SAP
Erp · sap.com · last read 2026-10-12
Identity
No identity observation recorded yet.
Data location
No data-location observation recorded yet.
Subprocessor chain
Processing terms
No data processing agreement read yet.
Assurance
No certification claims transcribed yet.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| ACN qualified cloud (Italy) | SAP Ariba · SAP SE | qualified | QC1 (SaaS) | 2028-06-16 | 2026-10-09 |
| ACN qualified cloud (Italy) | SAP Business Technology Platform · SAP SE | qualified | QC1 (PaaS) | 2028-06-16 | 2026-10-09 |
| ACN qualified cloud (Italy) | SAP Concur · SAP SE | qualified | QC1 (SaaS) | 2029-03-18 | 2026-10-09 |
| ACN qualified cloud (Italy) | SAP Customer Experience · SAP SE | qualified | QC1 (SaaS) | 2028-02-12 | 2026-10-09 |
| ACN qualified cloud (Italy) | SAP Fieldglass · SAP SE | qualified | QC1 (SaaS) | 2028-02-12 | 2026-10-09 |
| ACN qualified cloud (Italy) | SAP S/4HANA Cloud Public Edition on Azure · SAP SE | qualified | QC1 (SaaS) | 2029-01-05 | 2026-10-09 |
| ACN qualified cloud (Italy) | SAP S/4HANA Cloud, Private Edition on AWS · SAP SE | qualified | QC1 (SaaS) | 2028-06-16 | 2026-10-09 |
| ACN qualified cloud (Italy) | SAP S/4HANA Cloud, Private Edition on Azure · SAP SE | qualified | QC1 (SaaS) | 2028-06-16 | 2026-10-09 |
| ACN qualified cloud (Italy) | SAP S/4HANA Cloud, Private Edition on GCP · SAP SE | qualified | QC1 (SaaS) | 2028-06-16 | 2026-10-09 |
| ACN qualified cloud (Italy) | SAP Signavio · SAP SE | qualified | QC1 (SaaS) | 2028-06-16 | 2026-10-09 |
| ACN qualified cloud (Italy) | SAP SuccessFactors · SAP SE | qualified | QC1 (SaaS) | 2028-02-12 | 2026-10-09 |
| ACN qualified cloud (Italy) | SAP Walkme · SAP SE | qualified | QC1 (SaaS) | 2029-01-05 | 2026-10-09 |
| DORA critical ICT third-party providers (ESAs) | Critical ICT third-party service provider (DORA Art. 31) · SAP SE | designated | — | — | 2026-10-09 |
| EU Cloud Code of Conduct (GDPR Art. 40) | SAP Ariba (sap.com) · SAP Ariba | adherent | Level 2 | 2026-09-04 | 2026-10-09 |
| EU Cloud Code of Conduct (GDPR Art. 40) | SAP Business Network (sap.com) · SAP Business Network | adherent | Level 2 | 2026-09-04 | 2026-10-09 |
| EU Cloud Code of Conduct (GDPR Art. 40) | SAP Central Cloud Services (sap.com) · SAP Central Cloud Services | adherent | Level 2 | 2027-06-25 | 2026-10-09 |
| EU Cloud Code of Conduct (GDPR Art. 40) | SAP Customer Experience (sap.com) · SAP Customer Experience | adherent | Level 2 | 2026-12-27 | 2026-10-09 |
| EU Cloud Code of Conduct (GDPR Art. 40) | SAP Enterprise Management (sap.com) · SAP Enterprise Management | adherent | Level 2 | 2027-03-04 | 2026-10-09 |
| EU Cloud Code of Conduct (GDPR Art. 40) | SAP Sales Performance Management (sap.com) · SAP Sales Performance Management | adherent | Level 2 | 2027-04-29 | 2026-10-09 |
| EU Cloud Code of Conduct (GDPR Art. 40) | SAP SuccessFactors (sap.com) · SAP SuccessFactors | adherent | Level 2 | 2027-08-12 | 2026-10-09 |
| FedRAMP Marketplace (US) | DoD Cloud Intelligent Enterprise – DD-CIE · SAP National Security Services Inc. (SAP NS2) | FedRAMP Authorized | Moderate | — | 2026-10-09 |
| FedRAMP Marketplace (US) | SAP NS2 Cloud Intelligent Enterprise · SAP National Security Services Inc. (SAP NS2) | FedRAMP Authorized | Moderate | — | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, 12 entries under SAP
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, 1 entry under SAP
- Data Privacy Framework List (US): checked 2026-10-12, no entry under SAP
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, 7 entries under SAP
- FedRAMP Marketplace (US): checked 2026-10-12, 2 entries under SAP
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under SAP
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: not read: the vendor's robots.txt disallows the path (read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Refused | partial | — | 2026-10-09 |
| identity | Refused | partial | — | 2026-10-09 |
| residency | Refused | partial | — | 2026-10-09 |
History
Nothing has moved since we started watching this vendor on 2026-10-09. Changes appear here only after a human has reviewed them.