BSI C5: which cloud and SaaS vendors say they have an attestation

20 of the 148 vendors whose certification pages we read list BSI C5. Here is what each one states: the standard as it writes it, the scope, whether a certificate or report can be seen, and where and when we read it. Last read on 2026-11-09. The BSI keeps no list of C5 attestations, so this is a list of what the vendors say.

Vendor by vendor

"Report published": the vendor links the report itself. "Report on request": the vendor offers the certificate or audit report to customers or under NDA, usually through its trust centre. "Stated": the vendor names the standard and links nothing behind it. "Type" and edition are given only where the vendor writes them.

What BSI C5 is

C5, the Cloud Computing Compliance Criteria Catalogue, is a set of security criteria for cloud services published by Germany's Federal Office for Information Security (BSI). Its first version is from 2016; the edition in use is C5:2020. An independent auditor examines a cloud provider against it under the ISAE 3000 assurance standard, or its German equivalent IDW PS 860, and issues an attestation report (in German, a Testat), not a certificate. (BSI)

A Type 1 report says the provider's controls were suitably designed on a given date. A Type 2 report says, in addition, that they operated effectively over a period, and the BSI considers Type 2 necessary for the report to carry adequate weight. The BSI has published a new edition, C5:2026, which applies to attestations whose date or period begins on or after 1 June 2027.

There is no official list

The BSI does not register C5 attestations. Its C5 FAQ says that it keeps no list of C5 attestations ("führt es keine Liste von C5-Testaten"): the audits are carried out by independent auditors, and the BSI does not oversee them. So a vendor's own statement, and the report it gives its customers, is all there is to go on. That is the difference from France's SecNumCloud and Spain's ENS, whose authorities publish a register; both are on the certifications page.

Type 1 or Type 2, and which edition

3 of the 20 vendors name a Type 2 report (DeepL, STACKIT, T Cloud Public), and 1 a Type 1 report (IONOS Cloud). The other 16 list C5 without saying which. 2 name the C5:2020 edition (IONOS Cloud, Cloudflare); the rest do not name one. A buyer who needs Type 2, or a particular edition, has to ask for the report.

Vendors whose list does not include it

We read the certification pages of these 128 vendors and found no mention of BSI C5. That is what their pages say, not proof that no certificate exists: 1Password, 3DS Outscale, ActiveCampaign, Adyen, Aircall, Airtable, Amazon Web Services, Amplitude, Anthropic, Apollo.io, Asana, Attio, Backblaze, Bitwarden, Bleu, Brevo, Calendly, Canva, Cisco Webex, Clay, ClickHouse, ClickUp, Contentsquare, Cursor, DATEV, Datadog, Deepgram, Delos Cloud, DigitalOcean, Docker, Docusign, Doodle, Drata, Dropbox, Elastic Cloud, Element, ElevenLabs, Eventbrite, Freshworks, GitHub, GitLab, Gong, Google Analytics, Google Cloud, Grafana Labs, Grammarly, Granola, Hetzner, Hostinger, HubSpot, Infomaniak, Intercom, JetBrains, Jotform, Kahoot!, Klaviyo, KnowBe4, Langdock, Lovable, Lusha, Mailchimp, Mailgun, Make, Mapbox, Mentimeter, Miro, Mistral AI, Mixpanel, Mollie, MongoDB, Mural, Netlify, New Relic, Nextcloud, OneTrust, OpenAI, OpenRouter, Optimizely, PayPal, Pennylane, Perplexity, Personio, Pipedrive, Piwik PRO, Pleo, PostHog, Proton, Qualtrics, Retool, Rippling, S3NS, STRATO, Scaleway, Sentry, Shopify, Sinch, Smartsheet, Snowflake, Spendesk, Squarespace, Stripe, Supabase, SurveyMonkey, TeamViewer, Tresorit, Twilio, Typeform, Usercentrics, Vanta, Vercel, Vimeo, Vonage, WeTransfer, Webflow, WhatsApp Business, Wire, Wix, Workday, Xero, Zapier, Zendesk, Zoho, ZoomInfo, Zscaler, iubenda, monday.com, n8n, netcup.

Questions

Which cloud and SaaS vendors have a C5 attestation?

Of the 148 vendors whose certification pages this registry reads, 20 list BSI C5: Atlassian, Box, DeepL, IONOS Cloud, Notion, Slack, STACKIT, Adobe, AWS European Sovereign Cloud, Cloudflare, CrowdStrike, Databricks, Figma, Google Workspace, Microsoft, Okta, Oracle Cloud, OVHcloud, T Cloud Public, Zoom. 0 publish the attestation report, 7 provide the audit report or certificate on request, and 13 state it without a public document.

Is there an official list of C5 attested cloud providers?

No. The BSI writes in its C5 FAQ that it keeps no list of C5 attestations. It does not oversee the audits, which an independent auditor carries out. A list like the one on this page can only be built from what providers say on their own pages; 20 of the 148 vendors we read say they have one.

What is the difference between C5 Type 1 and Type 2?

A Type 1 report covers the design of the controls on a given date; a Type 2 report also covers whether they operated effectively over a period, and the BSI considers Type 2 necessary for the report to carry adequate weight. Of the 20 vendors here, 3 name Type 2 in their listing (DeepL, STACKIT, T Cloud Public), 1 names Type 1 (IONOS Cloud), and 16 do not say.

How can I check a vendor's C5 claim?

Ask the vendor for the attestation report itself. Check who the auditor is, whether it is Type 1 or Type 2 and for which date or period, which edition of C5 it was audited against, and which services and locations are in scope. The BSI does not register attestations, so there is no list to look the vendor up in.

Download the data (CSV): every row with its source and the date it was read.Cite as: eucsoft, “BSI C5: what SaaS vendors state”, https://eucsoft.com/en/certifications/bsi-c5/, data read up to 2026-11-09.

How this was read

Each week the registry reads every vendor's certification or trust centre page and records each standard it lists, quoted as written, with the scope and any validity date it gives. A listing that changes waits for a person's review before it reaches this page. Other standards: ISO/IEC 42001, ISO/IEC 27701, ISO/IEC 27017, ISO/IEC 27018, TISAX, SOC 2;SecNumCloud, from ANSSI's list; the other national cloud schemes (ENS, HDS) are on the certifications page. Full method on the methodology page.