Supporting Documents

Certificates and documents for your supplier evaluation.

The platform's certificates are issued to Cumulocity GmbH and are publicly available there. You can download our own documents directly here after registering and having your account approved.

As of October 28, 2026

Evidence from the platform.

Issued to Cumulocity GmbH, Düsseldorf. Available in the Trust Center at Cumulocity, without registration.

Cumulocity GmbH

ISO/IEC 27001:2022, along with 27017 and 27018

Information Security, Cloud Security, Data Protection in the Cloud

Valid through November 19, 2027View ↗
Cumulocity GmbH

ISO 22301:2019

Business Continuity: Operations Even in a Crisis

Valid through December 5, 2027View ↗
Cumulocity GmbH

ISO 9001:2015

Quality Management in Development, Professional Services, and Support

Valid through March 20, 2028View ↗
Cumulocity GmbH

SOC 3 Report 2026

Independent Review of Safety and Availability: Summary for the Public

PublicView ↗
Cumulocity GmbH

SOC 2 Type II 2026

Complete test report. Confidential; access available only via Cumulocity.

at CumulocityInquiries ↗
Cumulocity GmbH

Platform Privacy Policy

Technical and Organizational Measures and List of Subcontractors

PublicView ↗

Our own records.

Once you have registered and your account has been approved, you can download all documents here. The legal texts on the website are publicly available.

  • EULA MACHINES.cloud V2.5 Terms and Conditions with Appendices 1 through 4upon approvalDownload
  • EULA V2.5 Customer Overview:Your Agreement on One PageAfter ApprovalDownload
  • Terms and Conditions: Legal Text for the WebsitePublicOpen
  • Privacy Policy | Legal Information for the WebsitePublicOpen
  • Safety Instructions forGateways: Basic Safety Guidelines for Field OperationAfter ApprovalDownload
  • Reporting Chain forSecurity Incidents: Levels, Deadlines, Reporting ChannelsUpon ApprovalDownload
  • Data Processing Agreement—Appendix 3 to the EULA V2.5, with Subprocessorsupon approvalDownload
  • Technical and OrganizationalMeasures: Description of Our Measures · DE, ENUpon approvalDownload
  • SecureData Transfer Between Device and MACHINES.cloud · DE, ENAfter approvalDownload
  • Cumulocity's Subcontracted ProcessorsList of Subcontracted Processors · ENUpon approvalDownload
  • Cloud Services Measures (Cumulocity)Technical and Organizational Measures · ENAfter approvalDownload
  • Measures: Maintenance and Support Services (Cumulocity)Technical and Organizational Measures · ENAfter approvalDownload
  • Professional Services Measures (Cumulocity)Technical and Organizational Measures · ENAfter approvalDownload
  • Cumulocity Trust Center:Certificates, audits, and other platform documentationat CumulocityOpen ↗
  • SBOM YourCycloneDX instance, by release versionupon requestContact person
  • Agreement on the Notification Chain for ExistingContracts: For customers with older contract versions until the transition to V2.5Upon requestContact Person
  • Your Contracts and Customer-SpecificAgreements About Your Contact Personupon requestContact person

NIS2

Does your company fall under NIS2? We can help you with your supply chain assessment.

  • Security Questionnaire

    Once per contract year, we will respond to your questionnaire to the extent appropriate (Appendix 1, Section 6).

  • Supporting Documents

    Our documents from this Trust Center and the platform's supporting documentation.

  • Audits and Penetration Tests

    Subject to prior agreement on the scope, timing, and confidentiality (Appendix 1, Section 6).