Vamiset Trust Center

Security, compliance and sovereignty — made transparent.

Vamiset is VamiSec's solution for asset discovery and continuous compliance, with read-only connections to cloud accounts, code repositories and BambooHR. This Trust Center shows how we protect data, where we host and how we develop securely.

ISO/IEC 27001:2022 certified VamiSec GmbH ISMS · Proks Certification GmbH (DAkkS-accredited) · certificate no. DE-IS-20250191 · valid until 18 September 2028 Download certificate (PDF) ⤓

View documents security@vamisec.com

OperatorVamiSec GmbH · Bonn, Germany

HostingT Cloud Public · Germany

Report a security incidentsecurity@vamisec.com

Last updated13 October 2026

StatusLive

01 — Compliance & Certifications

Built on certified foundations.

Vamiset is operated by VamiSec GmbH, whose information security management system is certified to ISO/IEC 27001 by a DAkkS-accredited body. We transparently indicate what is certified, what is in preparation, and what is evidence of the hosting platform.

ISO/IEC 27001

VamiSec GmbH ISMS — certified by the DAkkS-accredited Proks Certification GmbH, valid until 09/2028.

Certified

ISO/IEC 42001

VamiSec AI management system being established — ISO/IEC 42001 certification in preparation.

In preparation

GDPR

Product-specific data processing agreement (DPA) under Art. 28 GDPR — on request via privacy@vamisec.com; sub-processors disclosed.

Product DPA available

BSI C5 · ISO 27001 · TISAX

Attestation, label & certificates of the operating platform T Cloud Public (Deutsche Telekom).

Hosting platform

ISO 14001

VamiSec GmbH environmental management system built per ISO 14001:2026 — certification in preparation.

In preparation

EcoVadis

Sustainability rating of VamiSec GmbH — Committed badge, awarded in October 2026.

Committed badge

02 — Hosting & Digital Sovereignty

Sovereign hosting in Germany — under European law.

In SaaS operation, Vamiset runs on Deutsche Telekom's T Cloud Public (formerly Open Telekom Cloud) — a sovereign European cloud, exclusively in German data centres. Platform data is subject to European law; the contracting party is based in Germany, German law applies and the place of jurisdiction is Germany. The asset inventory, configuration snapshots and findings reside in these data centres; Vamiset does not use any AI function today.

German data centres onlyTwin-core region Biere/Magdeburg (Saxony-Anhalt) — hosting exclusively in Germany, within the EU legal framework.

Deployment modelsSaaS on T Cloud Public; on request, also operation on your own Kubernetes cluster (on-premises).

Read-only accessVamiset connects cloud accounts (AWS, Azure, GCP), repositories (GitHub, GitLab) and BambooHR with read-only access only.

No AI function todayVamiset is a classic security tool without an AI function. We do not use customer data as training data.

T Cloud PublicDeutsche Telekom · sovereign cloud

BSI C5 Type II (ISAE 3000)
ISO/IEC 27001, 27017, 27018, 27701
SOC 1/2/3, TISAX AL 3
ISO 22301 (BCM), ISO 27001 data centres

Certificates, attestations and labels of the hosting platform (Deutsche Telekom), issued by independent auditors — not of VamiSec GmbH. Source: T Cloud Public certificates & attestations.

03 — Security Controls

How we protect — by domain.

Concrete statements instead of marketing: this section shows what applies to Vamiset today — further technical details are available on request. The measures are aligned with VamiSec's ISMS.

Data security

In SaaS operation, platform data is held exclusively in German data centres
Defined deletion and retention periods, governed by the product-specific DPA for Vamiset (on request via privacy@vamisec.com)
Encryption of data at rest and in transit (TLS)
No training on customer data — neither for our own nor for external AI models

Application security

Secure SDLC from requirements to operations (details below)
Threat modelling, code review and automated tests in CI

Access & identity

Read-only access to your systems — no write access by Vamiset
Access management is part of VamiSec GmbH's ISO/IEC 27001-certified ISMS; access to Vamiset customer data: details on request
Sign-in to Vamiset with multi-factor authentication (MFA); details of the role model on request

Infrastructure

Sovereign hosting on T Cloud Public (DE)
Operator and contracting party: VamiSec GmbH, Bonn — German law, place of jurisdiction Germany
Tenant separation and network isolation: details on request

Evidence for your audits (product feature)

Configuration snapshot per asset with every discovery run — ad hoc or scheduled (daily, weekly, monthly)
Findings with severity, owner and the failing control — tracked through to closure
Export of findings as audit evidence for your assessments

Incident management

Defined incident response process
Customer notification targeting a report within 24 hours
Responsible disclosure via security@vamisec.com · security.txt

Framework mapping

Assessment against controls from ISO 27001, SOC 2, GDPR, NIS2, PCI-DSS and HIPAA
Plus CIS Benchmarks (cloud, OS, Kubernetes) and your own policies in YAML
The mapping supports your evidence — it is not a certification or attestation of Vamiset

Organisation & governance

VamiSec GmbH ISMS certified to ISO/IEC 27001 (Proks Certification GmbH, DAkkS-accredited)
Security awareness training for all employees
Supplier and risk management processes

Business continuity

Backup and recovery concept: details on request
Hosting platform T Cloud Public with ISO 22301 (BCM) — evidence of Deutsche Telekom, not of VamiSec GmbH

04 — Secure Software Development Lifecycle

We develop as securely as we test.

At Vamiset, security is not a downstream step but anchored in every phase of development — state of the art, from requirements through to operations.

Security Requirements Engineering

Security and data-protection requirements are defined before the first line of code.

Threat Modelling

Threat modelling based on STRIDE.

Code Review

Changes are reviewed before they are merged — with a focus on security and data protection.

Automated Testing

The automated test suite runs in CI on every pull request.

Sovereign Deployment

In SaaS operation, deployed exclusively on T Cloud Public in German data centres.

Responsible Disclosure

Security researchers report vulnerabilities to security@vamisec.com — machine-readable via security.txt.

05 — Sub-processors

Disclosed — who processes which data.

We deliberately rely on a lean number of carefully selected sub-processors and disclose the purpose and processing region of each. We inform customers of changes in advance.

T Cloud Public processes the platform data exclusively in Germany. Vamiset does not use any AI function today and therefore does not involve any AI providers as sub-processors.

Sub-processor	Purpose	Region
Telekom Deutschland GmbH T Cloud Public	Cloud hosting & platform infrastructure — data centres in Biere/Magdeburg, SaaS operation only	DE

The current list of sub-processors and notifications of changes are available via privacy@vamisec.com.

06 — Documents & Evidence

VamiSec GmbH, the operator of Vamiset, runs a documented environmental management system (EMS) per ISO 14001:2026. It is integrated with our ISO/IEC 27001-certified ISMS into one management system, and our sustainability performance is additionally assessed externally by EcoVadis.

Environmental management system per ISO 14001:2026Environmental policy, registers of environmental aspects and legal obligations, measurable environmental objectives with KPIs and clearly assigned EMS responsibility.

Integrated with the ISMSThe EMS uses the processes of our ISO/IEC 27001-certified ISMS — from change and corrective-action management to a joint management review.

Certification in preparationCertification to ISO 14001 by a DAkkS-accredited body is in preparation; the audit is planned for 2027.

EcoVadis Committed – Sustainability Rating

EcoVadisSustainability rating · Committed badge 2026

In the EcoVadis sustainability rating, VamiSec GmbH was awarded the Committed badge in October 2026 — recognising continuous improvement in sustainability.

The rating and the environmental management system relate to VamiSec GmbH as a company, which develops and operates Vamiset.

08 — FAQ

Common questions from due diligence.

Where is our data stored?

In SaaS operation, we store the platform data of Vamiset exclusively in data centres in Germany; the contracting party is based in Germany, German law applies and the place of jurisdiction is Germany. We disclose the sub-processors we use, with purpose and processing region, in the sub-processor table.

Is Vamiset ISO 27001 certified?

What is certified is the information security management system of VamiSec GmbH, which operates Vamiset — not Vamiset as an individual product. The ISMS is certified to ISO/IEC 27001:2022 by the DAkkS-accredited Proks Certification GmbH (certificate DE-IS-20250191, valid until 18 September 2028). According to the certificate, the scope covers the “provision of consulting services in the field of information security, related digital products and supporting information-processing facilities …” (translated from the German original).

What access does Vamiset get to our systems?

Read-only access to connected systems. Vamiset connects cloud accounts (AWS, Azure, GCP), code repositories (GitHub, GitLab) and the BambooHR HR system with read-only access and has no write access to these systems. Vamiset scans the external attack surface with its own website scanner.

Does Vamiset use AI, and do AI providers see our data?

No. Today Vamiset is a classic security tool without an AI function, so no AI provider is involved as a sub-processor. Should AI functions be added in future, we will disclose any AI providers used in the sub-processor table in advance. We do not use customer data as training data.

How will we be informed in the event of a security incident?

We follow a defined incident response process and notify affected customers promptly — targeting an initial report within 24 hours. Security researchers can reach us via security@vamisec.com — machine-readable per RFC 9116 at /.well-known/security.txt.

Is our data used to train AI models?

No. We do not use customer data as training data: we do not train or fine-tune any AI models with it, and we only connect external AI models under contractual terms that exclude training use. Whether and which external AI providers Vamiset uses is disclosed in the sub-processor table.

How do we obtain access to confidential documents?

Public documents are available directly. For the Statement of Applicability, architecture whitepapers or completed questionnaires, a short request to security@vamisec.com is sufficient; evidence subject to an NDA is released after signing.

What personal data does Vamiset process?

Through the BambooHR integration, Vamiset processes employee data from your HR system — i.e. personal data. Information on the fields retrieved is available on request. Defined deletion and retention periods apply to the processed data; they are governed by the product-specific data processing agreement (DPA) under Art. 28 GDPR, which we provide on request: privacy@vamisec.com.

How do users authenticate, and how are stored credentials protected?

Sign-in to Vamiset is protected by multi-factor authentication (MFA). Vamiset stores data at rest in encrypted form, and data in transit is encrypted with TLS. We describe further technical details — such as the role model and the protection of the stored read-only credentials (secrets management) — on request: security@vamisec.com. Deletion and retention periods are governed by the product-specific DPA.

Still have questions?

Talk to our team.

We answer your security and compliance questions and provide the evidence your procurement needs.

Book a call security@vamisec.com