Know who was told what, and when. Before the regulator asks.
Tocsio keeps an audit trail of every notification, acknowledgement and status change, keeps the reporting clocks in view from the moment of detection, and runs in the EU or on your own infrastructure.
- Detected: card authorisations failing (core banking)
- Incident lead paged: delivered, read 09:03:05
- Acknowledged by the incident lead
- Classified as major by the incident lead
- Compliance and management informed: 6 of 6 delivered
The clocks start at detection
Tocsio shows each deadline on the incident from the first alert, so the report is never a surprise.
NIS2 early warning
Within 24 hours of becoming aware of a significant incident (NIS2, Article 23).
DORA major incident reporting
An initial notification within hours of classifying an ICT-related incident as major, then the intermediate and final reports.
GDPR breach notification
To the supervisory authority within 72 hours of becoming aware of a personal data breach (Article 33).
What auditors and supervisors ask for
An audit trail that writes itself
Every alert, notification, delivery receipt, acknowledgement and status change, with its time, exportable for the report and the post-mortem.
- Detected: card authorisations failing (core banking)
- Incident lead paged: delivered, read 09:03:05
- Acknowledged by the incident lead
- Classified as major by the incident lead
- Compliance and management informed: 6 of 6 delivered
EU residency, or your own servers
Hosted in the EU by design, with an on-premises deployment for teams that cannot use SaaS.
Separation of duties
Roles for responders, communicators and readers; single sign-on; a log of every configuration change.
Ready to leave
Your incidents, timelines and configuration export in open formats, so an exit plan is a plan.
Questions regulated teams ask
Does using Tocsio satisfy DORA or NIS2?
No tool does that on its own: the obligations are your organisation's. Tocsio is built to support the reporting workflows: the timeline, the audit trail and the clocks. We go through your ICT third-party requirements on the call.
Can it run on-premises?
Yes, an on-premises deployment is part of the design for teams whose data may not leave their network.
Who is behind Tocsio?
A software company registered in Poland, in the EU. The details are on the company information page.
Show us your incident process.
Who must be informed, by when, and how you prove it today. A 30-minute call with your operations or compliance lead.