Licensed to be used in conjunction with basebox, only.
// security
ISO 27001
Applies to
Product: Cloud · Server · Audience: Security / Compliance reviewer
basebox's ISO 27001 certification: what it means, what it covers, and what it means for Cloud and Server customers. basebox describes itself as ISO 27001 certified (What is basebox?). The ISMS of basebox GmbH is certified to ISO/IEC 27001:2022, with annual surveillance audits; the scope covers development, implementation and operation of the software. You can download the certificate with its scope at basebox.ai/en/security. For the Cloud, the BSI C5 Type 1 attestation is in progress, planned to C5:2026; C5 is not needed for Server.
For decision makers
Overview, ISO 27001 and topics for the works council: basebox.ai/en/security. These pages provide the technical evidence.
What an ISO 27001 certification says – and what not
Says: basebox runs an information security management system (ISMS) that has been audited by an independent body: risk management, policies, responsibilities, controls from Annex A, internal audits, continual improvement – within the defined scope.
Does not say: that a particular technical property of the software exists (for example encryption at rest), that your installation is securely configured, or that your own organization meets requirements. The certification describes the supplier, not your deployment.
What it means per deployment model
| Meaning of basebox's certification | |
|---|---|
| basebox Cloud | Directly relevant: basebox operates the infrastructure and processes as a processor. The ISMS covers – subject to the scope statement – the operational processes: access control for operations staff, change management, incident handling, supplier management (data center, sub-processors). For your vendor assessment the certificate is the central evidence. |
| basebox Server, self-operated | Relevant for the software supply chain: secure development, release process, handling of vulnerabilities, communication of security updates. The operation of your server sits in your own ISMS; the certificate does not cover your server. |
| basebox Server, operated by basebox | Both: software supply chain and the operational processes basebox works with via the maintenance access. |
Controls you find in basebox
Mapping of typical audit questions (ISO 27001:2022, Annex A) to what basebox delivers – as a help for your own assessment, not as a statement about the certification scope:
| Topic | What basebox delivers | Page |
|---|---|---|
| Access control (A.5.15–5.18, A.8.2–8.5) | Role model, groups, OIDC/LDAP, API keys, connector gate with per-user credentials | Roles & permissions · Connectors |
| Logging and monitoring (A.8.15–8.16) | Audit log with Audit Log Level, retention, export; metrics and logs on Server | Audit & logging · Monitoring |
| Cryptography (A.8.24) | HTTPS from outside, TLS across host and zone boundaries; storage encryption via encrypted disks; application-level encryption at rest not implemented | Encryption |
| Secure development (A.8.25–8.29) | Static analysis, dependency scan, CVE check, tests, manual QA, four-eyes principle | Infrastructure policy |
| Change management (A.8.32) | Release notes and changelog per version; maintenance windows with announcement, backup, report | Updates · Remote maintenance |
| Vulnerability management (A.8.8) | CVE check of every release (a known vulnerability fails the release), penetration test of the Cloud by external testers in November 2025, security updates announced by e-mail; reports to security@basebox.ai | Compliance document |
| Incident management (A.5.24–5.28) | Immediate information of affected customers; reporting channel datenschutz@basebox.ai | GDPR |
| Backup (A.8.13) | CloudNativePG backups, dumps; in the Cloud by basebox, daily, retained for 7 days | Backup |
| Supplier relationships (A.5.19–5.23) | Model register for the model supply chain; image signatures in preparation | Model register |
| Privacy (A.5.34) | Roles, DPA, data subject rights | GDPR |
| Remote access (A.6.7, A.8.1) | PAM/VPN, time-limited, approved, logged, revocable | Remote maintenance |
For the review
- Download the certificate with its scope from basebox.ai/en/security or request it from datenschutz@basebox.ai, check validity; check whether the scope covers the processes relevant to you (Cloud operation or software development).
- For Cloud, additionally request the data center's certification (Infrastructure).
- Your own ISMS: record your basebox installation as an asset, compare the controls above with your configuration, track open points (storage encryption, policies) as measures.
- In the supplier audit ask about: handling of vulnerability reports, response times. Sub-processors: Data processing & sub-processors.
Next step: NIS2