Skip to content
VamiAppSec Trust Center

Security, compliance and sovereignty — made transparent.

VamiAppSec is VamiSec GmbH’s LLM-powered application security platform for the Secure SDLC — SAST, SCA, SBOM, secrets, IaC and container scanning plus AI-powered DAST with the integrated VamiDAST. This Trust Center shows how we protect data, where we host and how we develop securely.

Proks Certification – ISO/IEC 27001 Certified
ISO/IEC 27001:2022 certified VamiSec GmbH ISMS · Proks Certification GmbH (DAkkS-accredited) · certificate no. DE-IS-20250191 · valid until 18 September 2028 Download certificate (PDF) ⤓
View documents security@vamisec.com
OperatorVamiSec GmbH · Bonn, Germany
HostingT Cloud Public · Germany · or on-prem
Report a security incidentsecurity@vamisec.com
Last updated13 October 2026
StatusLive
01 — Compliance & Certifications

Built on certified foundations.

VamiAppSec is operated by VamiSec GmbH, whose information security management system is certified to ISO/IEC 27001 by a DAkkS-accredited body. We transparently indicate what is certified, what is in preparation, and what is evidence of the hosting platform.

ISO/IEC 27001

VamiSec GmbH ISMS — certified by the DAkkS-accredited Proks Certification GmbH, valid until 09/2028.

Certified

ISO/IEC 42001

VamiSec AI management system established — ISO/IEC 42001 certification in preparation.

In preparation

GDPR

Product-specific data processing agreement (DPA) under Art. 28 GDPR on request (privacy@vamisec.com), sub-processors disclosed.

DPA on request

BSI C5 · ISO 27001 · TISAX

Attestation, label & certificates of the operating platform T Cloud Public — held by Deutsche Telekom, not VamiSec GmbH; relevant to SaaS operation.

Hosting platform

ISO 14001

VamiSec GmbH environmental management system established in line with ISO 14001:2026 — certification in preparation.

In preparation

EcoVadis

Sustainability rating of VamiSec GmbH — Committed badge, awarded in October 2026.

Committed badge
02 — Hosting & Digital Sovereignty

Sovereign hosting in Germany — under European law.

In SaaS operation, VamiAppSec runs on Deutsche Telekom’s T Cloud Public (formerly Open Telekom Cloud) — a sovereign European cloud, exclusively in German data centres. Platform data and logs are subject to European law; the contracting party is VamiSec GmbH, based in Bonn, Germany. VamiAppSec is LLM-agnostic — you choose the language model for the AI functions: the local Qwen3.8 in VamiSec’s data centre in Sankt Augustin (keeping AI processing in Germany as well), Anthropic Claude or OpenAI with processing in the USA, or your own LLM (BYOLLM).

German data centres onlyTwin-core region Biere/Magdeburg (Saxony-Anhalt) — hosting exclusively in Germany, within the EU legal framework.
On-prem on your Kubernetes clusterAlternatively, the entire stack — scanners, VamiDAST, DefectDojo and LLM — runs on your own Kubernetes cluster, without proprietary cloud-provider services and air-gapped if required; Qwen3.8 then uses your GPUs.
Local LLM in Sankt AugustinQwen3.8 is an open-weight model that VamiSec runs on its own GPUs in its own data centre in Sankt Augustin — only the LLM runs there, not the platform. With the local model, no third-country API is involved.
Anthropic Claude, OpenAI or your own LLMIf you choose Anthropic Claude or OpenAI via VamiSec, the provider processes the LLM requests in the USA (Standard Contractual Clauses). If you connect your own LLM or your own API key (BYOLLM), the contractual relationship is directly between you and the provider. We do not use customer data as training data — regardless of the model you choose.
  • BSI C5 Type II (ISAE 3000)
  • ISO/IEC 27001, 27017, 27018, 27701
  • SOC 1/2/3, TISAX AL 3
  • ISO 22301 (BCM), ISO 27001 data centres

Certificates, attestations and labels of the hosting platform (Deutsche Telekom), issued by independent auditors — not of VamiSec GmbH. Source: T Cloud Public certificates & attestations.

03 — Security Controls

How we protect — by domain.

Concrete controls instead of marketing. These measures are part of our security concept and are aligned with VamiSec’s ISMS.

Data security

  • SaaS platform data exclusively on T Cloud Public in Germany — encrypted at rest and in transit (TLS)
  • Defined deletion and retention periods, governed by the product-specific DPA — available on request via privacy@vamisec.com
  • Data minimisation: VamiDAST passes only 2 KB response snippets to a prompt
  • No AI training on customer data: we do not train or fine-tune models with it; external models connected via VamiSec (Anthropic Claude, OpenAI) only under contractual terms that exclude training use

Application security

  • Secure SDLC from requirements to operations (details below)
  • Threat modelling, code review and automated tests in CI
  • Penetration test of the platform completed; summary on request

Access & credentials

  • Credentials for authenticated DAST scans are never logged or passed into a prompt
  • Active tests in production only in Passive or Safe mode; Aggressive only after explicit non-production confirmation
  • Sign-in to the SaaS platform with multi-factor authentication (MFA)

Infrastructure

  • Sovereign hosting on T Cloud Public (DE)
  • Kubernetes-native and runs without proprietary cloud-provider services — the basis for on-prem and air-gapped operation
  • LLM-agnostic: local Qwen3.8 on VamiSec’s own GPUs in Sankt Augustin, Anthropic Claude, OpenAI or your own LLM (BYOLLM)

Logging & traceability

  • Every LLM call is logged with model version, prompt and output
  • DefectDojo as the system of record for findings — with deduplication, risk acceptance and a complete audit trail
  • Evidence package per release: gate decisions, SBOM (CycloneDX, SPDX), VEX/VDR and SARIF

Incident management

  • Defined incident response process
  • Notification of affected customers — details are governed by the DPA
  • Responsible disclosure via security@vamisec.com · security.txt

AI governance & human-in-the-loop

  • LLM-augmented, not agentic: the model enriches, triages and suggests fixes — it does not act autonomously
  • VamiDAST: deterministic engine, AI used at exactly three limited points, every AI output schema-validated
  • Humans decide: your PSIRT reviews VEX drafts, CRA reports remain drafts with no automatic submission

Organisation & governance

  • ISO/IEC 27001-certified ISMS (DAkkS)
  • Security awareness training for all employees
  • Supplier and risk management processes

Operations & continuity

  • Operation as SaaS or on-prem — air-gapped if required
  • Backup and recovery arrangements on request (security@vamisec.com)
  • Operated on T Cloud Public — twin-core region Biere/Magdeburg
04 — Secure Software Development Lifecycle

We develop as securely as we test.

At VamiAppSec, security is not a downstream step but anchored in every phase of development — state of the art, from requirements through to operations.

01

Security Requirements Engineering

Security and data-protection requirements are defined before the first line of code.

02

Threat Modeling

Threat modelling of the platform using STRIDE per element.

03

Code Review

Changes are reviewed before they are merged — with a focus on security and data protection.

04

Automated Testing

The automated test suite runs in CI on every pull request.

05

Secure Deployment

Containers, Kubernetes-native — as SaaS on T Cloud Public or on-prem on your cluster.

06

Penetration Testing

The platform has undergone a penetration test; a summary is available on request.

05 — Sub-processors

Disclosed — who processes which data.

We deliberately rely on a lean number of carefully selected sub-processors and disclose the purpose and processing region of each. We inform customers of changes in advance.

Telekom Deutschland GmbH processes platform data only in SaaS operation and exclusively in Germany. Anthropic and OpenAI are only involved if you choose a public LLM via VamiSec for AI functions: processing then takes place in the USA (direct API) on the basis of the EU Standard Contractual Clauses (SCC); training use is excluded under the providers’ contractual terms.

Sub-processor Purpose Region
Telekom Deutschland GmbH
T Cloud Public		 Hosting & infrastructure of the SaaS platform in the eu-de region (Biere/Magdeburg) — SaaS operation only DE
Anthropic
Claude API (public LLM)		 AI functions (enrichment, triage, fix suggestions, VamiDAST AI steps) — only if you choose Anthropic as public LLM via VamiSec; no training use under the provider’s contractual terms USA
OpenAI
OpenAI API (public LLM)		 AI functions (enrichment, triage, fix suggestions, VamiDAST AI steps) — only if you choose OpenAI as public LLM via VamiSec; no training use under the provider’s contractual terms USA

Not a sub-processor: VamiSec GmbH runs the local Qwen3.8 itself on its own GPUs in its data centre in Sankt Augustin. If you connect your own LLM or your own API key (BYOLLM), the contractual relationship is directly between you and the provider. On-prem, the entire stack including the LLM runs on your Kubernetes cluster — in that case Telekom is not involved either.

Questions about sub-processors: privacy@vamisec.com. The list is machine-readable at /subprocessors.json.

06 — Documents & Evidence

Everything you need for your review.

Public documents are available directly. Confidential evidence is released upon a brief request or under NDA.

Public

ISO/IEC 27001 certificate

Certificate of the VamiSec ISMS (no. DE-IS-20250191, ISO/IEC 27001:2022, valid until 18 September 2028), issued by the DAkkS-accredited Proks Certification GmbH.

View →
Public

Information Security Policy

Overarching information security policy with strategic direction.

View →
Public

AI Policy

Overarching policy of VamiSec GmbH on the responsible use of AI — the foundation of our AI management system per ISO/IEC 42001, with reference to the EU AI Act and the GDPR.

View →
On request

AVV / DPA

Product-specific data processing agreement pursuant to Art. 28 GDPR for VamiAppSec, including the deletion and retention periods — available for signature on request.

Request →
On request

Pentest Summary

Summary of the penetration test of the platform.

Request →
On request

Security Whitepaper & Architecture

Technical overview of the architecture, access protection and data flow of VamiAppSec.

Request →
Under NDA

CAIQ / Security Questionnaire

CAIQ and common security questionnaires for your vendor-risk process — VamiSec completes them under NDA.

Request →
Public

Report a vulnerability (responsible disclosure)

Report security vulnerabilities confidentially to security@vamisec.com — also machine-readable via /.well-known/security.txt (RFC 9116).

Report →
Public

Environmental & sustainability policies

ISO 14001 environmental management policy and the sustainability & ESG policy of VamiSec GmbH.

Environmental Management Policy (PDF) ↗ Sustainability & ESG Policy (PDF) ↗
07 — Environmental management & sustainability

Responsibility beyond information security.

VamiSec GmbH, the operator of VamiAppSec, runs a documented environmental management system (EMS) per ISO 14001:2026. It is integrated with our ISO/IEC 27001-certified ISMS into one management system, and our sustainability performance is additionally assessed externally by EcoVadis.

Environmental management system per ISO 14001:2026Environmental policy, registers of environmental aspects and legal obligations, measurable environmental objectives with KPIs and clearly assigned EMS responsibility.
Integrated with the ISMSThe EMS uses the processes of our ISO/IEC 27001-certified ISMS — from change and corrective-action management to a joint management review.
Certification in preparationCertification to ISO 14001 by a DAkkS-accredited body is in preparation; the audit is planned for 2027.

In the EcoVadis sustainability rating, VamiSec GmbH was awarded the Committed badge in October 2026 — recognising continuous improvement in sustainability.

The rating and the environmental management system relate to VamiSec GmbH as a company, which develops and operates VamiAppSec.

08 — FAQ

Common questions from due diligence.

Where is our data stored?
In SaaS operation, we store VamiAppSec platform data exclusively in data centres in Germany (T Cloud Public, Biere/Magdeburg); on-prem, it stays in your own environment. With the local Qwen3.8, AI processing also remains in Germany. If you choose Anthropic Claude or OpenAI via VamiSec for the AI functions, the LLM requests are processed in the USA; provider, purpose and region are disclosed in the sub-processor table. With your own LLM (BYOLLM), you determine the provider and processing location yourself.
Is VamiAppSec ISO 27001 certified?
VamiAppSec is operated by VamiSec GmbH, whose ISMS is certified to ISO/IEC 27001 by a DAkkS-accredited body. VamiAppSec as a product does not hold a certificate of its own. According to the certificate, the scope is the “provision of consulting services in the field of information security, associated digital products and supporting information-processing facilities for the processing of customer data, IT infrastructure and cloud storage” (translated from the German certificate DE-IS-20250191, ISO/IEC 27001:2022, valid until 18 September 2028).
What data does VamiAppSec process?
Source code from your repositories including dependencies, IaC and container configurations; derived from these, normalised findings (CWE, CVSS, OWASP requirement, file, line), detected secrets with rotation recommendations, as well as SBOMs (CycloneDX, SPDX) and VEX/VDR per release. For VamiDAST, endpoints, parameters and the requests and responses of the running web app or API are added; for pipeline gates and ticket sync, integration data from your CI/CD and ticket systems. For authenticated scans, VamiDAST processes credentials (form logins, JWTs, cookies, API keys); they are never logged or passed into a prompt. Every LLM call is logged with model version, prompt and output.
Which AI models does VamiAppSec use, and what do they see of our code?
VamiAppSec is LLM-agnostic — you choose the model: the local Qwen3.8, which VamiSec runs on its own GPUs in Sankt Augustin (on-prem on your GPUs), Anthropic Claude or OpenAI, processed in the USA, or your own LLM (BYOLLM). The selected model processes the context of the findings and — for the semantic SAST review — source code; VamiDAST passes only 2 KB response snippets to a prompt, never credentials. VamiAppSec is LLM-augmented, not agentic: the model enriches, triages and suggests fixes without acting autonomously. Triage decisions, false positives and fix results feed into future runs as context — this is not model training. Every call is logged with model version, prompt and output, and we do not use customer data as training data.
How will we be informed in the event of a security incident?
We follow a defined incident response process and notify affected customers promptly; the details are governed by the DPA. Security researchers report vulnerabilities to security@vamisec.com — machine-readable per RFC 9116 at /.well-known/security.txt.
Is our data used to train AI models?
No. We do not use customer data as training data: we do not train or fine-tune any AI models with it, and we use external AI models connected via VamiSec (Anthropic Claude, OpenAI) only under contractual terms that exclude training use; these providers are disclosed in the sub-processor table. If you connect your own LLM (BYOLLM), the terms of your contract with the provider apply.
How do we obtain access to confidential documents?
Public documents are available directly. For pentest summaries, architecture whitepapers or completed questionnaires, a short request to security@vamisec.com is sufficient; evidence subject to an NDA is released after signing.
Can VamiDAST affect our production environment?
VamiDAST has three modes: Passive (no state-changing requests), Safe (default) and Aggressive. A safety lock classifies every active request and blocks it in case of doubt. In production, only Passive and Safe are intended; Aggressive can only be used after explicit confirmation that the environment is not production. Everything is controlled by a deterministic engine — “The model advises — it never steers.”
Can we run VamiAppSec entirely in our own environment?
Yes. Besides SaaS operation on T Cloud Public, the entire stack — scanners, VamiDAST, DefectDojo and LLM — runs on your own Kubernetes cluster. VamiAppSec is Kubernetes-native and does not use proprietary cloud-provider services; air-gapped operation is possible if required, and Qwen3.8 then runs on your own GPUs.
Does VamiAppSec make our product compliant with the CRA, the MDR or IEC 62443?
No. VamiAppSec does not certify your product — that is done by your notified body, your technical service or your auditor. VamiAppSec provides machine-generated evidence per release, for example for regulations and standards such as the CRA, the MDR or IEC 62443: SBOM, VEX/VDR, gate decisions and audit exports. VamiAppSec prepares CRA reports under Art. 14 only as pre-filled drafts for submission via the ENISA Single Reporting Platform.
How are sign-in, encryption and deletion periods handled?
In SaaS operation, you sign in with multi-factor authentication (MFA). Your data is encrypted at rest and in transit (TLS). Deletion and retention periods are defined and governed by the product-specific data processing agreement (DPA) under Art. 28 GDPR, which you can request via privacy@vamisec.com.
Still have questions?

Talk to our team.

We answer your security and compliance questions and provide the evidence your procurement needs.

Book a demo security@vamisec.com