StackToIT Migration Intelligence Workspace

Executive lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Architect lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Platform lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Security lens: the sections are in the order this reader usually wants, and Costs and Migration Plan are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Application owner lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Programme lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

FinOps lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Engineering lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Security & Resilience

What has been proven about security and resilience, what has not, and what needs evidence from outside; the resilience of each unit, where this run assesses it, is on the Operations page.

Assurance Center

Across the 4 intents this run records, 5 items wait for a decision, 5 need evidence that the scan does not hold and 7 are not assessed in this build. These are counts of open items, not a measure of progress: a count of zero says that nothing is open in that intent, not that the intent is settled.

Open items per intent (an item is a unit, a workload or a dimension; an intent with no item is counted by its own state)
Intent	Item	Decision required	Evidence required	Not assessed
Data movement	stateful unit	2	0	0
Resilience	unit that holds state or states a zone, replication or backup fact	0	2	0
Identity transition	workload	2	0	0
Sovereignty	dimension	1	3	7

What was read, and what was not

A static reading of the source Terraform, and nothing set outside it

What was read: the access model the source Terraform states (security groups, rules, network ACLs, routes, listeners it manages). That is a static reading of the source, and it is the only claim this report makes about access.

What was not read: anything set outside this Terraform — console changes, firewall policies set above the project (organization or folder), the implied rules of a VPC network, routing not in the source, imported networks. That the target is equivalent to the access model of the real Google Cloud environment needs Google Cloud inventory evidence or your confirmation, and StackToIT has neither. Where a disposition rests on such an assumption it says so (ASSUMPTION) and is not PRESERVED.

No disposition of this run rests on an assumption about a resource outside the source.

Provider evidence describes the provider's own controls and attestations. It is not a statement about the workload and does not make a workload compliant with any framework; the customer's own controls and an external review decide that.

Evidence freshness and the frameworks shown

Evidence as of 2026-11-07. A document that was last opened more than 90 days earlier, or whose validity has ended, no longer counts. No framework was asked about, because the input has no field for it; the frameworks shown are those the provider evidence has rows for. Frameworks shown: BSI C5, GDPR, ISAE 3000 (SOC 2), ISAE 3402, ISO 22301, ISO/IEC 20000-1, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, TISAX.

Provider assurance evidence per STACKIT service and framework: 6 services, 10 frameworks

Provider assurance evidence per STACKIT service of the draft and per framework (6 services, 10 frameworks). A state describes what the provider's documents show about the provider's own controls; it says nothing about a workload.
STACKIT service	BSI C5	GDPR	ISAE 3000 (SOC 2)	ISAE 3402	ISO 22301	ISO/IEC 20000-1	ISO/IEC 27001	ISO/IEC 27017	ISO/IEC 27018	TISAX
STACKIT Object Storage	Customer control required	External review required	External review required	External review required	External review required	External review required	Provider evidence present	External review required	External review required	External review required
STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required
STACKIT PostgreSQL Flex	Customer control required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required
STACKIT RabbitMQ	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required
STACKIT Secrets Manager	Customer control required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required
STACKIT service account	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required	External review required

Provider evidence present: a current document describes the provider's own controls for this service. Nothing is concluded about the workload.
Customer control required: a control is shared with, or carried by, the customer; this build does not assess it.
External review required: no current document names this service for this framework (not found is not the same as not certified); somebody has to read the provider's documents.

Why each pair has its state

STACKIT Object Storage

BSI C5 — Customer control required. the evidence covers the provider's side at most; the customer's own controls for this framework are still required and are not assessed here. The provider has evidence for its own side.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document.
ISO/IEC 27001 — Provider evidence present. current evidence about the provider's own controls is present; nothing is concluded about the workload. The provider has evidence for its own side.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT Object Storage, so whether it covers this service has to be read from the document.

STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain

BSI C5 — External review required. only organisation-level evidence exists for BSI C5; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain, so whether it covers this service has to be read from the document.

STACKIT PostgreSQL Flex

BSI C5 — Customer control required. the evidence covers the provider's side at most; the customer's own controls for this framework are still required and are not assessed here. The provider has evidence for its own side.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT PostgreSQL Flex, so whether it covers this service has to be read from the document.

STACKIT RabbitMQ

BSI C5 — External review required. only organisation-level evidence exists for BSI C5; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT RabbitMQ, so whether it covers this service has to be read from the document.

STACKIT Secrets Manager

BSI C5 — Customer control required. the evidence covers the provider's side at most; the customer's own controls for this framework are still required and are not assessed here. The provider has evidence for its own side.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT Secrets Manager, so whether it covers this service has to be read from the document.

STACKIT service account

BSI C5 — External review required. only organisation-level evidence exists for BSI C5; its document does not name STACKIT service account, so whether it covers this service has to be read from the document.
GDPR — External review required. only organisation-level evidence exists for GDPR; its document does not name STACKIT service account, so whether it covers this service has to be read from the document.
ISAE 3000 (SOC 2) — External review required. only organisation-level evidence exists for ISAE 3000 (SOC 2); its document does not name STACKIT service account, so whether it covers this service has to be read from the document.
ISAE 3402 — External review required. only organisation-level evidence exists for ISAE 3402; its document does not name STACKIT service account, so whether it covers this service has to be read from the document.
ISO 22301 — External review required. only organisation-level evidence exists for ISO 22301; its document does not name STACKIT service account, so whether it covers this service has to be read from the document.
ISO/IEC 20000-1 — External review required. only organisation-level evidence exists for ISO/IEC 20000-1; its document does not name STACKIT service account, so whether it covers this service has to be read from the document.
ISO/IEC 27001 — External review required. only organisation-level evidence exists for ISO/IEC 27001; its document does not name STACKIT service account, so whether it covers this service has to be read from the document.
ISO/IEC 27017 — External review required. only organisation-level evidence exists for ISO/IEC 27017; its document does not name STACKIT service account, so whether it covers this service has to be read from the document.
ISO/IEC 27018 — External review required. only organisation-level evidence exists for ISO/IEC 27018; its document does not name STACKIT service account, so whether it covers this service has to be read from the document.
TISAX — External review required. only organisation-level evidence exists for TISAX; its document does not name STACKIT service account, so whether it covers this service has to be read from the document.

The provider documents behind these states: 14 documents, each listed once

The provider documents behind these states (each listed once; a document at organisation level bears on every service)
Framework	Claim	Scope	Service	Control carried by	Row status	Document	Document date	Valid until	Opened	Pairs
BSI C5	STACKIT states that its infrastructure is certified according to C5 Type 2 of the BSI	Statement on the STACKIT certificates page: the report covers the products listed there (the certificates page of STACKIT, stackit.com/en/why-stackit/benefits/certificates) and all basic and additional criteria. The attestation report was not opened. The STACKIT C5 page says a C5 certificate is valid for one year as a rule; no page opened names a date for STACKIT's own attestation, an auditor or an audit period. Press release of 2024-08-21 (opened): C5 Type 1 for the infrastructure stack at the end of 2023, type 2 effectiveness audit confirmed in 2024, appropriateness tested for STACKIT IaaS (Compute Engine, Network & Security, Block Storage, Object Storage).	organisation level	shared	current	https://stackit.com/en/why-stackit/benefits/certificates	not stated	not stated	2026-10-08	3
BSI C5	STACKIT states that its infrastructure is certified according to C5 Type 2 and that the report covers this product and all basic and additional criteria	Product listed under "C5 certified cloud products" on the STACKIT certificates page; C5 Type 2 as that page states it. The attestation report itself was not opened. The page names no audit period, no auditor, no region and no end of validity.	STACKIT Object Storage	shared	current	https://stackit.com/en/why-stackit/benefits/certificates	not stated	not stated	2026-10-08	1
BSI C5	STACKIT states that its infrastructure is certified according to C5 Type 2 and that the report covers this product and all basic and additional criteria	Product listed under "C5 certified cloud products" on the STACKIT certificates page; C5 Type 2 as that page states it. The attestation report itself was not opened. The page names no audit period, no auditor, no region and no end of validity.	STACKIT PostgreSQL Flex	shared	current	https://stackit.com/en/why-stackit/benefits/certificates	not stated	not stated	2026-10-08	1
BSI C5	STACKIT states that its infrastructure is certified according to C5 Type 2 and that the report covers this product and all basic and additional criteria	Product listed under "C5 certified cloud products" on the STACKIT certificates page; C5 Type 2 as that page states it. The attestation report itself was not opened. The page names no audit period, no auditor, no region and no end of validity.	STACKIT Secrets Manager	shared	current	https://stackit.com/en/why-stackit/benefits/certificates	not stated	not stated	2026-10-08	1
GDPR	STACKIT states that the development of its cloud takes place in Germany, that its servers and data centers are located in Germany and Austria, and that its cloud operates in accordance with European data protection standards	Statement on the STACKIT certificates page (provider-side text, not an attestation or a certificate). It is a statement about where and how the provider operates; the customer's own obligations toward personal data stay with the customer. The page names no region id and no attestation document.	organisation level	shared	current	https://stackit.com/en/why-stackit/benefits/certificates	not stated	not stated	2026-10-08	6
ISAE 3000 (SOC 2)	STACKIT states that its infrastructure holds an ISAE 3000 (SOC 2) certification in addition to C5	Statement on the STACKIT certificates page. The report was not opened and the page states no type, no audit period, no auditor and no end of validity. The Schwarz Digits press release of 2024-01-23 (opened) says ISAE 3000 (SOC 2) and ISAE 3402 were issued as type 1 at that time; whether a type 2 exists now is not stated on any page opened. Which products the report covers is not separately stated.	organisation level	shared	current	https://stackit.com/en/why-stackit/benefits/certificates	not stated	not stated	2026-10-08	6
ISAE 3402	STACKIT states that its infrastructure holds an ISAE 3402 certificate in addition to C5	Statement on the STACKIT certificates page. The report was not opened and the page states no type, no audit period, no auditor and no end of validity. The Schwarz Digits press release of 2024-01-23 (opened) says it was issued as type 1 at that time. Which products the report covers is not separately stated.	organisation level	shared	current	https://stackit.com/en/why-stackit/benefits/certificates	not stated	not stated	2026-10-08	6
ISO 22301	TÜV Rheinland Cert GmbH certified that the requirements of ISO 22301:2019 are met by Schwarz Digits Cloud GmbH & Co. KG, certificate registration number 01 195 2500863, initial certification 2026	Holder Schwarz Digits Cloud GmbH & Co. KG, Bad Friedrichshall (not STACKIT GmbH & Co. KG). Scope as the certificate words it (German): Cloud Infrastruktur- und Plattform-Services (IaaS und PaaS) sowie Colocation in Form der Bereitstellung von Rechenzentrums- oder Rackspace. Business continuity management system of the provider; the certificate lists no products and no locations.	organisation level	provider	current	https://stackit.com/en/asset/download/61434/file/ISO22301.pdf?version=2	2026-08-28	2029-08-26	2026-10-08	6
ISO/IEC 20000-1	TÜV SÜD Management Service GmbH certified that the requirements of ISO/IEC 20000-1:2018 are met by Schwarz Digits KG, certificate registration number 12 410 60762 TMS	Holder Schwarz Digits KG, Neckarsulm. IT service management system; scope as the certificate words it (German): Betrieb der IT-Infrastruktur, Server- und Netzwerkadministration, Datenspeicherung, Rechenzentrums- sowie Colocation Services (STACKIT Colocation, Housing), mit den Rechenzentren in Deutschland und Österreich für interne und externe Kunden; sites per the annex: Neckarsulm, Ellhofen, Weinsberg (two), Heilbronn and Ostermiething (Austria).	organisation level	provider	current	https://stackit.com/en/asset/download/40661/file/240206_STACKIT_Zertifikat_ISO-20000-1_DE_ug%2520%25281%2529.pdf?version=4	2024-01-18	2027-01-17	2026-10-08	6
ISO/IEC 27001	TÜV Rheinland Cert GmbH certified that the requirements of ISO/IEC 27001:2022 are met by STACKIT GmbH & Co. KG, certificate registration number 01 153 2500863	Holder STACKIT GmbH & Co. KG, Neckarsulm. Scope as the certificate words it: cloud infrastructure and platform services (IaaS and PaaS) as well as colocation in the form of providing data center or rack space. Statement of Applicability version 22 of 2025-11-28. The certificate lists no products and no locations.	organisation level	provider	current	https://stackit.com/en/asset/download/50680/file/ISO%253AIEC%252027001_2022_EN.pdf?version=2	2026-02-09	2029-02-08	2026-10-08	5
ISO/IEC 27001	The Federal Office for Information Security (BSI) issued certificate BSI-IGZ-0691-2025, an ISO 27001 certificate on the basis of IT-Grundschutz, for the provision and operation of the STACKIT IaaS cloud services of STACKIT GmbH & Co. KG	The certificate names the IaaS and PaaS cloud services STACKIT Compute Engine, STACKIT Network & Security, STACKIT Block Storage and STACKIT Objekt Storage (S3) and all processes, applications, systems, networks and locations of STACKIT GmbH & Co. KG necessary for them; this product is STACKIT Objekt Storage (S3) in the certificate. It is valid only for that object and together with the full certification report (not opened), under the condition that the annual surveillance audits from 2025-04-30 are completed with a positive result. The certificate states that it is no general recommendation of the object by the BSI and contains no warranty. It names no region.	STACKIT Object Storage	provider	current	https://stackit.com/en/asset/download/41727/file/BSI-IGZ-0691-2025-STACKIT-05-2025.pdf?version=2	2025-04-30	2028-04-29	2026-10-08	1
ISO/IEC 27017	The ISO/IEC 27001:2022 certificate of STACKIT GmbH & Co. KG states a Statement of Applicability with the additional measures for ISO/IEC 27017:2015	The additional measures of ISO/IEC 27017:2015 are part of the Statement of Applicability (version 22 of 2025-11-28) of the ISO/IEC 27001:2022 certificate 01 153 2500863; the certificate is not a separate ISO/IEC 27017 certificate. The STACKIT certificates page words it as a certification according to ISO/IEC 27017.	organisation level	shared	current	https://stackit.com/en/asset/download/50680/file/ISO%253AIEC%252027001_2022_EN.pdf?version=2	2026-02-09	2029-02-08	2026-10-08	6
ISO/IEC 27018	The ISO/IEC 27001:2022 certificate of STACKIT GmbH & Co. KG states a Statement of Applicability with the additional measures for ISO/IEC 27018:2019	The additional measures of ISO/IEC 27018:2019 are part of the Statement of Applicability (version 22 of 2025-11-28) of the ISO/IEC 27001:2022 certificate 01 153 2500863; the certificate is not a separate ISO/IEC 27018 certificate. The STACKIT certificates page words it as a certification according to ISO/IEC 27018 (personal data in the cloud).	organisation level	shared	current	https://stackit.com/en/asset/download/50680/file/ISO%253AIEC%252027001_2022_EN.pdf?version=2	2026-02-09	2029-02-08	2026-10-08	6
TISAX	STACKIT states a successful TISAX assessment, Level 3, for the automotive industry	Statement on the STACKIT certificates page with assessment ID ATA163-1 and scope ID SH938N; the result is published in the ENX portal, which was not opened. The page names no assessment date, no end of validity and no products.	organisation level	shared	current	https://stackit.com/en/why-stackit/benefits/certificates	not stated	not stated	2026-10-08	6

Targets that are not a STACKIT product by name (an alternative that runs on a STACKIT service, an implicit target) have no evidence row of their own and no pair is evaluated for them: Kubernetes Job/CronJob on SKE, SKE workload (or Cloud Foundry Docker app), a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD.