Licensed to be used in conjunction with basebox, only.
// security
Compliance
Applies to
Product: Cloud · Server · Audience: Security / Compliance reviewer
Regulatory frameworks and how basebox relates to them: GDPR, ISO 27001, NIS2 and the EU AI Act. These pages do not replace legal advice – they say what basebox delivers technically and organizationally, which role basebox has per framework and what stays with the customer.
The frameworks
| Framework | basebox's role | What sits with the customer | Page |
|---|---|---|---|
| GDPR | Cloud: processor, the DPA is part of every contract · Server: processor under operation by basebox; without an operations contract only if you grant basebox access for support · Cloud (transition phase): processor, Hetzner and Google as sub-processors | Controller; record of processing, legal basis, data subject rights, DPIA where applicable | GDPR · Data processing |
| ISO 27001 | The ISMS of basebox GmbH is certified to ISO/IEC 27001:2022; certificate with scope for download at basebox.ai/en/security | Own ISMS; assess basebox as a supplier | ISO 27001 |
| BSI C5 | Type 1 attestation for the Cloud in progress, planned to C5:2026 | C5 is not needed for Server; your requirements as operator apply there | basebox.ai/en/security |
| NIS2 | Supplier/service provider of an essential or important entity | Duties of the entity: risk management, supply chain, reporting | NIS2 |
| Software bill of materials (SBOM) | Generated automatically for every release, CycloneDX 1.6 according to BSI TR-03183-2 | Download in basebox under Version Info, complete for every chart version and in the installation package | SBOM |
| EU AI Act | Supplier/infrastructure provider, not a provider (no own models, quantization only) | Deployer: risk classification, human oversight, transparency, AI literacy | EU AI Act |
basebox is not a medical device and therefore does not need ISO 13485.
The EU AI Act package
Five versioned documents referring to basebox Server (as of October 2025, model register May 2026). Classification and summary: EU AI Act: What you need to know.
- Compliance – legal classification, duties of basebox and the customer, model responsibility, reporting duties
- Infrastructure policy – technical and organizational measures with a status per measure (implemented / partial / planned)
- Model register – source, licence, version, quantization, review status of the provided models
- Safety notice – residual risks, recommendations for operators, incident reporting
- Disclaimer – liability framework
The pages under Security & Compliance are the continuously maintained description; where they differ, the versioned package governs for contractual purposes. Where this documentation knows of a difference – for example the audit export that exists by now but is still listed as planned in the infrastructure policy – it is named on the respective page.
What recurs in every review
- Roles: basebox provides software and, where applicable, operation; the customer determines purpose, data and use. That applies equally to GDPR (controller), EU AI Act (deployer) and NIS2 (entity) – Shared responsibility.
- Data processing boundary: Cloud = your own environment in the Munich-East data center; Server = your network – Data flows.
- Controls with status: basebox names what is implemented and what is not (encryption at rest, image signatures, kill switch, manual pre-review) – Server.
- Evidence: audit log and export, release notes, model register, maintenance reports, DPA and list of sub-processors – Data processing & sub-processors.
Contact
Data protection and compliance questions, DPA, certificates: datenschutz@basebox.ai · basebox GmbH, Bahnhofplatz 3, 86919 Utting am Ammersee, Germany.
Next step: GDPR · Data processing & sub-processors