Efficiency onlyOff-the-shelf productEstablished, AI retrofitted

Sastrify

Sastrify GmbH, Cologne (owned by Deel since May 2026) ·www.sastrify.com· As of: 2026-07-30

Pulls software inventory, actual usage and contract data into one register, flags notice periods before an auto renewal fires, and holds the price you pay against a benchmark database built from other companies' contracts.

Work through this tool with an AI

ClaudeChatGPTPerplexity

Our verdict

Going without it does not really set you back: the substitute is a spreadsheet plus a calendar, and it gets you surprisingly far. Nor is it an edge, since customers never see your procurement. The value here is an arithmetic result, not a principle. It only appears once the annual software budget is large enough that the percentage saved clearly exceeds the fee of 12,500 euros and up, plus the internal effort. Below that line the tool costs more than the problem does.

Evidence:As of 2026-07-30Package prices from 12,500, 15,000 and 25,000 euros a year, no free tier, detailed pricing only on requestOpen sourceAs of 2026-07-30Legal entity Sastrify GmbH, Cologne, local court Cologne HRB 102066, managing directors Lackinger and MessingOpen sourceAs of 2026-07-30Originally registered as Sastrix GmbH on 22 June 2020, renamed Sastrify GmbH by resolution of 27 August 2021 under the same register numberOpen sourceAs of 2026-07-30Acquired by Deel, closed end of April 2026, announced early May 2026, terms undisclosed, entire team moving acrossOpen sourceAs of 2026-07-30SOC 2 and GDPR claims, encryption and role based access control; no named hosting provider, no region, no ISO 27001Open sourceAs of 2026-07-30Controller entity, website subprocessors, standard contractual clauses and retention periodsOpen sourceAs of 2026-07-30Series B of 32 million US dollars in August 2023, investors Endeit Capital, HV Capital, FirstMark, Simon Capital, TriplePointOpen sourceAs of 2026-07-30Annual accounts to 31 January 2025 disclosed on 24 February 2026, share capital 61,534 euros, company activeOpen source

Who it fits

Solo

not suitable

A floor of 12,500 euros a year against a handful of subscriptions does not add up. The pricing page offers no self service entry point and no free tier.

Mid-market

suitable with caveats

Works from the point where nobody can still say how many tools are paid for and how many are actually used. Before that the fee exceeds the waste it uncovers, which is why this is conditional rather than a yes.

Enterprise

suitable with caveats

A functional fit for distributed departments, but the evidence is not public: no ISO 27001 certificate, no product level subprocessor list, no named storage location. Procurement would have to obtain all of that in writing before signing.

Buy, switch or build

Off-the-shelf

Spreadsheet, contract folder and calendar reminder

The honest incumbent and, for most companies below roughly 100 staff, the right answer. It costs nothing but discipline and breaks in exactly two places: when nobody notices a tool bought on a company card around procurement, and when the notice period reminder sits in the calendar but belongs to no one.

AI-native

Discovery from sign in data and accounting instead of a maintained list

The newer design reverses the direction: it does not ask which tools you have, it reads them from your single sign on, the card account and the invoice inbox. That reliably surfaces whatever was bought around procurement. What this design does not bring is the benchmark database of other companies' contracts. That is the one part of the comparison you can neither build nor derive from your own data.

Build it yourself

Sign in log plus accounting export into your own table

The inventory is the cheap part and takes a day to build: user list from single sign on, creditor list from accounting, reconciled monthly, notice periods as dated entries with a name beside each one. That surfaces idle licences and forgotten renewals. What the build does not deliver is the answer to the real question: whether the price you pay is the going rate. That answer is the core of the offer, and it is not something you can manufacture yourself.

Our advice

  • Solo: Do not buy. A spreadsheet and a calendar cover this number of subscriptions.
  • Mid-market: Do the arithmetic before the call: annual software budget times a realistic expected saving, against 12,500 euros plus the time of whoever maintains the register.
  • Enterprise: A possible candidate, but settle storage location, subprocessors, audit logging and the product's future after the Deel acquisition in writing before signing.

Who is behind it

Staying power: Funded

In 2026 the nature of this rating changed rather than its level. The funding risk of a venture backed company disappeared with the Deel acquisition. In its place sits the risk that a bought in product gets absorbed into the acquirer's platform. The last blog post of Sastrify's own is dated 17 February 2026, before the announcement.

  • Legal entity and register: Sastrify GmbH, Subbelrather Straße 15a, 50823 Köln, commercial register Amtsgericht Köln HRB 102066, VAT ID DE333084964, managing directors Sven Lackinger and Maximilian MessingAs of 2026-07-30Legal entity Sastrify GmbH, Cologne, local court Cologne HRB 102066, managing directors Lackinger and MessingOpen source · As of 2026-07-30
  • Name change confirmed: Registered on 22.06.2020 as Sastrix GmbH, renamed to Sastrify GmbH by shareholders' resolution of 27.08.2021, register number HRB 102066 unchangedAs of 2026-07-30Originally registered as Sastrix GmbH on 22 June 2020, renamed Sastrify GmbH by resolution of 27 August 2021 under the same register numberOpen source · As of 2026-07-30
  • Acquisition by Deel: Closing reported for late April 2026, announcement in early May 2026, terms not disclosed; the entire team including both founders moves across to DeelAs of 2026-07-30Acquired by Deel, closed end of April 2026, announced early May 2026, terms undisclosed, entire team moving acrossOpen source · As of 2026-07-30
  • Acquisition confirmed by counsel: Orrick states that it advised Deel on the acquisition of Sastrify, announcement dated May 2026As of 2026-07-30orrick.com/en/News/2026/05/Deel-Acquires-SastrifyOpen source · As of 2026-07-30
  • Funding before the acquisition: Series B of USD 32 million in August 2023 led by Endeit Capital, alongside HV Capital, FirstMark Capital, Simon Capital and TriplePoint Capital; a top-up in late 2023 from Reimann Investors, at the same time the purchase of Pengu (Amsterdam)As of 2026-07-30Series B of 32 million US dollars in August 2023, investors Endeit Capital, HV Capital, FirstMark, Simon Capital, TriplePointOpen source · As of 2026-07-30
  • Latest disclosed annual accounts: Financial year ended 31.01.2025, filed on 24.02.2026; share capital 61,534 euros; revenue and headcount not publicly availableAs of 2026-07-30Annual accounts to 31 January 2025 disclosed on 24 February 2026, share capital 61,534 euros, company activeOpen source · As of 2026-07-30

Cost of leaving: Moderate

The negotiated contracts stay with each software vendor and do not hang on this tool. That is the easy part. Two things weigh more. First, a documented export path for the inventory you built, together with contract documents and cost history, is not publicly substantiated; the help pages consistently describe the way in and not the way out. Second, anyone who bought the package with assisted negotiation has outsourced a capability and has to rebuild it on the way out.

Regulation and data

How to read the traffic lightHow to read the traffic lightThe traffic light rates how well a point is evidenced, not how good the tool is. It draws only on the value, note and source held in the profile. Where a statement is missing, it rates the absence, not a guess. A well-reasoned "unclear" on a point that matters little for this tool is yellow. A missing source on a point that decides whether you can use it at all is red.documented, no condition attacheddocumented, tied to a conditiondocumented, but unfavourableopen on a point that decides usability
Data processing agreementScale for this point: Data processing agreementdocumented, no condition attached: Auftragsverarbeitungsvertrag öffentlich abrufbar und ohne weitere Bedingung Bestandteil des Vertrags; oder er entfällt nachvollziehbar begründet, weil kein Anbieter Kundendaten verarbeitet.documented, tied to a condition: Vertrag existiert, ist aber an einen Tarif gebunden, nur nach Anfrage einsehbar oder allein in den Nutzungsbedingungen geregelt statt als eigenes Dokument.documented, but unfavourable: Kein Auftragsverarbeitungsvertrag im üblichen Sinn: entweder weil der Anbieter für das Kerngeschäft eigenständig Verantwortlicher ist und stattdessen eine andere Konstruktion gilt, oder weil öffentlich offen bleibt, ob überhaupt einer angeboten wird.open on a point that decides usability: Weder ein Vertrag noch ein dokumentierter Weg zu einem Vertrag; der Einkauf hätte nichts, worauf er sich stützen kann.documented, but unfavourableunclearAs of 2026-07-30Controller entity, website subprocessors, standard contractual clauses and retention periodsOpen sourceThe privacy policy points to processing on behalf of the controller under Article 28 GDPR for the identity provider integration. No standalone data processing agreement is linked on the site; it has to be requested.As of 2026-07-30
Storage locationScale for this point: Storage locationdocumented, no condition attached: EU-Speicherort ohne Zusatzkosten und ohne Tarifbindung, oder der Ort ist vollständig selbst bestimmbar, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: EU-Speicherort möglich, aber an einen Tarif, einen gesondert zu aktivierenden Zusatz oder einen Umzug in eine getrennte Umgebung gebunden; oder die EU-Region ist nicht die Voreinstellung.documented, but unfavourable: Kein EU-Speicherort, der Ort ist aber eindeutig benannt, sodass die Folgen bewertbar sind.open on a point that decides usability: Der Speicherort ist öffentlich nicht benannt oder vom Kunden nicht steuerbar, sodass sich die Verarbeitung nicht verorten lässt.open on a point that decides usabilityunclearAs of 2026-07-30SOC 2 and GDPR claims, encryption and role based access control; no named hosting provider, no region, no ISO 27001Open sourceThe data protection page speaks of secure data centres at reputable providers but names neither provider nor region. The US services listed in the privacy policy concern the marketing site, not the product. For customer data inside the application the storage location therefore remains open.As of 2026-07-30
SubprocessorsScale for this point: Subprocessorsdocumented, no condition attached: Vollständige öffentliche Liste der Unterauftragnehmer mit Zweck und Land; oder es gibt keine, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Liste existiert und ist benannt, aber nur nach Anfrage oder nach Zugang zu einem Vertrauensportal einsehbar, oder sie nennt Zweck und Land nicht vollständig.documented, but unfavourable: Keine geführte Liste; namentlich stehen nur einzelne Dienste in der Datenschutzerklärung, überwiegend solche der eigenen Website.open on a point that decides usability: Weder eine Liste noch eine Nennung der Verarbeiter des Produkts, und kein dokumentierter Weg, sie zu erfahren.open on a point that decides usabilitynamed for the website only, not for the productAs of 2026-07-30Controller entity, website subprocessors, standard contractual clauses and retention periodsOpen sourceThe privacy policy names Webflow, Amazon CloudFront, Fastly, Mailchimp, SendGrid, HubSpot, Hotjar, Google, LinkedIn, Facebook and Clearbit. Those are marketing site services. A subprocessor list for the application itself is not public.As of 2026-07-30
Third-country transferScale for this point: Third-country transferdocumented, no condition attached: Keine Übermittlung in ein Drittland, oder die Übermittlung findet statt und die Grundlage ist benannt und im Vertrag verankert, etwa Standardvertragsklauseln, Angemessenheitsbeschluss oder EU-US-Datenschutzrahmen.documented, tied to a condition: Übermittlung findet statt, eine Grundlage ist genannt, aber ohne Zuordnung, welcher Empfänger auf welcher Grundlage arbeitet.documented, but unfavourable: Übermittlung findet statt und die eigenen Unterlagen widersprechen sich, oder die genannte Grundlage bezieht sich erkennbar nur auf einen Randbereich wie die Marketing-Website.open on a point that decides usability: Übermittlung findet erkennbar statt und eine Grundlage wird nirgends genannt.documented, but unfavourablestandard contractual clauses cited, scope unclearAs of 2026-07-30Controller entity, website subprocessors, standard contractual clauses and retention periodsOpen sourceFor transfers to the US the privacy policy cites standard contractual clauses under Article 46 GDPR, in the context of the website. The Deel acquisition, with the acquirer based in San Francisco, reopens this question at product level and it belongs on the table before any signature.As of 2026-07-30
Training on customer dataScale for this point: Training on customer datadocumented, no condition attached: Vertraglich oder in der Datenschutzerklärung ausdrücklich ausgeschlossen, mit Erstreckung auf die eingesetzten Modellanbieter; oder es gibt keine Datenübertragung an einen Anbieter.documented, tied to a condition: Ausschluss ab einem bestimmten Tarif, oder die Zusage steht nur auf einer Dokumentationsseite statt im Vertrag, oder die Frage stellt sich für das Werkzeug sachlich kaum und der Anbieter schweigt dazu.documented, but unfavourable: Nutzung ist die Voreinstellung und nur ein Widerspruch beendet sie; oder der Anbieter trainiert eigene Modelle auf bereinigten Kundendaten.open on a point that decides usability: Keine Aussage, obwohl das Werkzeug KI-Funktionen auf Kundeninhalten betreibt.open on a point that decides usabilityunclearNo public statement, even though the product runs AI contract capture and an AI assistant and advertises a benchmark database built from contracts. That is exactly where the question bites: whether and in what form your own contract data feeds that database or any model is documented nowhere.no source given · As of 2026-07-30
Retention and deletionScale for this point: Retention and deletiondocumented, no condition attached: Löschfristen nach Vertragsende beziffert und die Löschung oder Rückgabe zugesagt; oder die Fristen bestimmt der Betreiber selbst, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Löschung ist zugesagt, die Fristen sind aber nur teilweise beziffert, oder Sicherungskopien sind ausdrücklich ausgenommen.documented, but unfavourable: Nur der Grundsatz der Erforderlichkeit ohne jede Frist nach Vertragsende, oder Fristen sind allein für Randbereiche wie Website-Protokolle genannt.open on a point that decides usability: Keine Aussage zu Aufbewahrung und Löschung.documented, but unfavourablequantified for website data onlyAs of 2026-07-30Controller entity, website subprocessors, standard contractual clauses and retention periodsOpen sourceServer logs deleted after 14 days at the latest, applicant data 6 months after rejection and one year with consent. For contract documents and inventory data inside the application the vendor only states they are kept as long as needed to deliver the service. No post termination deadline is public.As of 2026-07-30
CertificationsScale for this point: Certificationsdocumented, no condition attached: Mehrere anerkannte Nachweise, benannt mit Norm, Fassung und Geltungsbereich, und bezogen auf den Anbieter selbst.documented, tied to a condition: Ein anerkannter Nachweis für den Anbieter belegt, der Bericht aber nur auf Anfrage, oder der Nachweis hängt an einem Tarif, oder der Geltungsbereich bleibt teilweise offen.documented, but unfavourable: Nur pauschale Nennung ohne Norm-Fassung und Geltungsbereich, oder bloße Selbstauskunft, oder die Nachweise gehören dem Infrastrukturanbieter statt dem Anbieter, oder der Prüfzeitraum ist erkennbar veraltet, oder die eigenen Angaben widersprechen sich.open on a point that decides usability: Kein Nachweis genannt und keine Sicherheits- oder Vertrauensseite vorhanden.documented, but unfavourableSOC 2 claimed, no ISO 27001As of 2026-07-30SOC 2 and GDPR claims, encryption and role based access control; no named hosting provider, no region, no ISO 27001Open sourceThe site carries a SOC 2 badge and a GDPR badge. Neither the SOC 2 report type nor its audit window is named, and no report is publicly retrievable. An ISO 27001 certificate is claimed nowhere. The vendor operates no trust portal.As of 2026-07-30
EU AI Act, Article 50Scale for this point: EU AI Act, Article 50documented, no condition attached: Der Anbieter macht eine belegte Aussage, die die eigene Pflicht trägt, etwa Modelldokumentation und Zertifizierung nach ISO/IEC 42001; oder das Werkzeug enthält nachvollziehbar begründet kein KI-System im Sinne der Verordnung.documented, tied to a condition: Der Anbieter äußert sich zur Verordnung oder ordnet die eigene Funktion ein, eine benannte Zusage zu den Transparenzpflichten aus Artikel 50 fehlt aber; oder das Werkzeug enthält kein KI-System, das gegenüber Menschen auftritt, und der Anbieter schweigt.documented, but unfavourable: Das Produkt enthält KI-Funktionen, der Anbieter schweigt dazu oder trägt ein Selbstetikett ohne Nachweis; die Kennzeichnung ist vom Betreiber aber selbst setzbar.open on a point that decides usability: KI spricht im Produkt unmittelbar mit Endkunden und der Anbieter sagt zu Artikel 50 nichts; die Kennzeichnung lässt sich ohne Zusage des Anbieters nicht sicher setzen.documented, but unfavourableunclearA notable gap: the product advertises that it produces audit documentation for DORA, NIS2 and the AI Act, yet says nothing about its own transparency duties under Article 50 of the AI Regulation. Anyone using it for evidence should first ask the vendor about its own.no source given · As of 2026-07-30
Audit loggingScale for this point: Audit loggingdocumented, no condition attached: Nachvollziehbares Protokoll über Zugriffe und Änderungen in allen Tarifen enthalten, mit benannter Frist und Ausleitung in eigene Systeme; oder die Nachvollziehbarkeit liegt vollständig in eigener Hand, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Protokoll vorhanden, aber an einen höheren Tarif oder einen kostenpflichtigen Zusatz gebunden, oder die Ausleitung fehlt in den unteren Stufen; Reichweite und Frist sind benannt.documented, but unfavourable: Protokolle sind nur anbieterseitig beschrieben, oder Reichweite und Frist bleiben offen, sodass sich Nachweispflichten nicht planen lassen.open on a point that decides usability: Öffentlich nicht belegt, ob der Kunde überhaupt ein auswertbares Protokoll erhält.open on a point that decides usabilityunclearAs of 2026-07-30SOC 2 and GDPR claims, encryption and role based access control; no named hosting provider, no region, no ISO 27001Open sourceRole based access control and internal plus external audits are named. Whether customers receive their own auditable log of access and changes, and in which package, is nowhere stated publicly.As of 2026-07-30

What it really costs

Entry price

Three packages, each labelled starting from: Software Management from 12,500 euros a year, Vendor Benchmarks from 15,000 euros, Expert Procurement from 25,000 euros. No free tier, no self service plan, the actual price only through a quote conversation.As of 2026-07-30Package prices from 12,500, 15,000 and 25,000 euros a year, no free tier, detailed pricing only on requestOpen source

As of 2026-07-30

What gets expensive

Two places. First the words starting from: the pricing page gives you no way to derive what the contract actually costs, and it names neither minimum term nor notice period nor renewal mechanics. Second the step up from plain visibility to assisted negotiation, which doubles the entry price. On top sits the quiet line item nobody budgets: without a person who maintains the inventory and chases the alerts, the tool produces a tidy register and no savings.

What it displaces

  • Software inventory as a maintained spreadsheet
  • Notice periods as calendar entries with no owner
  • Price negotiation by gut feel without a benchmark

Interfaces

  • Single sign-on and identity provider integration, Okta among them
  • Integrations with accounting and spend management tools, among them DATEV, Pleo, Moss, Ramp and Spendesk
  • Bulk import of inventory and spend data as XLSX, CSV, TSV, XML or JSON
  • Document intake by forwarding to an email address
  • Notifications into Slack
  • No publicly documented API for pulling data back out

Matching methods

  • Value Creation Plan (Lever Categories and Execution Rate)The plan requires named action points with an implementation rate, and contract data with notice periods and price comparison supplies the cost-side points in verifiable form.
  • Rule of 40 (Toward 60)The metric forces a trade-off between growth and profit, and the software estate is one of the few cost lines where profit can be lifted without giving up growth.
  • Operating Model Grid (Standardization and Integration)The grid asks how much standardisation several units genuinely need, and a shared register of estate, usage and contracts is the evidence base without which that question gets settled by opinion.

Sources

  1. 1.Package prices from 12,500, 15,000 and 25,000 euros a year, no free tier, detailed pricing only on request (opens in a new tab)sastrify.com/pricing · As of 2026-07-30
  2. 2.Legal entity Sastrify GmbH, Cologne, local court Cologne HRB 102066, managing directors Lackinger and Messing (opens in a new tab)sastrify.com/imprint · As of 2026-07-30
  3. 3.Originally registered as Sastrix GmbH on 22 June 2020, renamed Sastrify GmbH by resolution of 27 August 2021 under the same register number (opens in a new tab)online-handelsregister.de/…/Sastrix-GmbH · As of 2026-07-30
  4. 4.Acquired by Deel, closed end of April 2026, announced early May 2026, terms undisclosed, entire team moving across (opens in a new tab)reworked.co/…/deel-buys-sastrify-to-tame-saas-spend · As of 2026-07-30
  5. 5.SOC 2 and GDPR claims, encryption and role based access control; no named hosting provider, no region, no ISO 27001 (opens in a new tab)sastrify.com/data-protection · As of 2026-07-30
  6. 6.Controller entity, website subprocessors, standard contractual clauses and retention periods (opens in a new tab)sastrify.com/privacy-policy · As of 2026-07-30
  7. 7.Series B of 32 million US dollars in August 2023, investors Endeit Capital, HV Capital, FirstMark, Simon Capital, TriplePoint (opens in a new tab)prnewswire.com/… · As of 2026-07-30
  8. 8.Annual accounts to 31 January 2025 disclosed on 24 February 2026, share capital 61,534 euros, company active (opens in a new tab)northdata.com/Sastrify%20GmbH,%20K%C3%B6ln/HRB%20102066 · As of 2026-07-30
  9. 9.orrick.com/en/News/2026/05/Deel-Acquires-Sastrify (opens in a new tab)As of 2026-07-30

Last reviewed: 2026-07-30 by Dr. Oliver Gausmann, Convios GmbH

Details out of date? Let us know.

← Back to the toolbox