Trust Center

Security you can prove.

Here you'll find everything you need for your supplier evaluation: how we handle security incidents, what the Cyber Resilience Act and Data Act mean for you, where your data is stored, and what documentation is available.

Frankfurt am Main
Storing and Backing Up Your Data with Amazon Web Services
ISO/IEC 27001
In addition, ISO 22301, ISO 9001, and SOC 3: Certificates for the platform issued to Cumulocity GmbH
psirt@
a reporting channel for vulnerabilities and security incidents
Data Act
Data Export and Provider Switching with Fixed Deadlines and an Open Format Directory

Six topics, one point of contact.

Each page states its position. What we agree to is set forth in our contract, the EULA V2.5 and its appendices. These pages explain this and cite the relevant sections.

Operation

Platform Status.

You can view outages and scheduled maintenance for the platform and—for devices purchased through us—our reception services on our status pages.

Your contract takes precedence. These pages describe the EULA V2.5, which has been in effect since October 28, 2026. If you have an older version of the contract, it will remain in effect until the transition; we will contact you regarding this.

Three levels, three people in charge.

Each entry applies to exactly one level. This way, you can see who is responsible for what.

Operations and ApplicationsModern Drive Technology GmbH

Operating your platform instance, extensions, and microservices; connecting devices; providing support; and reporting security incidents to you.

Cumulocity , GmbH IoT Platform

Platform software and platform operations, certified to ISO/IEC 27001, 27017, 27018, ISO 9001, and ISO 22301, and audited to SOC 2 and SOC 3.

Infrastructure: Amazon Web Services

Data centers in Frankfurt am Main for storing and backing up platform data.

News.

New versions and revisions. Customers with access to the documents can receive them by email upon request.

  • Our EULA V2.5 is in effect. It revises the provisions regarding the reporting of security incidents, software bill of materials, data export, and switching providers. We will migrate existing customers over the next few weeks.
  • The platform's SOC 2 Type II report and SOC 3 report for 2026 are now available.
  • The reporting requirements of the German Federal Office for Information Security ( Cyber Resilience Act ) apply. Our security incident reporting chain is in effect.
  • The " Data Act " is in effect. Data export and switching providers have been regulated by law ever since.

Did you receive a security questionnaire?

Please send it to us. We will answer it based on the information provided in this Trust Center.