TRUST CENTER
On this page, we disclose how we work ourselves: our ISO/IEC 27001 certification, our policies and the answers to the questions your procurement or information security team asks in the supplier process — as evidence rather than promises.
Our processes are audited, our measures effective – this builds trust and shows: we know what we are talking about because we practice it ourselves every day.
As an active member of the BSI’s Alliance for Cyber Security, we contribute to strengthening digital resilience in Germany.
About our information security:
Our ISO/IEC 27001 certificate (DE-IS-20250158, valid until July 15, 2028): Certificate as PDF.
Our information security policy: Information Security Policy
Reporting security incidents: Please send reports of security incidents directly to [email protected].
We don’t just consult on ISO 27001 – we are certified ourselves and passed our first surveillance audit in 2026. Our field report.
For our clients:
General Terms and Conditions (version 2.1 of October 15, 2026): Terms as PDF · German version.
Our subprocessors:
To deliver our services, we use the following service providers, who may process personal data on our behalf (as of October 15, 2026):
| Provider | Location | Purpose |
|---|---|---|
| Anthropic, PBC | USA | AI assistance (Claude) |
| Google Ireland Limited (Google Workspace) | Ireland | E-mail, documents, calendar |
| ClickUp (Mango Technologies, Inc.) | USA | Project and task management, forms |
| Cloudflare, Inc. | USA | Website hosting |
| Qonto (Olinda SAS) | France | Invoicing and payments |
We publish changes to this list on this page.
For our suppliers:
Supplier Policy of 360 Digitale Transformation GmbH / Supplement to the Terms and Conditions of Purchase.
Without limiting the seller’s other obligations under this agreement, the seller must comply with basic security safeguards and controls that are at least as strict as recognized industry standards – in particular those described in the most current version of ISO/IEC 27001. These measures protect the buyer’s confidential information, all other data of the buyer or its employees, and the buyer’s systems (all of the above collectively referred to as “buyer’s data and systems”).
With reasonable prior notice, the buyer may review the seller’s policies, procedures and controls, as well as the results of internal or external reviews relating to the buyer’s data and systems (collectively referred to as “seller’s processes and controls”). This right applies both before and during the performance of this agreement. It includes immediate access following any security incident caused by the seller that could affect the buyer’s data and systems.
As soon as such a security incident has been identified, the seller must inform the buyer within twenty-four (24) hours of the incident and the nature of its impact on the buyer’s data and systems.
The seller shall ensure that these provisions are included in all contracts with its subcontractors and suppliers, so that the buyer and its customers have the same inspection and audit rights there as they have with respect to the seller.