Security

Real offensive depth

Testing and defence led by a published security researcher with five CVEs, including a CVSS 9.1 Mirai botnet kill-switch.

All security →
Testing & offensive
Penetration Testing
Web, network, and cloud, human-led
Vulnerability Management
Continuous scan, triage, remediation
Cloud Security Review
AWS, GCP, and Azure hardening
Enterprise Security Review
Find your exposed edges
AI & code
AI / LLM Security
Prompt injection, RAG, agent abuse
Vibe-Coding QA
Security review of AI-built code
LLM Red-Teaming
Adversarial testing for your model
Lead & respond
Fractional / Virtual CISO
Security leadership on tap
Retainers & Ongoing Work
Continuous compliance, security program, IR
Threat & Risk Assessment
Formal TRA for procurement
Security Questionnaire Response
We answer the questionnaires
Compliance

Audit-ready, fixed scope

SOC 2, ISO, CPCSC, and the Canadian privacy stack, run end to end with an independent auditor.

All frameworks →
Frameworks
SOC 2
Readiness + audit coordination
ISO 27001
ISMS, done properly
ISO 42001 (AI)
AI management system readiness
CPCSC (Defence)
Level 1 and Level 2
HIPAA
For digital health
PCI DSS
Scope reduction first
Program & audit
Gap Analysis
Know exactly where you stand
Internal Audit
ISO 27001 clause 9.2 and A.5.35
Auditor Management & Advocacy
We manage the auditor for you
Trust Center Setup
Speed buyer diligence
Vendor / Third-Party Risk
Assess your vendors
Canadian privacy
Outsourced Privacy Officer
External DPO and Law 25 contact
Quebec Law 25
The privacy law with teeth
PIPEDA
Federal privacy baseline
GDPR
EU data protection
Resources

Learn the space

Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.

Read the blog →
Learn
Research & CVEs
Our published vulnerability research
2026 Security Report
The state of startup security
Glossary
Security & compliance terms, explained
Library
Templates, checklists, and downloads
Tools & guides
Tools & Calculators
Free readiness and cost tools
Guides
Deep how-to walkthroughs
CPCSC Level 1 & 2 Guide
13 requirements, then all 98
Comparisons
traztech vs the platforms
Company
Blog
Buyer-focused security writing
Partners
Our offensive-security partner
Referrals
Refer a company, get rewarded
Case studies
Real engagements and the numbers behind them
How it works
The four phases, and what we need from you
FAQ
Common questions, answered
All Tools

DPIA / Privacy Impact Assessment Builder

Describe a processing activity and we assemble a structured DPIA / PIA draft you can copy into your own document. It follows the shape expected under GDPR Article 35 and Quebec Law 25. It is a starting draft, not a filed assessment.

Describe the processing activity

Your DPIA draft

Fill in the activity name and purpose to generate your draft.

This is a draft generator, not a completed DPIA. A defensible DPIA requires a real assessment of the likelihood and severity of harm to individuals, consultation where required, and sign-off by an accountable person (and your DPO or privacy officer where you have one). The draft here structures your inputs into the standard sections; it does not judge whether your risks are acceptable. Under GDPR Article 35 a DPIA is mandatory for high-risk processing, and Quebec Law 25 requires a PIA for high-risk projects. Have the final assessment reviewed by a qualified privacy professional before you rely on it.

Questions

When is a DPIA required?

Under GDPR Article 35, a Data Protection Impact Assessment is required for processing that is likely to result in a high risk to individuals, such as large-scale profiling, systematic monitoring, or processing of sensitive data. Quebec Law 25 requires a Privacy Impact Assessment for high-risk projects and certain cross-border transfers.

Is the generated DPIA ready to file?

No. It is a structured first draft based on what you enter. You must review it, add real detail about your controls and risks, and have it validated by a privacy professional before you rely on it.

What is the difference between a DPIA and a PIA?

They are the same idea under different names. GDPR calls it a Data Protection Impact Assessment (DPIA); Quebec Law 25 and many other frameworks call it a Privacy Impact Assessment (PIA). Both document the risks of a processing activity and how you mitigate them.

Is this tool free?

Yes, it is free with no signup. If you need DPIAs done properly and defensibly, our privacy and GDPR readiness services can help.

Not ready for a call yet?

Get the privacy compliance playbook

A few short notes from Jacob on DPIAs, lawful bases, and getting GDPR-ready without the legalese. No fluff, unsubscribe in one click. Reply anytime; it reaches him directly.

From Jacob Masse, founder of traztech. No spam, unsubscribe in one click.

Want it done for you?

GDPR Readiness

We run your DPIAs and get your data processing GDPR-compliant.

Explore GDPR Readiness →

Need this done properly?

We run DPIAs and privacy impact assessments that hold up, map your data flows, and get your processing GDPR and Law 25 ready.

See GDPR Readiness Book a call
Go deeper, still free

Want the full picture on GDPR?

This gives you the shape of the problem. The full picture is all 60 obligations of GDPR, each one explained in plain English, with somewhere to attach the evidence and a readiness score that moves as you close gaps. Start a free assessment and walk every control.

Start your free GDPR assessment See what is in the Workspace

No credit card, no trial clock, no locked features. Traztech makes money when someone wants help closing the gaps, not from the Workspace itself.

Track record

Who is actually doing the work

5
Published CVEs, including a CVSS 9.1
76
Controls taken from nothing to a passed SOC 2 Type II
Zero
Exceptions on that Type II report
20+
Penetration testing engagements delivered

Published vulnerability research

Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.

A SOC 2 Type II built from nothing

At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation across 76 controls with zero exceptions, on a team of 15.