VamiRedteam Trust Center

Security, compliance and sovereignty — made transparent.

VamiRedteam is an autonomous, agentic pentesting platform — operated to the same standards we assess at our clients. This Trust Center shows how we protect data, where we host, and how we develop securely.

ISO/IEC 27001:2022 certified VamiSec GmbH ISMS · Proks Certification GmbH (DAkkS-accredited) · certificate no. DE-IS-20250191 · valid until September 18, 2028 Download certificate (PDF) ⤓

View documents security@vamisec.com

OperatorVamiSec GmbH · Bonn, Germany

HostingT Cloud Public · Germany

Report a security incidentsecurity@vamisec.com

Statusstatus.vamiredteam.com

Last updatedOctober 13, 2026

01 — Compliance & Certifications

Built on certified foundations.

VamiRedteam is operated by VamiSec GmbH, whose information security management system is certified to ISO/IEC 27001 by a DAkkS-accredited body. The operating platform T Cloud Public brings its own attestations and certificates. We transparently indicate what is certified, what is in preparation, and what is platform evidence.

ISO/IEC 27001

VamiSec GmbH ISMS — certified by the DAkkS-accredited Proks Certification GmbH, valid until 09/2028.

Certified

ISO/IEC 42001

VamiSec AI management system being established — ISO/IEC 42001 certification in preparation.

In preparation

GDPR

GDPR-compliant processing, DPA available, EU data residency.

Compliant

BSI C5 · ISO 27001 · TISAX

Attestation, label & certificates of the operating platform T Cloud Public (Deutsche Telekom).

Hosting platform

ISO 14001

VamiSec GmbH environmental management system built per ISO 14001:2026 — certification in preparation.

In preparation

EcoVadis

Sustainability rating of VamiSec GmbH — Committed badge, awarded in October 2026.

Committed badge

02 — Hosting & Digital Sovereignty

Sovereign hosting in Germany — under European law.

VamiRedteam runs on Deutsche Telekom's T Cloud Public (formerly Open Telekom Cloud) — a sovereign European cloud, exclusively in German data centres. Platform data, model parameters and logs are subject to European law; the contracting party is based in Germany, German law applies and the place of jurisdiction is Germany. Identity and scheduling metadata are processed via Microsoft (EU region).

German data centres onlyTwin-core region Biere/Magdeburg (Saxony-Anhalt) — hosting exclusively in Germany, within the EU legal framework.

Secrets in HashiCorp VaultCredentials and API keys reside in Vault (KV v2), never in code — with AppRole/Kubernetes authentication for services.

Tenant isolationEach organisation receives isolated sandboxes on its own network — pentest environments run strictly separated.

Sovereign AI inferenceThe LLM connection is configurable — on request with models hosted in Europe or self-hosted, so that prompts and findings never leave the trust zone. Customer data is not used to train AI models.

T Cloud PublicDeutsche Telekom · sovereign cloud

BSI C5 Type II (ISAE 3000)
ISO/IEC 27001, 27017, 27018, 27701
SOC 1/2/3, TISAX AL 3
ISO 22301 (BCM), ISO 27001 data centres

Certificates, attestations and labels of the hosting platform (Deutsche Telekom), issued by independent auditors — not of VamiSec GmbH. Source: T Cloud Public certificates & attestations.

03 — Security Controls

How we protect — by domain.

Concrete controls instead of marketing. These measures are part of our security concept and are aligned with VamiSec's ISMS.

Data security

Encryption at rest (AES-256) and in transit (TLS 1.2+)
EU data residency; deletion within 30 days after contract end (DPA)
Data minimisation — only scope-relevant artefacts
No training on customer data — neither for our own nor for external AI models

Application security

Secure SDLC to the state of the art (details below)
SAST, DAST, SCA & dependency scanning in the pipeline
Penetration tests: external at least annually, complemented by continuous agentic testing

Access & identity

SSO & MFA via Microsoft Entra External ID (OIDC)
Least privilege & role-based access control
httpOnly session cookies, short token lifetimes

Infrastructure

Sovereign hosting on T Cloud Public (DE)
Isolated per-tenant sandboxes, containerised
Secrets management with HashiCorp Vault

Logging, monitoring & SOC

Central logging & monitoring, SIEM analysis
SOC-supported monitoring of security-relevant events
Hash-chained audit log for every agent action

Incident management

Defined incident response process
Customer notification targeting a report within 24 hours
Responsible disclosure to security@vamisec.com · security.txt

Authorization Cage

Whitelist-only scope, signed authorization letters
Hard stops for out-of-scope targets
Every write operation governed, scoped and logged

Organisation & governance

ISO/IEC 27001-certified ISMS (DAkkS)
Security awareness training for all employees
Supplier and risk management processes

Business Continuity & Backups

Regular, encrypted backups of platform data
Recovery is tested regularly
Operated on T Cloud Public in Germany

04 — Secure Software Development Lifecycle

We develop as securely as we test.

At VamiRedteam, security is not a downstream step but anchored in every phase of development — state of the art, from requirements through to operations.

Security Requirements Engineering

Security and data-protection requirements are defined before the first line of code.

Threat Modeling

Threat modeling to STRIDE and — for AI/agent components — MAESTRO.

SAST

Static code analysis, automated within the CI/CD pipeline.

SCA & Dependency Scanning

Software composition analysis and continuous checking of dependencies.

DAST

Dynamic security testing against the running application.

Penetration Testing

Regular manual and agentic pentests ahead of releases.

05 — The platform in action

Transparency — shown, not just claimed.

This is how VamiRedteam works: every agent action visible, every finding in the graph, every event logged.

VamiRedteam live console — **Live console.** Three specialised agents work in parallel; on the right the crawler pauses honestly instead of inventing success, and the pentester asks the operator.

VamiRedteam event stream — **Event stream.** Every tool call and every result — logged in full, traceable for any audit.

**Vami Logic Graph.** The attack surface as a linked hierarchy — domain, hosts, ports, services, directories.

// Screenshots from a real test run of the platform — target data anonymised (RFC 5737 / 2606).

06 — Sub-processors

Disclosed — who processes which data.

We deliberately rely on a lean number of carefully selected sub-processors. All process data within the EU or under EU law. We notify contract customers of changes at least 30 days in advance.

Sub-processor	Purpose	Region
Deutsche Telekom T Cloud Public	Cloud hosting & platform infrastructure	DE
Microsoft Entra External ID	Authentication, SSO & MFA (identity management)	EU
Microsoft Bookings / Outlook	Appointment scheduling & business communication	EU
Third-party LLMs configurable / sovereign	AI inference for the agents — EU-hosted or self-hosted on request; findings are triaged by humans	EU / self-hosted

Complete, always up-to-date list of sub-processors, including a contact for change notifications: privacy@vamisec.com

07 — Documents & Evidence

VamiSec GmbH, the operator of VamiRedteam, runs a documented environmental management system (EMS) per ISO 14001:2026. It is integrated with our ISO/IEC 27001-certified ISMS into one management system, and our sustainability performance is additionally assessed externally by EcoVadis.

Environmental management system per ISO 14001:2026Environmental policy, registers of environmental aspects and legal obligations, measurable environmental objectives with KPIs and clearly assigned EMS responsibility.

Integrated with the ISMSThe EMS uses the processes of our ISO/IEC 27001-certified ISMS — from change and corrective-action management to a joint management review.

Certification in preparationCertification to ISO 14001 by a DAkkS-accredited body is in preparation; the audit is planned for 2027.

EcoVadis Committed – Sustainability Rating

EcoVadisSustainability rating · Committed badge 2026

In the EcoVadis sustainability rating, VamiSec GmbH was awarded the Committed badge in October 2026 — recognising continuous improvement in sustainability.

The rating and the environmental management system relate to VamiSec GmbH as a company, which develops and operates VamiRedteam.

09 — Trust Updates

What has changed recently.

We keep our security profile up to date and transparently document material changes.

2026-10-13

Reporting channel unified

Report security vulnerabilities to security@vamisec.com; the security controls, FAQ, document card and security.txt (RFC 9116) all point to this address.

2026-10-12

Environmental management & EcoVadis

New environmental management section: VamiSec GmbH’s environmental management system per ISO 14001:2026 (certification in preparation) and the EcoVadis Committed badge (October 2026) added.

2026-10-04

Hosting exclusively in Germany

Clarified: the platform runs on T Cloud Public exclusively in German data centres (Biere/Magdeburg); the previously listed second region in the Netherlands no longer applies.

2026-10-04

No training on customer data

Made explicit: customer data is not used as training data — neither for our own nor for external AI models.

2026-08-30

Status page & certificate details

Live status page linked; ISO scope quoted with certificate number and validity, deletion timelines (30/90 days) made concrete.

2026-08-29

security.txt & clarifications

security.txt published per RFC 9116; evidence terminology and legal statements refined; business-continuity tile, availability/deletion FAQ and VDP card added.

2026-08-28

Trust Center published

This Trust Center went live — with controls, sub-processors, a Secure SDLC overview and document access.

2026-08

24/7 Zero-Day Vulnerability Management

The L4 Continuous Adversary Mode is available as a continuous operation — the foundation of VamiSec Zero-Day Monitoring.

2026

Migration to T Cloud Public

Operation on Deutsche Telekom's sovereign European cloud (formerly Open Telekom Cloud) confirmed.

10 — FAQ

Common questions from due diligence.

Where is our data stored?

Exclusively in German data centres of T Cloud Public (Deutsche Telekom) in Biere/Magdeburg. Platform data is subject to European law — the contracting party is based in Germany, German law applies and the place of jurisdiction is Germany; identity and scheduling metadata are processed via Microsoft in the EU region.

Is VamiRedteam ISO 27001 certified?

VamiRedteam is operated by VamiSec GmbH, whose ISMS is certified to ISO/IEC 27001 by a DAkkS-accredited body. The operation of VamiRedteam follows the processes of this management system. The certified scope explicitly covers, in addition to the consulting services, the associated digital products and supporting information-processing facilities (certificate DE-IS-20250191, ISO/IEC 27001:2022, valid until 18 September 2028). The hosting platform T Cloud Public additionally holds a BSI C5 attestation, ISO 27001 certificates, a TISAX label (AL 3) and SOC 1/2/3 reports.

How do users authenticate?

Via Single Sign-On with enforced multi-factor authentication through Microsoft Entra External ID (OIDC). Sessions run over short-lived httpOnly cookies; access follows the least-privilege principle.

How do you ensure that pentests stay within scope?

Through the Authorization Cage: the scope is whitelist-only, every engagement is covered by signed Authorization Letters, targets outside the scope are hard-stopped, and every active operation is recorded in a hash-chained audit log.

How will we be informed in the event of a security incident?

We follow a defined incident response process and notify affected customers promptly — targeting an initial report within 24 hours. Report security vulnerabilities confidentially to security@vamisec.com — also machine-readable via /.well-known/security.txt (RFC 9116).

Which AI models does the platform use, and is our data used for training?

The LLM integration is configurable. On request, we deploy models hosted in Europe or self-hosted, so that prompts and findings never leave the European trust zone. Your data is not used to train AI models: we use neither scope data, prompts, findings nor reports to train or fine-tune our own models, and we connect external models only under contractual terms that exclude training use by the provider. Results are triaged by humans before reporting.

How do we obtain access to confidential documents?

Public documents are available directly. For pentest summaries, architecture whitepapers or completed questionnaires, a short request to security@vamisec.com is sufficient; evidence subject to an NDA is released after signing.

What availability applies to the platform?

We monitor the platform continuously (central monitoring, SOC-supported) and announce planned maintenance in advance. Contractual availability commitments (SLA) are agreed as part of the contract — talk to us. Check the current operational status live at status.vamiredteam.com.

What happens to our data after the contract ends?

Production data is deleted within 30 days after contract end; backups then rotate out automatically within a further 90 days (timelines as agreed in the DPA). You can export your data before deletion.

Still have questions?

Talk to our team.

We answer your security and compliance questions and provide the evidence your procurement needs.

Book a demo security@vamisec.com