StackToIT Migration Intelligence Workspace

Executive lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Architect lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Platform lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Security lens: the sections are in the order this reader usually wants, and Costs and Migration Plan are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Application owner lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Programme lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

FinOps lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Engineering lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Security & Resilience

What has been proven about security and resilience, what has not, and what needs evidence from outside; the resilience of each unit, where this run assesses it, is on the Operations page.

15 source weaknesses stated (1 carried unchanged, 9 not carried, 5 not compared with the draft) (1 plaintext public listener; world-open ingress on tcp 8080; 1 transit encryption off; 2 final snapshots skipped; 5 single-node data stores; 1 access policy for every principal), 6 wait for security acceptance — the draft changes no security policy; decide before the migration.

1 assumption about unmanaged security configuration (a conclusion that rests on one is an assumption, not a proof).

Assurance Center

Across the 4 intents this run records, 12 items wait for a decision, 10 need evidence that the scan does not hold and 6 are not assessed in this build. These are counts of open items, not a measure of progress: a count of zero says that nothing is open in that intent, not that the intent is settled.

Open items per intent (an item is a unit, a workload or a dimension; an intent with no item is counted by its own state)
Intent	Item	Decision required	Evidence required	Not assessed
Data movement	stateful unit	6	0	0
Resilience	unit that holds state or states a zone, replication or backup fact	0	6	0
Identity transition	workload	5	0	0
Sovereignty	dimension	1	4	6

What was read, and what was not

A static reading of the source Terraform, and nothing set outside it

What was read: the access model the source Terraform states (security groups, rules, network ACLs, routes, listeners it manages). That is a static reading of the source, and it is the only claim this report makes about access.

What was not read: anything set outside this Terraform — console changes, default or pre-existing network ACLs, routing not in the source, imported networks. That the target is equivalent to the access model of the real AWS environment needs AWS inventory evidence or your confirmation, and StackToIT has neither. Where a disposition rests on such an assumption it says so (ASSUMPTION) and is not PRESERVED.

Assumptions about configuration the source does not manage

1 assumption, one per unit and kind: none is a proof, and no answer changes it

StackToIT reads the Terraform it is given. Security configuration that source does not manage (an AWS default network ACL, an imported VPC or security group, a change made in the console) is not read and not verified. A conclusion of the draft that relies on it is an assumption and not a proof: it is not a NOT CARRIED property (nothing the source states is dropped) and no answer changes it. 1 assumption below.

Assumptions, one per unit and kind
Unit	Written in the draft as	Configuration missing for	Assumption
`module.retail_app_ecs.module.alb.aws_lb.this`	stackit_application_load_balancer.retail_app_ecs_alb_this		the network ACLs of the subnets of module.retail_app_ecs.module.alb.aws_lb.this is not managed by this source and is taken as unrestricted — not verified: the clients that reach module.retail_app_ecs.module.alb.aws_lb.this are an assumption and not a proof. Its ledger row network exposure is REVIEW (ASSUMPTION), not PRESERVED; the security group rules the source states are read as before.

Carried source weaknesses

How to read the weaknesses and their acceptance

StackToIT reads these weaknesses in the source and states them: it changes none of them. 15 observations below, each non-blocking (SECURITY_OBSERVATION): not a finding of a unit, not a decision, not part of the critical settings, and none changes a class, a confidence or an eligibility. They are counted apart from the critical settings. The column “In the draft” says whether the draft writes the same setting (Preserved), does not carry it (Not carried) or was not compared with the source (Not verified). A hardening is a note for the owner, not a change the draft makes; the source line is that of the resource block, not of the attribute.

Level and acceptance: a HIGH weakness (world-open ingress on an application port, a plaintext public listener, transit encryption off, an access policy for every principal) that the draft carries, carries unenforced or did not compare with the source waits for a security acceptance: 6 of them here. The weakness blocks no unit, but the GO or ROLLBACK decision of the migration waits for the step that records who accepted it, when and by what reference (owner: Security Architect). A MEDIUM weakness (a single node, a final snapshot skipped) stays an observation.

Plaintext public listener: 1
World-open ingress on an application port: 5
Transit encryption off: 1
Final snapshot skipped: 2
Single-node data store: 5
Access policy for every principal: 1

15 weaknesses of the source, one per unit and setting: what the source does and what the draft does with it

Weaknesses of the source, one per unit and setting
Unit	Weakness	Level	What the source does	Source line	In the draft	Security acceptance	Hardening (a note)	Owner
`module.dependencies.aws_mq_broker.mq`	Single-node data store	MEDIUM	The source broker module.dependencies.aws_mq_broker.mq runs as SINGLE_INSTANCE: one broker in one availability zone, no standby.	`../../lib/dependencies/mq.tf:12`	Not verified: the redundancy of the drafted stackit_rabbitmq_instance is the plan the draft leaves to a person (a variable), and this build does not compare it with the source's single instance.	MEDIUM: stays an observation; no acceptance is asked for.	choose a target plan with more than one node, or accept the single instance knowingly.	Security Architect
`module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`	Single-node data store	MEDIUM	The source domain module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this runs on one data node (cluster_config.instance_count = 1): a failure or a maintenance of that node takes the domain down.	`.terraform/modules/dependencies.catalog_opensearch/main.tf:29`	Not verified: the cluster_config is not carried (the drafted stackit_opensearch_instance takes a plan that sets the size, a variable); this build does not compare the plan with the source's single node.	MEDIUM: stays an observation; no acceptance is asked for.	choose a target plan with more than one node, or accept the single node knowingly.	Security Architect
`module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this`	Access policy for every principal	HIGH	The access policy of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (module.dependencies.module.catalog_opensearch.aws_opensearch_domain_policy.this) has Statement[0]: Effect Allow for Principal "" with no condition for es:: every caller that can reach the resource is allowed by the policy; only the network and the other controls limit who can.	`.terraform/modules/dependencies.catalog_opensearch/main.tf:269`	Not carried: the draft writes no resource policy: a stackit_opensearch_instance has no policy attribute (pinned provider schema) and is limited by its access list (parameters.sgw_acl), which the draft takes from a variable without a default, so the wildcard principal is not carried and the clients are named by a person.	HIGH: needs no acceptance, because the draft does not carry the weakness (narrowed, replaced or removed, as the draft line says).	name the principals that need access instead of "*", or add a condition that limits the caller (the network, the account or the source address).	Security Architect
`module.dependencies.module.catalog_rds.aws_rds_cluster.this`	Final snapshot skipped	MEDIUM	The source aws_rds_cluster module.dependencies.module.catalog_rds.aws_rds_cluster.this is deleted without a final snapshot (skip_final_snapshot = true): when it is destroyed, its data is gone unless it was exported or backed up separately.	`.terraform/modules/dependencies.catalog_rds/main.tf:61`	Not carried: the draft carries no final-snapshot setting (the NOT CARRIED line of stackit_mariadb_instance.dependencies_catalog_rds_this says the target has none): destroying the drafted instance requests no final backup either.	MEDIUM: stays an observation; no acceptance is asked for.	export the data (or take a backup you keep) before the instance is destroyed, and do not rely on the draft's destroy to keep it.	Security Architect
`module.dependencies.module.catalog_rds.aws_rds_cluster.this`	Single-node data store	MEDIUM	The source cluster module.dependencies.module.catalog_rds.aws_rds_cluster.this has one instance (module.dependencies.module.catalog_rds.aws_rds_cluster_instance.this): no reader in a second zone to take over, a failure or a maintenance of that instance interrupts the database.	`.terraform/modules/dependencies.catalog_rds/main.tf:175`	Not verified: the redundancy of the drafted stackit_mariadb_instance is its flavor and plan, which the draft states where it can (see the ledger row high availability when the source states standby); this build does not compare it with the source's single instance.	MEDIUM: stays an observation; no acceptance is asked for.	choose a target flavor with a replica, or accept the single instance knowingly.	Security Architect
`module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`	Transit encryption off	HIGH	The source replication group module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default has transit_encryption_enabled = false: clients connect without TLS and the traffic between the nodes is not encrypted.	`.terraform/modules/dependencies.checkout_elasticache_redis/main.tf:115`	Not carried: the draft does not carry the plaintext transport: STACKIT Key Value Store enforces TLS (a test on a STACKIT project, Valkey 8, eu01, 2026-09-24, found a plaintext connection closed by the server; knowledge base rule aws.elasticache_replication_group), so the clients that connect without TLS must switch to rediss://.	HIGH: needs no acceptance, because the draft does not carry the weakness (narrowed, replaced or removed, as the draft line says).	have every client connect with TLS (rediss://) and keep the target TLS-only; this is a change to the clients, not to the draft.	Security Architect
`module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default`	Single-node data store	MEDIUM	The source replication group module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default runs on one node (num_cache_clusters states it): a failure or a maintenance of that node takes the cache down.	`.terraform/modules/dependencies.checkout_elasticache_redis/main.tf:115`	Not verified: the redundancy of the drafted stackit_valkey_instance is the plan the draft leaves to a person (a variable), and this build does not compare it with the source's single node.	MEDIUM: stays an observation; no acceptance is asked for.	choose a target plan with more than one node, or accept the single node knowingly.	Security Architect
`module.dependencies.module.orders_rds.aws_rds_cluster.this`	Final snapshot skipped	MEDIUM	The source aws_rds_cluster module.dependencies.module.orders_rds.aws_rds_cluster.this is deleted without a final snapshot (skip_final_snapshot = true): when it is destroyed, its data is gone unless it was exported or backed up separately.	`.terraform/modules/dependencies.orders_rds/main.tf:61`	Not carried: the draft carries no final-snapshot setting (the NOT CARRIED line of stackit_postgresflex_instance.dependencies_orders_rds_this says the target has none): destroying the drafted instance requests no final backup either.	MEDIUM: stays an observation; no acceptance is asked for.	export the data (or take a backup you keep) before the instance is destroyed, and do not rely on the draft's destroy to keep it.	Security Architect
`module.dependencies.module.orders_rds.aws_rds_cluster.this`	Single-node data store	MEDIUM	The source cluster module.dependencies.module.orders_rds.aws_rds_cluster.this has one instance (module.dependencies.module.orders_rds.aws_rds_cluster_instance.this): no reader in a second zone to take over, a failure or a maintenance of that instance interrupts the database.	`.terraform/modules/dependencies.orders_rds/main.tf:175`	Not verified: the redundancy of the drafted stackit_postgresflex_instance is its flavor and plan, which the draft states where it can (see the ledger row high availability when the source states standby); this build does not compare it with the source's single instance.	MEDIUM: stays an observation; no acceptance is asked for.	choose a target flavor with a replica, or accept the single instance knowingly.	Security Architect
`module.retail_app_ecs.module.alb.aws_lb.this`	Plaintext public listener	HIGH	The source load balancer module.retail_app_ecs.module.alb.aws_lb.this is internet-facing and every listener it states is HTTP (port 80 forwards to its targets, no listener is HTTPS or TLS): clients reach the application without transport encryption.	`.terraform/modules/retail_app_ecs.alb/main.tf:5`	Preserved: the drafted listener of stackit_application_load_balancer.retail_app_ecs_alb_this is plain HTTP on port 80, as the source states it; the public address is kept and no HTTPS listener or certificate is added.	HIGH: waits for security acceptance, because the draft carries the weakness. The cutover decision (GO or ROLLBACK) waits for the step that records who accepted it, when and by what reference, or for the hardening.	serve the application over HTTPS (an HTTPS listener with a certificate, certificate_config in the pinned provider schema) and redirect or close port 80.	Security Architect
`module.retail_app_ecs.module.carts_service.aws_security_group.this`	World-open ingress on an application port	HIGH	The source security group module.retail_app_ecs.module.carts_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to.	`../../lib/ecs/service/sg.tf:1`	Not carried: the drafted rule stackit_security_group_rule.retail_app_ecs_carts_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION).	HIGH: waits for security acceptance, because the drafted rule is written as the source states it and is unenforced until the group is attached, so the weakness is not removed. The cutover decision (GO or ROLLBACK) waits for the step that records who accepted it, when and by what reference, or for the hardening.	limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule.	Security Architect
`module.retail_app_ecs.module.catalog_service.aws_security_group.this`	World-open ingress on an application port	HIGH	The source security group module.retail_app_ecs.module.catalog_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to.	`../../lib/ecs/service/sg.tf:1`	Not carried: the drafted rule stackit_security_group_rule.retail_app_ecs_catalog_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION).	HIGH: waits for security acceptance, because the drafted rule is written as the source states it and is unenforced until the group is attached, so the weakness is not removed. The cutover decision (GO or ROLLBACK) waits for the step that records who accepted it, when and by what reference, or for the hardening.	limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule.	Security Architect
`module.retail_app_ecs.module.checkout_service.aws_security_group.this`	World-open ingress on an application port	HIGH	The source security group module.retail_app_ecs.module.checkout_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to.	`../../lib/ecs/service/sg.tf:1`	Not carried: the drafted rule stackit_security_group_rule.retail_app_ecs_checkout_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION).	HIGH: waits for security acceptance, because the drafted rule is written as the source states it and is unenforced until the group is attached, so the weakness is not removed. The cutover decision (GO or ROLLBACK) waits for the step that records who accepted it, when and by what reference, or for the hardening.	limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule.	Security Architect
`module.retail_app_ecs.module.orders_service.aws_security_group.this`	World-open ingress on an application port	HIGH	The source security group module.retail_app_ecs.module.orders_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to.	`../../lib/ecs/service/sg.tf:1`	Not carried: the drafted rule stackit_security_group_rule.retail_app_ecs_orders_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION).	HIGH: waits for security acceptance, because the drafted rule is written as the source states it and is unenforced until the group is attached, so the weakness is not removed. The cutover decision (GO or ROLLBACK) waits for the step that records who accepted it, when and by what reference, or for the hardening.	limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule.	Security Architect
`module.retail_app_ecs.module.ui_service.aws_security_group.this`	World-open ingress on an application port	HIGH	The source security group module.retail_app_ecs.module.ui_service.aws_security_group.this admits tcp 8080 from 0.0.0.0/0 (ingress[0]): any client on the internet can open a connection to that port of every resource the group is attached to.	`../../lib/ecs/service/sg.tf:1`	Not carried: the drafted rule stackit_security_group_rule.retail_app_ecs_ui_service_this_ingress_1 admits 0.0.0.0/0 on the same ports (written as the source states it), but it is UNENFORCED: the group is attached to no target block; its rules restrict nothing on the target until an attachment is designed (decision DEC-GEN-CONVERT-POD-SEGMENTATION).	HIGH: waits for security acceptance, because the drafted rule is written as the source states it and is unenforced until the group is attached, so the weakness is not removed. The cutover decision (GO or ROLLBACK) waits for the step that records who accepted it, when and by what reference, or for the hardening.	limit the source range of the rule to the clients that need the port (the load balancer's addresses or the network's own range) in the draft's rule, or remove the rule.	Security Architect

Provider evidence describes the provider's own controls and attestations. It is not a statement about the workload and does not make a workload compliant with any framework; the customer's own controls and an external review decide that.

Evidence freshness and the frameworks shown

Evidence as of 2026-11-02. A document that was last opened more than 90 days earlier, or whose validity has ended, no longer counts. No framework was asked about, because the input has no field for it; the frameworks shown are those the provider evidence has rows for. Frameworks shown: BSI C5, GDPR, ISAE 3000 (SOC 2), ISAE 3402, ISO 22301, ISO/IEC 20000-1, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, TISAX.

Provider assurance evidence per STACKIT service and framework: 15 services, 10 frameworks

Provider assurance evidence per STACKIT service of the draft and per framework (15 services, 10 frameworks). A state describes what the provider's documents show about the provider's own controls; it says nothing about a workload.
STACKIT service	BSI C5	GDPR	ISAE 3000 (SOC 2)	ISAE 3402	ISO 22301	ISO/IEC 20000-1	ISO/IEC 27001	ISO/IEC 27017	ISO/IEC 27018	TISAX
STACKIT Application Load Balancer	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required
STACKIT KMS	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required
STACKIT Key Value Store (Valkey)	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required
STACKIT Kubernetes Engine (SKE)	Customer control required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required
STACKIT Logs	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required
STACKIT MariaDB	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required
STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required
STACKIT OpenSearch	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required
STACKIT PostgreSQL Flex	Customer control required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required
STACKIT RabbitMQ	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required
STACKIT Secrets Manager	Customer control required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required
STACKIT network	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required
STACKIT project networking / Network Area (SNA)	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required
STACKIT security group	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required
STACKIT service account for the workload	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required

Provider evidence present: a current document describes the provider's own controls for this service. Nothing is concluded about the workload.
Customer control required: a control is shared with, or carried by, the customer; this build does not assess it.
External review required: no current document names this service for this framework (not found is not the same as not certified); somebody has to read the provider's documents.

Why each pair has its state

STACKIT Application Load Balancer

BSI C5 — External review required. only organisation-level evidence exists for BSI C5; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT Application Load Balancer, so whether it covers this service has to be read from the document.

STACKIT KMS

BSI C5 — External review required. only organisation-level evidence exists for BSI C5; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT KMS, so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT KMS, so whether it covers this service has to be read from the document.

STACKIT Key Value Store (Valkey)

BSI C5 — External review required. only organisation-level evidence exists for BSI C5; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT Key Value Store (Valkey), so whether it covers this service has to be read from the document.

STACKIT Kubernetes Engine (SKE)

BSI C5 — Customer control required. the evidence covers the provider's side at most; the customer's own controls for this framework are still required and are not assessed here. The provider has evidence for its own side.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT Kubernetes Engine (SKE), so whether it covers this service has to be read from the document.

STACKIT Logs

BSI C5 — External review required. only organisation-level evidence exists for BSI C5; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Logs, so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT Logs, so whether it covers this service has to be read from the document.

STACKIT MariaDB

BSI C5 — External review required. only organisation-level evidence exists for BSI C5; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT MariaDB, so whether it covers this service has to be read from the document.

STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option)

BSI C5 — External review required. only organisation-level evidence exists for BSI C5; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT MongoDB Flex (alternative — data-model redesign; PostgreSQL Flex JSONB is the other option), so whether it covers this service has to be read from the document.

STACKIT OpenSearch

BSI C5 — External review required. only organisation-level evidence exists for BSI C5; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT OpenSearch, so whether it covers this service has to be read from the document.

STACKIT PostgreSQL Flex

BSI C5 — Customer control required. the evidence covers the provider's side at most; the customer's own controls for this framework are still required and are not assessed here. The provider has evidence for its own side.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document.

STACKIT RabbitMQ

BSI C5 — External review required. only organisation-level evidence exists for BSI C5; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.

STACKIT Secrets Manager

BSI C5 — Customer control required. the evidence covers the provider's side at most; the customer's own controls for this framework are still required and are not assessed here. The provider has evidence for its own side.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document.

STACKIT network

BSI C5 — External review required. only organisation-level evidence exists for BSI C5; its document does not name STACKIT network, so whether it covers this service has to be read from the document.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT network, so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT network, so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT network, so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT network, so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT network, so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT network, so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT network, so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT network, so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT network, so whether it covers this service has to be read from the document.

STACKIT project networking / Network Area (SNA)

BSI C5 — External review required. only organisation-level evidence exists for BSI C5; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT project networking / Network Area (SNA), so whether it covers this service has to be read from the document.

STACKIT security group

BSI C5 — External review required. only organisation-level evidence exists for BSI C5; its document does not name STACKIT security group, so whether it covers this service has to be read from the document.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT security group, so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT security group, so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT security group, so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT security group, so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT security group, so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT security group, so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT security group, so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT security group, so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT security group, so whether it covers this service has to be read from the document.

STACKIT service account for the workload

BSI C5 — External review required. only organisation-level evidence exists for BSI C5; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT service account for the workload, so whether it covers this service has to be read from the document.

The provider documents behind these states: 13 documents, each listed once

The provider documents behind these states (each listed once; a document at organisation level bears on every service)
Framework	Claim	Scope	Service	Control carried by	Row status	Document	Document date	Valid until	Opened	Pairs
BSI C5	STACKIT states that its infrastructure is certified according to C5 Type 2 of the BSI	Statement on the STACKIT certificates page: the report covers the products listed there (the certificates page of STACKIT, stackit.com/en/why-stackit/benefits/certificates) and all basic and additional criteria. The attestation report was not opened. The STACKIT C5 page says a C5 certificate is valid for one year as a rule; no page opened names a date for STACKIT's own attestation, an auditor or an audit period. Press release of 2024-08-21 (opened): C5 Type 1 for the infrastructure stack at the end of 2023, type 2 effectiveness audit confirmed in 2024, appropriateness tested for STACKIT IaaS (Compute Engine, Network & Security, Block Storage, Object Storage).	organisation level	shared	current	https://stackit.com/en/why-stackit/benefits/certificates	not stated	not stated	2026-10-08	12
BSI C5	STACKIT states that its infrastructure is certified according to C5 Type 2 and that the report covers this product and all basic and additional criteria	Product listed under "C5 certified cloud products" on the STACKIT certificates page; C5 Type 2 as that page states it. The attestation report itself was not opened. The page names no audit period, no auditor, no region and no end of validity.	STACKIT Kubernetes Engine (SKE)	shared	current	https://stackit.com/en/why-stackit/benefits/certificates	not stated	not stated	2026-10-08	1
BSI C5	STACKIT states that its infrastructure is certified according to C5 Type 2 and that the report covers this product and all basic and additional criteria	Product listed under "C5 certified cloud products" on the STACKIT certificates page; C5 Type 2 as that page states it. The attestation report itself was not opened. The page names no audit period, no auditor, no region and no end of validity.	STACKIT PostgreSQL Flex	shared	current	https://stackit.com/en/why-stackit/benefits/certificates	not stated	not stated	2026-10-08	1
BSI C5	STACKIT states that its infrastructure is certified according to C5 Type 2 and that the report covers this product and all basic and additional criteria	Product listed under "C5 certified cloud products" on the STACKIT certificates page; C5 Type 2 as that page states it. The attestation report itself was not opened. The page names no audit period, no auditor, no region and no end of validity.	STACKIT Secrets Manager	shared	current	https://stackit.com/en/why-stackit/benefits/certificates	not stated	not stated	2026-10-08	1
GDPR	STACKIT states that the development of its cloud takes place in Germany, that its servers and data centers are located in Germany and Austria, and that its cloud operates in accordance with European data protection standards	Statement on the STACKIT certificates page (provider-side text, not an attestation or a certificate). It is a statement about where and how the provider operates; the customer's own obligations toward personal data stay with the customer. The page names no region id and no attestation document.	organisation level	shared	current	https://stackit.com/en/why-stackit/benefits/certificates	not stated	not stated	2026-10-08	15
ISAE 3000 (SOC 2)	STACKIT states that its infrastructure holds an ISAE 3000 (SOC 2) certification in addition to C5	Statement on the STACKIT certificates page. The report was not opened and the page states no type, no audit period, no auditor and no end of validity. The Schwarz Digits press release of 2024-01-23 (opened) says ISAE 3000 (SOC 2) and ISAE 3402 were issued as type 1 at that time; whether a type 2 exists now is not stated on any page opened. Which products the report covers is not separately stated.	organisation level	shared	current	https://stackit.com/en/why-stackit/benefits/certificates	not stated	not stated	2026-10-08	15
ISAE 3402	STACKIT states that its infrastructure holds an ISAE 3402 certificate in addition to C5	Statement on the STACKIT certificates page. The report was not opened and the page states no type, no audit period, no auditor and no end of validity. The Schwarz Digits press release of 2024-01-23 (opened) says it was issued as type 1 at that time. Which products the report covers is not separately stated.	organisation level	shared	current	https://stackit.com/en/why-stackit/benefits/certificates	not stated	not stated	2026-10-08	15
ISO 22301	TÜV Rheinland Cert GmbH certified that the requirements of ISO 22301:2019 are met by Schwarz Digits Cloud GmbH & Co. KG, certificate registration number 01 195 2500863, initial certification 2026	Holder Schwarz Digits Cloud GmbH & Co. KG, Bad Friedrichshall (not STACKIT GmbH & Co. KG). Scope as the certificate words it (German): Cloud Infrastruktur- und Plattform-Services (IaaS und PaaS) sowie Colocation in Form der Bereitstellung von Rechenzentrums- oder Rackspace. Business continuity management system of the provider; the certificate lists no products and no locations.	organisation level	provider	current	https://stackit.com/en/asset/download/61434/file/ISO22301.pdf?version=2	2026-08-28	2029-08-26	2026-10-08	15
ISO/IEC 20000-1	TÜV SÜD Management Service GmbH certified that the requirements of ISO/IEC 20000-1:2018 are met by Schwarz Digits KG, certificate registration number 12 410 60762 TMS	Holder Schwarz Digits KG, Neckarsulm. IT service management system; scope as the certificate words it (German): Betrieb der IT-Infrastruktur, Server- und Netzwerkadministration, Datenspeicherung, Rechenzentrums- sowie Colocation Services (STACKIT Colocation, Housing), mit den Rechenzentren in Deutschland und Österreich für interne und externe Kunden; sites per the annex: Neckarsulm, Ellhofen, Weinsberg (two), Heilbronn and Ostermiething (Austria).	organisation level	provider	current	https://stackit.com/en/asset/download/40661/file/240206_STACKIT_Zertifikat_ISO-20000-1_DE_ug%2520%25281%2529.pdf?version=4	2024-01-18	2027-01-17	2026-10-08	15
ISO/IEC 27001	TÜV Rheinland Cert GmbH certified that the requirements of ISO/IEC 27001:2022 are met by STACKIT GmbH & Co. KG, certificate registration number 01 153 2500863	Holder STACKIT GmbH & Co. KG, Neckarsulm. Scope as the certificate words it: cloud infrastructure and platform services (IaaS and PaaS) as well as colocation in the form of providing data center or rack space. Statement of Applicability version 22 of 2025-11-28. The certificate lists no products and no locations.	organisation level	provider	current	https://stackit.com/en/asset/download/50680/file/ISO%253AIEC%252027001_2022_EN.pdf?version=2	2026-02-09	2029-02-08	2026-10-08	15
ISO/IEC 27017	The ISO/IEC 27001:2022 certificate of STACKIT GmbH & Co. KG states a Statement of Applicability with the additional measures for ISO/IEC 27017:2015	The additional measures of ISO/IEC 27017:2015 are part of the Statement of Applicability (version 22 of 2025-11-28) of the ISO/IEC 27001:2022 certificate 01 153 2500863; the certificate is not a separate ISO/IEC 27017 certificate. The STACKIT certificates page words it as a certification according to ISO/IEC 27017.	organisation level	shared	current	https://stackit.com/en/asset/download/50680/file/ISO%253AIEC%252027001_2022_EN.pdf?version=2	2026-02-09	2029-02-08	2026-10-08	15
ISO/IEC 27018	The ISO/IEC 27001:2022 certificate of STACKIT GmbH & Co. KG states a Statement of Applicability with the additional measures for ISO/IEC 27018:2019	The additional measures of ISO/IEC 27018:2019 are part of the Statement of Applicability (version 22 of 2025-11-28) of the ISO/IEC 27001:2022 certificate 01 153 2500863; the certificate is not a separate ISO/IEC 27018 certificate. The STACKIT certificates page words it as a certification according to ISO/IEC 27018 (personal data in the cloud).	organisation level	shared	current	https://stackit.com/en/asset/download/50680/file/ISO%253AIEC%252027001_2022_EN.pdf?version=2	2026-02-09	2029-02-08	2026-10-08	15
TISAX	STACKIT states a successful TISAX assessment, Level 3, for the automotive industry	Statement on the STACKIT certificates page with assessment ID ATA163-1 and scope ID SH938N; the result is published in the ENX portal, which was not opened. The page names no assessment date, no end of validity and no products.	organisation level	shared	current	https://stackit.com/en/why-stackit/benefits/certificates	not stated	not stated	2026-10-08	15