# Compliance evidence of the provider

> FOR REVIEW — generated by StackToIT Assess. Architect review required before any decision.

Run `6f8f72b2-1c34-4cfc-8483-344c41245364` · source digest `sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000`

Provider evidence describes the provider's own controls and attestations. It is not a statement about the workload and does not make a workload compliant with any framework; the customer's own controls and an external review decide that.

Evidence judged as of 2026-11-07; a row is vouched for for 90 days after it was verified. Read from: STACKIT certificates and attestations by service (the certificates page stackit.com/en/why-stackit/benefits/certificates and the documents it links; each row names its document); STACKIT certificates and attestations of the provider organisation and its facilities (the certificates page stackit.com/en/why-stackit/benefits/certificates and the documents it links; each row names its document).

Frameworks in scope: BSI C5, GDPR, ISAE 3000 (SOC 2), ISAE 3402, ISO 22301, ISO/IEC 20000-1, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, TISAX. Services of the draft: STACKIT Object Storage, STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, STACKIT PostgreSQL Flex, STACKIT RabbitMQ, STACKIT Secrets Manager, STACKIT service account.

| Service | Framework | State | Reason |
|---|---|---|---|
| STACKIT Object Storage | BSI C5 | CUSTOMER CONTROL REQUIRED | the evidence covers the provider's side at most; the customer's own controls for this framework are still required and are not assessed here |
| STACKIT Object Storage | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document |
| STACKIT Object Storage | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document |
| STACKIT Object Storage | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document |
| STACKIT Object Storage | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document |
| STACKIT Object Storage | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document |
| STACKIT Object Storage | ISO/IEC 27001 | PROVIDER EVIDENCE PRESENT | current evidence about the provider's own controls is present; nothing is concluded about the workload |
| STACKIT Object Storage | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document |
| STACKIT Object Storage | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document |
| STACKIT Object Storage | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document |
| STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain | BSI C5 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for BSI C5; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document |
| STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document |
| STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document |
| STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document |
| STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document |
| STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document |
| STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document |
| STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document |
| STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document |
| STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document |
| STACKIT PostgreSQL Flex | BSI C5 | CUSTOMER CONTROL REQUIRED | the evidence covers the provider's side at most; the customer's own controls for this framework are still required and are not assessed here |
| STACKIT PostgreSQL Flex | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document |
| STACKIT PostgreSQL Flex | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document |
| STACKIT PostgreSQL Flex | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document |
| STACKIT PostgreSQL Flex | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document |
| STACKIT PostgreSQL Flex | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document |
| STACKIT PostgreSQL Flex | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document |
| STACKIT PostgreSQL Flex | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document |
| STACKIT PostgreSQL Flex | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document |
| STACKIT PostgreSQL Flex | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | BSI C5 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for BSI C5; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT RabbitMQ | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document |
| STACKIT Secrets Manager | BSI C5 | CUSTOMER CONTROL REQUIRED | the evidence covers the provider's side at most; the customer's own controls for this framework are still required and are not assessed here |
| STACKIT Secrets Manager | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document |
| STACKIT Secrets Manager | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document |
| STACKIT Secrets Manager | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document |
| STACKIT Secrets Manager | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document |
| STACKIT Secrets Manager | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document |
| STACKIT Secrets Manager | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document |
| STACKIT Secrets Manager | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document |
| STACKIT Secrets Manager | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document |
| STACKIT Secrets Manager | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document |
| STACKIT service account | BSI C5 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for BSI C5; its document does not name STACKIT service account, so whether it covers this service has to be read from the document |
| STACKIT service account | GDPR | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for GDPR; its document does not name STACKIT service account, so whether it covers this service has to be read from the document |
| STACKIT service account | ISAE 3000 (SOC 2) | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT service account, so whether it covers this service has to be read from the document |
| STACKIT service account | ISAE 3402 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT service account, so whether it covers this service has to be read from the document |
| STACKIT service account | ISO 22301 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO 22301; its document does not name STACKIT service account, so whether it covers this service has to be read from the document |
| STACKIT service account | ISO/IEC 20000-1 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT service account, so whether it covers this service has to be read from the document |
| STACKIT service account | ISO/IEC 27001 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT service account, so whether it covers this service has to be read from the document |
| STACKIT service account | ISO/IEC 27017 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT service account, so whether it covers this service has to be read from the document |
| STACKIT service account | ISO/IEC 27018 | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT service account, so whether it covers this service has to be read from the document |
| STACKIT service account | TISAX | EXTERNAL REVIEW REQUIRED | only organisation-level evidence exists for TISAX; its document does not name STACKIT service account, so whether it covers this service has to be read from the document |

Targets of the draft that are not a STACKIT product by name, so no pair is evaluated for them: Kubernetes Job/CronJob on SKE, SKE workload (or Cloud Foundry Docker app), a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD.

## Evidence rows

| Framework | Service | Claim | Control | Status | Document | Verified at |
|---|---|---|---|---|---|---|
| BSI C5 | organisation | STACKIT states that its infrastructure is certified according to C5 Type 2 of the BSI | SHARED | CURRENT | https://stackit.com/en/why-stackit/benefits/certificates | 2026-10-08 |
| BSI C5 | STACKIT Object Storage | STACKIT states that its infrastructure is certified according to C5 Type 2 and that the report covers this product and all basic and additional criteria | SHARED | CURRENT | https://stackit.com/en/why-stackit/benefits/certificates | 2026-10-08 |
| BSI C5 | STACKIT PostgreSQL Flex | STACKIT states that its infrastructure is certified according to C5 Type 2 and that the report covers this product and all basic and additional criteria | SHARED | CURRENT | https://stackit.com/en/why-stackit/benefits/certificates | 2026-10-08 |
| BSI C5 | STACKIT Secrets Manager | STACKIT states that its infrastructure is certified according to C5 Type 2 and that the report covers this product and all basic and additional criteria | SHARED | CURRENT | https://stackit.com/en/why-stackit/benefits/certificates | 2026-10-08 |
| GDPR | organisation | STACKIT states that the development of its cloud takes place in Germany, that its servers and data centers are located in Germany and Austria, and that its cloud operates in accordance with European data protection standards | SHARED | CURRENT | https://stackit.com/en/why-stackit/benefits/certificates | 2026-10-08 |
| ISAE 3000 (SOC 2) | organisation | STACKIT states that its infrastructure holds an ISAE 3000 (SOC 2) certification in addition to C5 | SHARED | CURRENT | https://stackit.com/en/why-stackit/benefits/certificates | 2026-10-08 |
| ISAE 3402 | organisation | STACKIT states that its infrastructure holds an ISAE 3402 certificate in addition to C5 | SHARED | CURRENT | https://stackit.com/en/why-stackit/benefits/certificates | 2026-10-08 |
| ISO 22301 | organisation | TÜV Rheinland Cert GmbH certified that the requirements of ISO 22301:2019 are met by Schwarz Digits Cloud GmbH & Co. KG, certificate registration number 01 195 2500863, initial certification 2026 | PROVIDER | CURRENT | https://stackit.com/en/asset/download/61434/file/ISO22301.pdf?version=2 | 2026-10-08 |
| ISO/IEC 20000-1 | organisation | TÜV SÜD Management Service GmbH certified that the requirements of ISO/IEC 20000-1:2018 are met by Schwarz Digits KG, certificate registration number 12 410 60762 TMS | PROVIDER | CURRENT | https://stackit.com/en/asset/download/40661/file/240206_STACKIT_Zertifikat_ISO-20000-1_DE_ug%2520%25281%2529.pdf?version=4 | 2026-10-08 |
| ISO/IEC 27001 | organisation | TÜV Rheinland Cert GmbH certified that the requirements of ISO/IEC 27001:2022 are met by STACKIT GmbH & Co. KG, certificate registration number 01 153 2500863 | PROVIDER | CURRENT | https://stackit.com/en/asset/download/50680/file/ISO%253AIEC%252027001_2022_EN.pdf?version=2 | 2026-10-08 |
| ISO/IEC 27001 | STACKIT Object Storage | The Federal Office for Information Security (BSI) issued certificate BSI-IGZ-0691-2025, an ISO 27001 certificate on the basis of IT-Grundschutz, for the provision and operation of the STACKIT IaaS cloud services of STACKIT GmbH & Co. KG | PROVIDER | CURRENT | https://stackit.com/en/asset/download/41727/file/BSI-IGZ-0691-2025-STACKIT-05-2025.pdf?version=2 | 2026-10-08 |
| ISO/IEC 27017 | organisation | The ISO/IEC 27001:2022 certificate of STACKIT GmbH & Co. KG states a Statement of Applicability with the additional measures for ISO/IEC 27017:2015 | SHARED | CURRENT | https://stackit.com/en/asset/download/50680/file/ISO%253AIEC%252027001_2022_EN.pdf?version=2 | 2026-10-08 |
| ISO/IEC 27018 | organisation | The ISO/IEC 27001:2022 certificate of STACKIT GmbH & Co. KG states a Statement of Applicability with the additional measures for ISO/IEC 27018:2019 | SHARED | CURRENT | https://stackit.com/en/asset/download/50680/file/ISO%253AIEC%252027001_2022_EN.pdf?version=2 | 2026-10-08 |
| TISAX | organisation | STACKIT states a successful TISAX assessment, Level 3, for the automotive industry | SHARED | CURRENT | https://stackit.com/en/why-stackit/benefits/certificates | 2026-10-08 |