Features
Everything to categorize, document, and assess
Catégo covers your entire information security and privacy compliance journey — from asset inventory all the way to presentation-ready exports.
Pillar 1
Information asset categorization (DICT)
Assess each asset across the four dimensions of the DICT model — Availability, Integrity, Confidentiality, and Traceability — to set a sensitivity level and prioritize the appropriate protection measures.
- Step-by-step guided categorization record for each asset
- DICT levels with documented justifications
- Owner and steward clearly assigned
- Prioritization of the most sensitive assets
Foundation
A complete, connected inventory
Categorization and the register both build on a structured inventory. Record and connect everything that matters to your compliance.
Pillar 2
Records of processing (RoPA)
Document each personal information processing activity and keep your register up to date, ready to present to the Commission d'accès à l'information or another authority.
- Purposes, data categories, and recipients
- Security measures and retention periods
- Cross-border transfers and their associated mechanisms
- Confidentiality incident log
Pillar 3
Impact assessments (PIA/EFVP)
Produce your privacy impact assessments faster, with a structured draft generated by the AI and validated by an authorized person.
- Automatic detection of PIA triggers
- Draft written from your data
- Versioning and review tracking
- Scheduled reassessment date
Add-on module
Consent management (CMP)
For clients who also use Moelleux — Horizon-Cumulus's consent management platform — drive your cookie banners and policies directly from Catégo, without leaving your compliance workspace.
- Cookie banner and policy per property (site)
- Consent statistics and register
- Policy generation and embed code
- Secure per-organisation token connection
Only need a cookie manager? Moelleux can also be used on its own.
Catégo + Moelleux
Catégo for compliance, Moelleux for visitor consent. Together, a complete record — from your information inventory to your website's cookie banner.
AI assistant
The AI does the first draft, you approve
The assistant speeds up every step without ever deciding for you.
Natural-language intake
Describe an activity or asset in plain language; the AI extracts a structured record that you complete.
Justified DICT suggestions
The AI proposes a level for each DICT dimension and drafts the justification, which you adjust as needed.
Personal information detection
Data likely to be personal information is flagged so nothing is missed in the register.
PIA generation
A draft impact assessment is produced from your existing data, clearly labelled "AI-generated".
You keep control and traceability: every AI-generated item is reviewed and approved by an authorized person before it is kept.
Demo
See Catégo in action
Watch how to document your privacy compliance — AI-assisted.
Presentation-ready PDF exports
Generate your records of processing and your impact assessments as PDFs, formatted to hand to management, a client, or a supervisory authority.
- Records of processing as PDF
- PIA as PDF, structured by section
Multi-regime, extensible
Law 25, GDPR and PIPEDA are fully supported. The data model is multi-regime from day one: each framework's specifics are added as extensions, no rebuild. Every regime brings its own obligations catalogue, legal bases and assessment instrument.
Operational compliance
From documentation to action
Track your obligations, draft your documents and answer requests — all in one place.
Obligations tracking
A catalogue of each regime's obligations (Law 25, GDPR, PIPEDA), with status, owner and evidence — feeding your compliance index.
Document generation (AI)
Privacy and governance policies, collection notices, procedures, processor agreements (DPA): a draft written from your context, which you validate.
Data-subject rights (DSAR)
A register of access, rectification, erasure and portability requests, with automatic statutory deadline computation (30 days / 1 month) and overdue tracking.
Unique to Catégo
A living processor chain
Your vendors and business customers are often on Catégo too. Link who hosts what — without ever exchanging personal information — and turn the controller ↔ processor relationship into a living link.
- "What I entrust" view: data categories and sensitivity, per vendor
- Host side: "who depends on me", per service
- Targeted incident notification, organisation to organisation
- Interoperable exports (W3C DPV, CycloneDX SaaSBOM) — no lock-in
A B2B governance registry: Catégo links organisations, never your end customers.
WordPress → Host → Cloud
Any organisation can be a consumer of a service; as soon as it hosts one for others, it also becomes the provider. Each link documents its part and notifies the relevant link on an incident.