eucsoft

STACKIT

Cloud infrastructure · stackit.com · last read 2026-10-12

Identity

Legal entitySchwarz Digits Cloud GmbH & Co. KG
HQDE
Parent company—
Ultimate ownership—
EU contracting entity—
LEI5299000VW89CGMWMEI16
US CLOUD Act reachNot determined from the sources read
Sourcestackit.com · 2026-10-08

Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.

Data location

RegionEU data locationMinimum planSourceObserved
EUEU by default—docs.stackit.cloud2026-10-08

EU: STACKIT hosts all regions exclusively in Germany (eu01) and Austria (eu02), so data stays in the EU without the customer choosing it.

Subprocessor chain

No subprocessor list transcribed. Either the vendor does not publish one where we could reach it, or it is gated — see the documents table below for which.

Processing terms

From the vendor's data processing agreement · read 2026-10-09 · stackit.com

TermWhat the agreement says
Transfer mechanismSCC module 3
Notice of new subprocessorsBy e-mail, about intended changes to other processors; notice period not stated
If you object to oneCustomer may object case by case only for good reason that it demonstrates, in text form by e-mail to [email protected], within 14 days of notification. If it objects, Contractor may terminate the Main Agreement and this Agreement on four weeks' notice
Breach notificationwithout undue delay
AuditAudits including on-site inspections of premises during normal business hours, at customer's own cost, with notice in good time (usually at least two weeks); one audit per calendar year, additional audits only by agreement and subject to reimbursement; independent third-party auditors permitted, subject to contractor objection if unsuitable
AuditInstead of an audit, the Contractor may choose to provide a current attestation or report from an independent entity, or a certification (e.g., ISO 27001, BSI IT-Grundschutz); Contractor is told in advance of any third-party auditor and may object to unsuitable ones

Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.

Assurance

SchemeStatusScopeSourceObserved
C5 Type 2 · C5Available on requestThe STACKIT infrastructure; the report covers the listed products (Compute Engine incl. GPU, Load Balancer, Server Update Management, Network & Security, Windows Server, Kubernetes Engine (SKE), Red Hat Enterprise Linux, PostgreSQL Flex, Server Backup Management, MongoDB Flex, Run Command, SQLServer Flex, Block Storage, Observability, Object Storage, Secrets Manager, Backup Storage, AI Model Serving, Archiving Service, ServiceNow, File Storage) and ALL basic and additional criteriastackit.com2026-10-08
GDPRClaimedSTACKIT Cloudstackit.com2026-10-08
ISO 22301 · ISO22301Certificate publishedBusiness Continuity Management System (BCMS)stackit.com2026-10-08
ISO 27001 · ISO27001Claimedinformation security management system (ISMS); also the Group's own data centers in Germany and Austriastackit.com2026-10-08
ISO 27001 certificate based on IT baseline protection · ISO27001Claimedinformation network for the provision and operation of IaaS and PaaS cloud services: STACKIT Compute Engine, STACKIT Network & Security, STACKIT Block Storage, STACKIT Object Storage (S3) as well as all necessary processes, applications, systems, networks and locations of Schwarz Digits Cloud GmbH & Co. KGstackit.com2026-10-08
ISO 27017 · ISO27017Claimedcloud securitystackit.com2026-10-08
ISO 27018 · ISO27018Claimedprotection of personal data (PII)stackit.com2026-10-08
ISAE 3402Claimed—stackit.com2026-10-08
TÜV SÜD - ISO20000ClaimedIT Service Management (ITSM)stackit.com2026-10-08
TÜV SÜD - ISO50001Claimedthe modern DC10stackit.com2026-10-08
TÜVIT Trusted SiteClaimedSTACKIT data centers; Trusted Site Infrastructure (TSI) criteria catalogstackit.com2026-10-08
ISAE 3000 (SOC 2) · SOC2Available on request—stackit.com2026-10-08
TISAX LEVEL 3 · TISAXAvailable on requestcloud architecture; assessment ID ATA163-1, scope ID SH938Nstackit.com2026-10-08

Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.

Official registers

RegisterOffering, as the register names itStatusLevelValid untilObserved
Global LEI Index (GLEIF)Schwarz Digits Cloud GmbH & Co. KG · Schwarz Digits Cloud GmbH & Co. KGISSUEDDE2027-09-252026-10-09

What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.

Support window

Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.

Vulnerability reporting: [email protected] (security.txt, expires 2029-12-07; read 2026-10-11)

Documents

What we read, how it was disclosed, and when.
DocumentDisclosureTranscriptionHTTPObserved
certificationsPublicfull2002026-10-08
dpaPublicfull2002026-10-09
residencyPublicfull2002026-10-08

History

Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.