T Cloud Public
Cloud infrastructure · t-cloud-public.com · last read 2026-10-12
Identity
| Legal entity | T-Systems International GmbH |
|---|---|
| HQ | DE |
| Parent company | DEUTSCHE TELEKOM AG |
| Ultimate ownership | DE |
| EU contracting entity | — |
| LEI | 5299004XPX8GS3AHAV34 |
| US CLOUD Act reach | No US company in the ownership chain on record |
| Source | t-cloud-public.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Terms not stated | — | t-cloud-public.com | 2026-10-08 |
EU: The document lists T Cloud Public data centers in Germany and the Netherlands and mentions "GDPR-compliant data storage in Europe". It names no plan and no cost for using these locations.
Subprocessor chain
3 third parties · 9 of the vendor's own group companies · 0 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| iits-consulting GmbH | DE | Consulting |
| operational services GmbH & Co. KG | DE | IT service provider |
| SC Combridge S.R.L | RO | Cloud provider |
T Cloud Public's own group companies listed as subprocessors (9)
| Company | Country | Purpose |
|---|---|---|
| Deutsche Telekom Individual Solutions & ProductsGmbH | DE, NL | 1st level & level 1.5 support, hardware maintenance and setup |
| Deutsche Telekom IT GmbH | DE | MyWorkplace |
| Deutsche Telekom MMS GmbH | DE | IT service provider |
| Deutsche Telekom Security GmbH | DE | IT service provider |
| Deutsche Telekom Systems Solutions Slovakia s.r.o. | SK | Cloud provider |
| Deutsche Telekom TSI Hungary Kft. | HU | Operation, 2ndlevel support |
| T-Systems Client Services GmbH | DE | Service Desk (1st Level Support) |
| T-Systems ITC Iberia, S.A. | ES | Operation, 2ndLevel Support |
| T-Systems on site services GmbH | DE | Development services |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · t-cloud-public.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | other |
| Notice of new subprocessors | At least four weeks in advance, express written notice to the controller of intended additions or replacements to the agreed subprocessor list |
| Notice of new subprocessors | Six weeks in advance, in writing, with information needed to exercise the right to object |
| If you object to one | Controller may object to the changes before the subprocessor is engaged; processor must provide the information needed to exercise the objection right. No consequence of an objection is stated in this part. |
| If you object to one | Object in writing within four weeks (otherwise deemed approved; not unreasonably); if the objection makes service impossible, customer may terminate affected services without notice within one month of notification; transition phase up to six months during which the new subprocessor is not used for the customer's data |
| Breach notification | without undue delay after becoming aware of the breach |
| Audit | Non-event-driven on-site inspections may be replaced by documents, evidence, certifications or audits; must be announced in advance in a timely manner, avoiding business disruption; inspectors bound to confidentiality and may not be competitor representatives |
| Audit | Processor provides compliance information; on controller's request, permits and contributes to audits at reasonable intervals or when there are indications of non-compliance; controller may consider processor's certifications |
| Audit | Processor provides information to demonstrate compliance and permits audits at reasonable intervals or when there are indications of non-compliance. Audits by the controller or an independent auditor, and may include inspections of premises with reasonable advance notice. The controller may consider the processor's certifications. |
| Audit | Telekom may prove compliance (per item 3.2) by evidence: Art. 40 GDPR codes of conduct, Art. 42 certification, current certificates/reports or report excerpts from independent bodies (e.g., auditors), other suitable certification, or a processor affidavit |
| Audit | routine on-site inspections twice per calendar year, announced in advance; event-driven inspections unaffected; customer to first consider whether documents, evidence, certifications or audits can replace them; inspectors bound to confidentiality and may not represent competitors of Telekom |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| BSI C5 (Typ 2) · C5 | Claimed | T Cloud Public | t-cloud-public.com | 2026-10-08 |
| ISO 22301 · ISO22301 | Claimed | T Cloud Public; business continuity management | t-cloud-public.com | 2026-10-08 |
| ISO 27001 · ISO27001 | Claimed | T Cloud Public | t-cloud-public.com | 2026-10-08 |
| ISO 27017 · ISO27017 | Claimed | T Cloud Public; cloud-specific security measures | t-cloud-public.com | 2026-10-08 |
| ISO 27018 · ISO27018 | Claimed | T Cloud Public | t-cloud-public.com | 2026-10-08 |
| ISO 9001 · ISO9001 | Claimed | T Cloud Public; standardized quality management | t-cloud-public.com | 2026-10-08 |
| Trusted Cloud data protection profile | Claimed | T Cloud Public | t-cloud-public.com | 2026-10-08 |
| SOC 2 · SOC2 | Claimed | T Cloud Public | t-cloud-public.com | 2026-10-08 |
| TISAX | Claimed | T Cloud Public | t-cloud-public.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Global LEI Index (GLEIF) | T-Systems International GmbH · T-Systems International GmbH | ISSUED | DE | 2027-08-26 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under T Cloud Public; T-Systems International GmbH
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under T Cloud Public; T-Systems International GmbH
- Data Privacy Framework List (US): checked 2026-10-12, no entry under T Cloud Public; T-Systems International GmbH
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under T Cloud Public; T-Systems International GmbH
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under T Cloud Public; T-Systems International GmbH
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under T Cloud Public; T-Systems International GmbH
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| T Cloud Public (service) | — | Service only | unknown | t-cloud-public.com | 2026-10-11 |
Vulnerability reporting: no security.txt at the well-known path (read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.