# Compliance evidence of the provider

> PROPOSAL — generated by StackToIT Assess. Architect review required before any decision.

Run `f6267c3f-2848-4aa5-89df-5fee8b15b3b9` · source digest `sha256:812c5ae3f6cc8530163abbf5b6fbe305ed3b363c4886ec6b87623db857ea0c70`

Provider evidence describes the provider's own controls and attestations. It is not a statement about the workload and does not make a workload compliant with any framework; the customer's own controls and an external review decide that.

Evidence judged as of 2026-11-02; a row is vouched for for 90 days after it was verified. Read from: STACKIT certificates and attestations by service (the certificates page stackit.com/en/why-stackit/benefits/certificates and the documents it links; each row names its document); STACKIT certificates and attestations of the provider organisation and its facilities (the certificates page stackit.com/en/why-stackit/benefits/certificates and the documents it links; each row names its document).

Frameworks in scope: BSI C5, GDPR, ISAE 3000 (SOC 2), ISAE 3402, ISO 22301, ISO/IEC 20000-1, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, TISAX. Services of the draft: STACKIT Application Load Balancer, STACKIT KMS, STACKIT Key Value Store (Valkey), STACKIT Kubernetes Engine (SKE), STACKIT Logs, STACKIT MariaDB, STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), STACKIT OpenSearch, STACKIT PostgreSQL Flex, STACKIT RabbitMQ, STACKIT Secrets Manager, STACKIT network, STACKIT project networking / Network Area (SNA), STACKIT security group, STACKIT service account for the workload.

| Service | Framework | State | Reason |
|---|---|---|---|
| STACKIT Application Load Balancer | BSI C5 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for BSI C5; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document |
| STACKIT Application Load Balancer | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document |
| STACKIT Application Load Balancer | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document |
| STACKIT Application Load Balancer | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document |
| STACKIT Application Load Balancer | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document |
| STACKIT Application Load Balancer | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document |
| STACKIT Application Load Balancer | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document |
| STACKIT Application Load Balancer | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document |
| STACKIT Application Load Balancer | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document |
| STACKIT Application Load Balancer | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document |
| STACKIT KMS | BSI C5 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for BSI C5; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document |
| STACKIT KMS | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document |
| STACKIT KMS | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT KMS, so whether it covers this service has to be read from the document |
| STACKIT KMS | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document |
| STACKIT KMS | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document |
| STACKIT KMS | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document |
| STACKIT KMS | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document |
| STACKIT KMS | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document |
| STACKIT KMS | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document |
| STACKIT KMS | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document |
| STACKIT Key Value Store (Valkey) | BSI C5 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for BSI C5; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document |
| STACKIT Key Value Store (Valkey) | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document |
| STACKIT Key Value Store (Valkey) | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document |
| STACKIT Key Value Store (Valkey) | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document |
| STACKIT Key Value Store (Valkey) | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document |
| STACKIT Key Value Store (Valkey) | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document |
| STACKIT Key Value Store (Valkey) | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document |
| STACKIT Key Value Store (Valkey) | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document |
| STACKIT Key Value Store (Valkey) | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document |
| STACKIT Key Value Store (Valkey) | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document |
| STACKIT Kubernetes Engine (SKE) | BSI C5 | CUSTOMER CONTROL REQUIRED | the evidence covers the provider's side at most; the customer's own controls for this framework are still required and are not assessed here |
| STACKIT Kubernetes Engine (SKE) | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document |
| STACKIT Kubernetes Engine (SKE) | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document |
| STACKIT Kubernetes Engine (SKE) | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document |
| STACKIT Kubernetes Engine (SKE) | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document |
| STACKIT Kubernetes Engine (SKE) | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document |
| STACKIT Kubernetes Engine (SKE) | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document |
| STACKIT Kubernetes Engine (SKE) | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document |
| STACKIT Kubernetes Engine (SKE) | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document |
| STACKIT Kubernetes Engine (SKE) | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document |
| STACKIT Logs | BSI C5 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for BSI C5; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document |
| STACKIT Logs | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document |
| STACKIT Logs | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Logs, so whether it covers this service has to be read from the document |
| STACKIT Logs | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document |
| STACKIT Logs | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document |
| STACKIT Logs | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document |
| STACKIT Logs | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document |
| STACKIT Logs | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document |
| STACKIT Logs | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document |
| STACKIT Logs | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document |
| STACKIT MariaDB | BSI C5 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for BSI C5; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document |
| STACKIT MariaDB | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document |
| STACKIT MariaDB | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document |
| STACKIT MariaDB | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document |
| STACKIT MariaDB | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document |
| STACKIT MariaDB | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document |
| STACKIT MariaDB | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document |
| STACKIT MariaDB | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document |
| STACKIT MariaDB | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document |
| STACKIT MariaDB | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document |
| STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) | BSI C5 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for BSI C5; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document |
| STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document |
| STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document |
| STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document |
| STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document |
| STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document |
| STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document |
| STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document |
| STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document |
| STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option) | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document |
| STACKIT OpenSearch | BSI C5 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for BSI C5; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document |
| STACKIT OpenSearch | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document |
| STACKIT OpenSearch | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document |
| STACKIT OpenSearch | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document |
| STACKIT OpenSearch | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document |
| STACKIT OpenSearch | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document |
| STACKIT OpenSearch | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document |
| STACKIT OpenSearch | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document |
| STACKIT OpenSearch | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document |
| STACKIT OpenSearch | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document |
| STACKIT PostgreSQL Flex | BSI C5 | CUSTOMER CONTROL REQUIRED | the evidence covers the provider's side at most; the customer's own controls for this framework are still required and are not assessed here |
| STACKIT PostgreSQL Flex | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document |
| STACKIT PostgreSQL Flex | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document |
| STACKIT PostgreSQL Flex | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document |
| STACKIT PostgreSQL Flex | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document |
| STACKIT PostgreSQL Flex | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document |
| STACKIT PostgreSQL Flex | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document |
| STACKIT PostgreSQL Flex | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document |
| STACKIT PostgreSQL Flex | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document |
| STACKIT PostgreSQL Flex | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | BSI C5 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for BSI C5; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT Secrets Manager | BSI C5 | CUSTOMER CONTROL REQUIRED | the evidence covers the provider's side at most; the customer's own controls for this framework are still required and are not assessed here |
| STACKIT Secrets Manager | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document |
| STACKIT Secrets Manager | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document |
| STACKIT Secrets Manager | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document |
| STACKIT Secrets Manager | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document |
| STACKIT Secrets Manager | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document |
| STACKIT Secrets Manager | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document |
| STACKIT Secrets Manager | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document |
| STACKIT Secrets Manager | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document |
| STACKIT Secrets Manager | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document |
| STACKIT network | BSI C5 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for BSI C5; its document does not name STACKIT network, so whether it covers this service has to be read from the document |
| STACKIT network | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT network, so whether it covers this service has to be read from the document |
| STACKIT network | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT network, so whether it covers this service has to be read from the document |
| STACKIT network | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT network, so whether it covers this service has to be read from the document |
| STACKIT network | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT network, so whether it covers this service has to be read from the document |
| STACKIT network | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT network, so whether it covers this service has to be read from the document |
| STACKIT network | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT network, so whether it covers this service has to be read from the document |
| STACKIT network | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT network, so whether it covers this service has to be read from the document |
| STACKIT network | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT network, so whether it covers this service has to be read from the document |
| STACKIT network | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT network, so whether it covers this service has to be read from the document |
| STACKIT project networking / Network Area (SNA) | BSI C5 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for BSI C5; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document |
| STACKIT project networking / Network Area (SNA) | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document |
| STACKIT project networking / Network Area (SNA) | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document |
| STACKIT project networking / Network Area (SNA) | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document |
| STACKIT project networking / Network Area (SNA) | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document |
| STACKIT project networking / Network Area (SNA) | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document |
| STACKIT project networking / Network Area (SNA) | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document |
| STACKIT project networking / Network Area (SNA) | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document |
| STACKIT project networking / Network Area (SNA) | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document |
| STACKIT project networking / Network Area (SNA) | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document |
| STACKIT security group | BSI C5 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for BSI C5; its document does not name STACKIT security group, so whether it covers this service has to be read from the document |
| STACKIT security group | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT security group, so whether it covers this service has to be read from the document |
| STACKIT security group | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT security group, so whether it covers this service has to be read from the document |
| STACKIT security group | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT security group, so whether it covers this service has to be read from the document |
| STACKIT security group | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT security group, so whether it covers this service has to be read from the document |
| STACKIT security group | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT security group, so whether it covers this service has to be read from the document |
| STACKIT security group | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT security group, so whether it covers this service has to be read from the document |
| STACKIT security group | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT security group, so whether it covers this service has to be read from the document |
| STACKIT security group | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT security group, so whether it covers this service has to be read from the document |
| STACKIT security group | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT security group, so whether it covers this service has to be read from the document |
| STACKIT service account for the workload | BSI C5 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for BSI C5; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document |
| STACKIT service account for the workload | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document |
| STACKIT service account for the workload | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document |
| STACKIT service account for the workload | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document |
| STACKIT service account for the workload | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document |
| STACKIT service account for the workload | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document |
| STACKIT service account for the workload | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document |
| STACKIT service account for the workload | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document |
| STACKIT service account for the workload | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document |
| STACKIT service account for the workload | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document |

## Evidence rows

| Framework | Service | Claim | Control | Status | Document | Verified at |
|---|---|---|---|---|---|---|
| BSI C5 | organisation | STACKIT states that its infrastructure is certified according to C5 Type 2 of the BSI | SHARED | CURRENT | https://stackit.com/en/why-stackit/benefits/certificates | 2026-10-08 |
| BSI C5 | STACKIT Kubernetes Engine (SKE) | STACKIT states that its infrastructure is certified according to C5 Type 2 and that the report covers this product and all basic and additional criteria | SHARED | CURRENT | https://stackit.com/en/why-stackit/benefits/certificates | 2026-10-08 |
| BSI C5 | STACKIT PostgreSQL Flex | STACKIT states that its infrastructure is certified according to C5 Type 2 and that the report covers this product and all basic and additional criteria | SHARED | CURRENT | https://stackit.com/en/why-stackit/benefits/certificates | 2026-10-08 |
| BSI C5 | STACKIT Secrets Manager | STACKIT states that its infrastructure is certified according to C5 Type 2 and that the report covers this product and all basic and additional criteria | SHARED | CURRENT | https://stackit.com/en/why-stackit/benefits/certificates | 2026-10-08 |
| GDPR | organisation | STACKIT states that the development of its cloud takes place in Germany, that its servers and data centers are located in Germany and Austria, and that its cloud operates in accordance with European data protection standards | SHARED | CURRENT | https://stackit.com/en/why-stackit/benefits/certificates | 2026-10-08 |
| ISAE 3000 (SOC 2) | organisation | STACKIT states that its infrastructure holds an ISAE 3000 (SOC 2) certification in addition to C5 | SHARED | CURRENT | https://stackit.com/en/why-stackit/benefits/certificates | 2026-10-08 |
| ISAE 3402 | organisation | STACKIT states that its infrastructure holds an ISAE 3402 certificate in addition to C5 | SHARED | CURRENT | https://stackit.com/en/why-stackit/benefits/certificates | 2026-10-08 |
| ISO 22301 | organisation | TÜV Rheinland Cert GmbH certified that the requirements of ISO 22301:2019 are met by Schwarz Digits Cloud GmbH & Co. KG, certificate registration number 01 195 2500863, initial certification 2026 | PROVIDER | CURRENT | https://stackit.com/en/asset/download/61434/file/ISO22301.pdf?version=2 | 2026-10-08 |
| ISO/IEC 20000-1 | organisation | TÜV SÜD Management Service GmbH certified that the requirements of ISO/IEC 20000-1:2018 are met by Schwarz Digits KG, certificate registration number 12 410 60762 TMS | PROVIDER | CURRENT | https://stackit.com/en/asset/download/40661/file/240206_STACKIT_Zertifikat_ISO-20000-1_DE_ug%2520%25281%2529.pdf?version=4 | 2026-10-08 |
| ISO/IEC 27001 | organisation | TÜV Rheinland Cert GmbH certified that the requirements of ISO/IEC 27001:2022 are met by STACKIT GmbH & Co. KG, certificate registration number 01 153 2500863 | PROVIDER | CURRENT | https://stackit.com/en/asset/download/50680/file/ISO%253AIEC%252027001_2022_EN.pdf?version=2 | 2026-10-08 |
| ISO/IEC 27017 | organisation | The ISO/IEC 27001:2022 certificate of STACKIT GmbH & Co. KG states a Statement of Applicability with the additional measures for ISO/IEC 27017:2015 | SHARED | CURRENT | https://stackit.com/en/asset/download/50680/file/ISO%253AIEC%252027001_2022_EN.pdf?version=2 | 2026-10-08 |
| ISO/IEC 27018 | organisation | The ISO/IEC 27001:2022 certificate of STACKIT GmbH & Co. KG states a Statement of Applicability with the additional measures for ISO/IEC 27018:2019 | SHARED | CURRENT | https://stackit.com/en/asset/download/50680/file/ISO%253AIEC%252027001_2022_EN.pdf?version=2 | 2026-10-08 |
| TISAX | organisation | STACKIT states a successful TISAX assessment, Level 3, for the automotive industry | SHARED | CURRENT | https://stackit.com/en/why-stackit/benefits/certificates | 2026-10-08 |