VamiGRC Trust Center — Security, Compliance & Sovereign Hosting

01 — Compliance & Certifications

Built on certified foundations.

VamiGRC is operated by VamiSec GmbH, whose information security management system is certified to ISO/IEC 27001 by a DAkkS-accredited body. The operating platform T Cloud Public brings its own attested evidence. We transparently indicate what is certified, what is in preparation, and what is platform evidence.

ISO/IEC 27001

VamiSec GmbH ISMS — certified by the DAkkS-accredited Proks Certification GmbH, valid until 09/2028.

Certified

ISO/IEC 42001

AI management system built to ISO/IEC 42001 — certification in preparation.

In preparation

GDPR

Data processing agreement under Art. 28 GDPR, sub-processors disclosed, platform data in Germany.

DPA available

BSI C5 · ISO 27001 · TISAX

Attestation, label & certificates of the operating platform T Cloud Public (Deutsche Telekom).

Hosting platform

ISO 14001

VamiSec GmbH environmental management system built per ISO 14001:2026 — certification in preparation.

In preparation

EcoVadis

Sustainability rating of VamiSec GmbH — Committed badge, awarded in October 2026.

Committed badge

02 — Hosting & Digital Sovereignty

Sovereign hosting in Germany — under European law.

VamiGRC runs on Deutsche Telekom's T Cloud Public (formerly Open Telekom Cloud) — a sovereign European cloud, for VamiGRC exclusively with data centres in Germany. Platform data and logs are subject to European law and German jurisdiction. SSO sign-in runs through your organisation’s Microsoft Entra tenant; Microsoft 365 processes system e-mails within the EU Data Boundary; AI providers process requests in the USA (see sub-processors).

Data centres in GermanyTwin-core region Biere/Magdeburg (Saxony-Anhalt) — platform and data storage in German data centres.

Logical tenant separationAt application level: every request is validated against the tenant context via Keycloak JWT, complemented by role-based access control.

Encrypted transportTLS for all connections, HTTPS enforced. Credentials for integrations and AI providers are stored encrypted at application level.

Configurable AIThe default LLM is Claude (Anthropic), processed in the USA; embeddings for search are provided by OpenAI (USA). The platform is currently being switched from OpenAI GPT models to Claude; until the switch is complete, OpenAI GPT models (USA, no training use) answer AI requests. No training use — neither by VamiSec nor under the providers' terms. Via your tenant’s routing policy you can restrict chat, assistant and agents to your own models (BYOLLM, local); embeddings for search and individual special functions currently continue to run via OpenAI.

T Cloud PublicDeutsche Telekom · sovereign cloud

BSI C5 Type II (ISAE 3000)
ISO/IEC 27001, 27017, 27018, 27701
SOC 1/2/3, TISAX AL 3
ISO 22301 (BCM), ISO 27001 data centres

Certificates, attestations and labels of the hosting platform (Deutsche Telekom), issued by independent auditors — not of VamiSec GmbH. Source: T Cloud Public certificates & attestations.

03 — Security Controls

How we protect — by domain.

Concrete controls instead of marketing. These measures are part of our security concept and are aligned with VamiSec's ISMS.

Data security

Encrypted transport (TLS, HTTPS enforced); credentials for integrations and AI providers encrypted at application level
Platform data in Germany; after contract end 30 calendar days for data retrieval, then deletion (backups within a further 90 calendar days)
Staff access to customer data only where required for operations, support or onboarding

Application security

Secure SDLC from requirements to operations (details below)
Threat modeling, code review and automated tests in CI
External penetration tests at least annually; management summary on request

Access & identity

SSO via Microsoft Entra ID (OIDC), brokered by Keycloak; MFA per the policies of your Entra tenant
Keycloak JWT validation on every request
Least privilege & role-based access control

Infrastructure

Sovereign hosting on T Cloud Public (DE)
Containerised operation on Kubernetes; logical tenant separation at application level
Central secrets management — credentials are loaded at runtime from Kubernetes secrets

Logging & traceability

Structured logging of platform services
Status page status.vamigrc.com with live check of the services
Change history per module and audit log of AI calls

Incident management

Defined incident response process
Affected customers informed without undue delay — target: initial information within 24 hours of becoming aware
Responsible disclosure: report vulnerabilities to security@vamisec.com · security.txt (RFC 9116)

AI governance & human-in-the-loop

Autonomy levels L0–L3 — you decide per workflow how much the AI may do
AI answers with source citations from your knowledge base
Default LLM Claude (Anthropic, USA) — configurable per tenant; chat, assistant and agents can be restricted to your own models (BYOLLM) via routing policy
No training on customer data — neither for our own nor for external AI models

Organisation & governance

ISO/IEC 27001-certified ISMS (DAkkS)
Security awareness training for all employees
Supplier and risk management processes

Business Continuity & Backups

Regular backups of platform data in Germany
Recovery is tested regularly
Operated on T Cloud Public — twin-core region Biere/Magdeburg

04 — Secure Software Development Lifecycle

We build to the same standard our customers have to prove.

At VamiGRC, security is not a downstream step but anchored in every phase of development — from requirements through to operations.

01

Security Requirements Engineering

Security and data-protection requirements are defined before the first line of code.

02

Threat Modeling

Threat modeling to STRIDE and — for AI/agent components — MAESTRO.

03

Code Review

Changes are reviewed before they are merged — with a focus on security and data protection.

04

Automated Testing

The automated test suite runs in CI on every pull request.

05

Secure Deployment

Containers on Kubernetes, HTTPS enforced, credentials held as Kubernetes secrets.

06

Penetration Testing

External penetration tests at least annually; the management summary is available on request.

05 — Sub-processors

Disclosed — who processes which data.

We store platform data and backups in data centres in Germany (T Cloud Public). AI providers (Anthropic, OpenAI) process requests in the USA. Transfers to third countries are based on the EU Standard Contractual Clauses (SCC) and — where the provider is verifiably certified — on the EU-U.S. Data Privacy Framework (DPF). We notify contract customers of changes at least 30 calendar days in advance in text form; within this period you may object on important data-protection grounds.

Sub-processor	Service	Purpose	Region
Telekom Deutschland GmbH	T Cloud Public (formerly Open Telekom Cloud): Kubernetes, managed PostgreSQL database, Object Storage, Redis, container registry, load balancer	Hosting and operation of the entire platform including database, file storage and backups, plus the self-operated components (e.g. Keycloak)	DERegion eu-de (Biere/Magdeburg); support by Telekom sub-processors from EU member states only
Microsoft (Microsoft 365)	Exchange Online (system e-mails, support mailbox) and Microsoft Teams (meetings)	Sending the platform's system e-mails (e.g. invitations, notifications, supplier questionnaires, compliance packages); handling support requests; onboarding, customer success and support meetings	EUEU Data Boundary; group headquarters USA, limited access from third countries possible (SCC, DPF)
Microsoft (Microsoft Azure)	Azure Service Bus and Azure Blob Storage	Handing over scan jobs of the cloud and identity connectors to the scan worker; storage of the GCP connector’s service account key file — only if you activate such connectors	DE (set before activation)Azure region in Germany, set and evidenced before activation; group headquarters USA (SCC, DPF)
Anthropic	Claude API (claude-haiku-4-5, claude-sonnet-5, claude-opus-5)	Default language model of the AI functions (VamiAI assistant, graph queries, drafts, agents, Teams bot); use determined per tenant during onboarding; replaceable by your own models; no training use (Commercial Terms)	USADirect API, no EU region; Anthropic's infrastructure sub-processors worldwide per provider list; EU Standard Contractual Clauses
OpenAI	OpenAI API: embeddings (text-embedding-3-large) and individual special functions	Vectors for semantic search; special functions such as document export and AI-assisted catalogue import until they are ported; until the switch to Claude is complete, also GPT models for the AI functions; no training use (API terms)	USADirect API, no EU data residency; EU Standard Contractual Clauses
Cloudflare	Cloudflare for SaaS (custom hostnames, TLS, reverse proxy)	Delivery of your public VamiGRC Trust Center on your own domain — only if you use your own domain	GlobalNearest Cloudflare data centre; headquarters USA (DPF, SCC)

Changes as of 4 October 2026 (correction and completion of the list): newly listed OpenAI, Microsoft Azure (optional) and Cloudflare (optional); Microsoft 365 (Exchange Online, Teams) replaces the previous Bookings/Outlook entry and now also covers sending system e-mails; Microsoft Entra External ID removed (SSO sign-in runs through your organisation’s Entra tenant); Anthropic’s region corrected from EU to USA; legal entity specified as Telekom Deutschland GmbH.

Complete, always up-to-date list of sub-processors, including a contact for change notifications: privacy@vamisec.com

06 — Documents & Evidence

Information under Art. 26 and Art. 28 of Regulation (EU) 2023/2854 (Data Act) for VamiGRC as a data processing service. The provisions of your contract are authoritative; we keep this information up to date.

Switching process

You request switching, transfer or erasure in text form; the notice period is two months from receipt of your request
Transition period of at most 30 calendar days, extendable once; if this is technically unfeasible, we notify you within 14 working days and propose an alternative of at most seven months
Then 30 calendar days for data retrieval, followed by erasure with confirmation in text form (backups within a further 90 calendar days)
No switching or data extraction charges; if the contract ends early as a result of switching, only the fee for the current licence year remains payable (before the licence start: the first licence year); we support your exit strategy with all relevant information

Methods and interfaces

Export per register in the user interface (CSV, XLSX, JSON) plus PDF reports for individual objects
Public REST API (v1) with personal access tokens — free of charge for you and for receiving providers you designate
Full export of your tenant, also without switching: on request in text form received no later than one month before the end of the contract, we provide it within ten working days

Known limitations

Licensed third-party standard texts (e.g. ISO standards) only as a reference: catalogue, version, control ID
Not exportable: source code, platform-owned prompt and agent configurations, protected VamiSec templates and playbooks, and cross-tenant operational and security logs where they contain VamiSec trade secrets
AI histories and logs only to the extent they are stored in the tenant
Exports via the interface and API are limited per request (pagination); there is no self-service full export — we create it on request
Documents and attachments as well as workflow and approval actions are not available via the API; you receive documents via the full export

Online register: data structures, formats and standards

Register under Art. 26(b) Data Act · version 1.0 · as of 4 October 2026. It shows the structures, formats, standards and open specifications in which your exportable data is available. The fields of each register are documented in the OpenAPI description of the Public REST API v1, which we provide on request.

Data category	Data structure	Format	Standard / open specification
Register data (e.g. risks, controls, assets, suppliers, processes, incidents, vulnerabilities)	One record per object with the register's fields; links via unique IDs	JSON, CSV, XLSX	JSON: RFC 8259 · CSV: RFC 4180 · XLSX: Office Open XML (ISO/IEC 29500)
Documents and attachments	Original file with metadata (name, type, assignment)	Original format (e.g. PDF, DOCX, XLSX); metadata as JSON	Format of the respective file · JSON: RFC 8259
Control sets, framework catalogues, profiles and system security plans (SSP)	OSCAL models catalog, profile (resolved) and system security plan	OSCAL JSON	NIST OSCAL 1.x (open specification)
Metadata and history (versions, changes, workflow and approval status, assignments)	Entries per object with timestamp, actor and change	JSON	JSON: RFC 8259
Tenant configuration (own frameworks, workflows, reports, templates)	Configuration objects per type	JSON; own frameworks also as OSCAL JSON	JSON: RFC 8259 · NIST OSCAL 1.x
Audit logs and histories of AI actions and approvals (where stored in the tenant)	Log entries with timestamp, actor and action	JSON or CSV	JSON: RFC 8259 · CSV: RFC 4180
Programmatic access (Public REST API v1)	Resources per register, retrievable page by page	JSON over HTTPS; exports also as CSV or XLSX	OpenAPI interface description (machine-readable, on request) · JSON: RFC 8259 · transport: HTTPS (TLS)

Jurisdiction per component

Jurisdiction of the ICT infrastructure under Art. 28(1)(a) Data Act. Providers whose group is headquartered in the USA are additionally subject to US law.

Component	Provider / infrastructure	Jurisdiction
Platform, database, file storage and backups	Telekom Deutschland GmbH — T Cloud Public, data centres Biere/Magdeburg	Germany (EU); support by Telekom sub-processors from EU member states
Identity and sign-in	Keycloak, self-operated on T Cloud Public; SSO via Microsoft Entra ID in the customer's Microsoft tenant	Keycloak: Germany · Entra ID: region of the customer’s Microsoft tenant, group headquarters USA
System e-mails and support	Microsoft 365 (Exchange Online, Microsoft Teams)	EU Data Boundary, group headquarters USA
AI functions	Anthropic (Claude) · OpenAI (embeddings, individual special functions)	USA
Own models (BYOLLM)	Customer infrastructure	As chosen by the customer
Scan connectors (optional)	Microsoft Azure (Service Bus, Blob Storage)	Azure region set before activation; group headquarters USA
Trust Center on your own domain (optional)	Cloudflare (Cloudflare for SaaS)	Global network, headquarters USA

Protection against unlawful governmental access from third countries

General description under Art. 28(1)(b) and Art. 32 Data Act for non-personal data stored in the EU. Personal data is additionally protected by the GDPR and the DPA.

Technical measures

Platform data and backups in data centres in Germany (T Cloud Public)
TLS for all connections; logical tenant separation with every request checked
Third-party AI for chat, assistant and agents can be restricted per tenant to your own models (except embeddings and individual special functions)

Organisational measures

Staff access to customer data on a need-to-know basis only
We review requests from third-country authorities or courts against the conditions of Art. 32(2) and (3) Data Act (for personal data, Art. 48 GDPR) and take reasonable legal remedies against unlawful requests
Disclosure limited to the minimum necessary; prior notice to the customer, except where the request serves law enforcement purposes and for as long as necessary to preserve the effectiveness of the law enforcement activity; requests and their handling are documented

Contractual measures

Sub-processors are contractually bound (DPA, EU Standard Contractual Clauses)
Change of infrastructure provider only to data centres in Germany with a BSI C5 attestation (Type 2) or equivalent evidence
Sub-processor changes at least 30 calendar days in advance, with the option to object

Questions about switching and data export: vamigrc@vamisec.com. Legal basis: Regulation (EU) 2023/2854, Chapters VI and VII, applicable since 12 September 2025.

08 — Environmental management & sustainability

Responsibility beyond information security.

VamiSec GmbH, the operator of VamiGRC, runs a documented environmental management system (EMS) per ISO 14001:2026. It is integrated with our ISO/IEC 27001-certified ISMS into one management system, and our sustainability performance is additionally assessed externally by EcoVadis.

Environmental management system per ISO 14001:2026Environmental policy, registers of environmental aspects and legal obligations, measurable environmental objectives with KPIs and clearly assigned EMS responsibility.

Integrated with the ISMSThe EMS uses the processes of our ISO/IEC 27001-certified ISMS — from change and corrective-action management to a joint management review.

Certification in preparationCertification to ISO 14001 by a DAkkS-accredited body is in preparation; the audit is planned for 2027.

EcoVadis Committed – Sustainability Rating

EcoVadisSustainability rating · Committed badge 2026

In the EcoVadis sustainability rating, VamiSec GmbH was awarded the Committed badge in October 2026 — recognising continuous improvement in sustainability.

The rating and the environmental management system relate to VamiSec GmbH as a company, which develops and operates VamiGRC.

09 — FAQ

Common questions from due diligence.

Where is our data stored?

We store platform data and backups in German data centres of T Cloud Public (Deutsche Telekom); they are subject to European law and German jurisdiction. SSO sign-in runs through your organisation’s Microsoft Entra tenant; Microsoft 365 processes system e-mails within the EU Data Boundary. For AI functions, including semantic search, Anthropic and OpenAI process the respective requests in the USA.

Is VamiGRC ISO 27001 certified?

VamiGRC is operated by VamiSec GmbH, whose ISMS is certified to ISO/IEC 27001 by a DAkkS-accredited body. The operation of VamiGRC follows the processes of this management system. The certified scope explicitly covers, in addition to the consulting services, the associated digital products and supporting information-processing facilities (certificate DE-IS-20250191, ISO/IEC 27001:2022, valid until 18 September 2028). The hosting platform T Cloud Public additionally holds a BSI C5 attestation, ISO 27001 certificates, a TISAX label (AL 3) and SOC 1/2/3 reports.

How do users authenticate?

Via single sign-on through Microsoft Entra ID (OIDC); multi-factor authentication follows the policies of your Entra tenant. Every API request is additionally validated against the tenant context via Keycloak JWT; access follows the least-privilege principle. We operate Keycloak ourselves on T Cloud Public — it brokers sign-in and issues the tenant-bound tokens, which is why it does not appear as a sub-processor.

Does the AI see our data, which models do you use — and is our data used for training?

The default LLM behind VamiAI is Claude (Anthropic); processing takes place via Anthropic's API in the USA. For semantic search, OpenAI generates embeddings, also in the USA; individual special functions use OpenAI until they are ported. The platform is currently being switched from OpenAI GPT models to Claude; until the switch is complete, OpenAI GPT models (USA, no training use) answer AI requests. Under their contractual terms (Anthropic Commercial Terms, OpenAI API terms), neither provider uses your inputs and outputs to train models. VamiSec itself does not use your data as training data either: we do not train or fine-tune any AI models with it. Via your tenant’s routing policy you can restrict chat, assistant and agents to your own endpoint (BYOLLM) or locally operated models; embeddings and the special functions mentioned currently continue to run via OpenAI. VamiAI answers are backed by source citations from your knowledge base, and via autonomy levels L0–L3 you decide how much the AI may do without human approval.

How is tenant isolation implemented?

Logically, at application level: all tenants share one database schema, and every record is assigned to a tenant. Every request is validated against the tenant context via Keycloak JWT; role-based access control applies on top. Any cross-tenant access is treated as a security-critical defect.

How will we be informed in the event of a security incident?

We follow a defined incident response process and inform affected customers without undue delay in text form — targeting initial information within 24 hours of becoming aware. Report security vulnerabilities confidentially to security@vamisec.com — also machine-readable via /.well-known/security.txt (RFC 9116).

How do we obtain access to confidential documents?

Public documents are available directly. For pentest summaries, architecture whitepapers or completed questionnaires, a short request to security@vamisec.com is sufficient; evidence subject to an NDA is released after signing.

What availability applies to the platform?

Check the current operational status live at status.vamigrc.com — the page checks the reachability of the services when you open it. We announce planned maintenance in advance. The availability target, maintenance windows and response times are set out in the SLA as part of your contract — talk to us.

What happens to our data after the contract ends?

After the contract ends, you can retrieve your data for 30 calendar days; for a switch of provider under the EU Data Act, this period starts at the end of the transition period. We then delete the data in the production system; backups are deleted within a further 90 calendar days. We confirm both deletions in text form. Details are in the EU Data Act section.