
All 15 templates, generated for you.
Every module feeds the register. Mlab TPRM aggregates your data into the complete set of EBA ITS templates with controlled eba_* codes, runs a referential integrity validation, and builds the xBRL-CSV package matching the official deposit structure. A Register Readiness panel shows the deposit verdict and the top blocking points, only ICT arrangements reach the register, and each template can also be downloaded as a standalone CSV.
B_01.01Entity maintaining registerB_01.02Entities in scopeB_01.03BranchesB_02.01Contractual — generalB_02.02Contractual — specificB_02.03Arrangement linksB_03.01Signing entitiesB_03.02ICT TPSP signingB_03.03Service providersB_04.01Entities using servicesB_05.01ICT third partiesB_05.02Supply chainB_06.01Functions supportedB_07.01Criticality assessmentB_99.01DefinitionsGRC-grade compliance, without the GRC price tag.
Enterprise GRC suites charge six figures. Spreadsheets cost zero but lose every thread. Mlab TPRM sits between — a DORA-specific platform you actually own.
Runs entirely on your servers. The only outbound call is an hourly, signed license check. No provider, contract, assessment or register data ever leaves your network.
Add your license key to .env, run docker compose up -d and you are done. Rust and Actix-web for the app, MySQL for business data, ClickHouse for analytics. Migrations run on startup.
Every module maps to a DORA article and an EBA code, rather than a generic vendor-risk questionnaire relabelled for the occasion.
Up to 5 ICT providers and 3 users, with no time limit. Dashboard, provider management, contracts, risk assessments, third-party incidents and a read-only REST API included. Requires a free license key from your mlab.sh account.
Unlimited providers and users. Unlocks the DORA register, EBA export and validation, exit strategies, due diligence, audits, analytics and the full CRUD API. One key covers several instances, one per entity or branch. A license change, not a reinstall.
Up to 7 days without outbound HTTPS on the locally verified, signed license. Beyond that the instance locks until the license check succeeds again. Your data stays in place.
Ready to take control of your third-party risks?
Free tier included, with no time limit. Or bring us in to run the DORA gap analysis alongside the deployment.