VamiThreat Trust Center

Security, compliance and sovereignty — made transparent.

VamiThreat is VamiSec GmbH’s AI-assisted threat modeling platform: from architecture descriptions, documents and diagrams it produces a data-flow diagram, a threat model based on STRIDE and MAESTRO, attack paths and remediation. This Trust Center shows how we protect data, where we host, and how we develop securely.

ISMS certified to ISO/IEC 27001:2022 VamiSec GmbH ISMS · Proks Certification GmbH (DAkkS-accredited) · certificate no. DE-IS-20250191 · valid until 18 September 2028 Download certificate (PDF) ⤓

View documents security@vamisec.com

OperatorVamiSec GmbH · Bonn, Germany

HostingT Cloud Public · Germany

Report a security incidentsecurity@vamisec.com

Last updated13 October 2026

StatusBeta · access on request

01 — Compliance & Certifications

Built on certified foundations.

VamiThreat is operated by VamiSec GmbH, whose information security management system is certified to ISO/IEC 27001 by a DAkkS-accredited body. We transparently indicate what is certified, what is in preparation, and what is evidence of the hosting platform.

ISO/IEC 27001

VamiSec GmbH ISMS — certified by the DAkkS-accredited Proks Certification GmbH, valid until 09/2028.

Certified

ISO/IEC 42001

VamiSec AI management system being established — ISO/IEC 42001 certification in preparation.

In preparation

GDPR

Data processing agreement under Art. 28 GDPR on request (privacy@vamisec.com), sub-processors disclosed.

DPA on request

BSI C5 · ISO 27001 · TISAX

Attestation, label & certificates of the operating platform T Cloud Public (Deutsche Telekom).

Hosting platform

ISO 14001

VamiSec GmbH environmental management system built per ISO 14001:2026 — certification in preparation.

In preparation

EcoVadis

Sustainability rating of VamiSec GmbH — Committed badge, awarded in October 2026.

Committed badge

02 — Hosting & Digital Sovereignty

Sovereign hosting in Germany — under European law.

VamiThreat runs on Deutsche Telekom’s T Cloud Public (formerly Open Telekom Cloud) — a sovereign European cloud, exclusively in German data centres. Platform data and logs are subject to European law; the contracting party is based in Germany, German law applies and the place of jurisdiction is Germany. Sign-in uses single sign-on via Microsoft Entra ID (EU region); where AI processing takes place depends on the LLM selected — locally in Germany or with the public provider in the USA.

German data centres onlyTwin-core region Biere/Magdeburg (Saxony-Anhalt) — hosting exclusively in Germany, within the EU legal framework.

Access only after sign-inThe entire application — interface and API — sits behind upstream authentication; without single sign-on via Microsoft Entra ID it cannot be used.

Encrypted transportVamiThreat is reachable via HTTPS only; unencrypted HTTP requests are redirected to HTTPS. Current browsers connect using TLS 1.3.

LLM of your choiceThe language model for the AI functions can be selected: a local Qwen3.8 in VamiSec’s data centre in Sankt Augustin — AI processing then stays in Germany — or a public provider such as Anthropic or OpenAI. No AI training on customer data.

T Cloud PublicDeutsche Telekom · sovereign cloud

BSI C5 Type II (ISAE 3000)
ISO/IEC 27001, 27017, 27018, 27701
SOC 1/2/3, TISAX AL 3
ISO 22301 (BCM), ISO 27001 data centres

Certificates, attestations and labels of the hosting platform (Deutsche Telekom), issued by independent auditors — not of VamiSec GmbH. Source: T Cloud Public certificates & attestations.

03 — Security Controls

How we protect — by domain.

Concrete controls instead of marketing. These measures are part of our security concept and are aligned with VamiSec’s ISMS.

Data security

Encrypted transport (TLS, HTTPS enforced)
Platform data held exclusively in German data centres in SaaS operation; retention and deletion are governed by the DPA
Your inputs — descriptions, documents, diagrams — are processed by the selected LLM, locally or at the public provider
No training on customer data — we do not train our own models with it and connect external models only under terms that exclude training use

Application security

Secure SDLC from requirements to operations (details below)
Threat modeling, code review and automated tests in CI
No function usable without sign-in: interface and API only after SSO login

Access & identity

Single sign-on via Microsoft Entra ID (OpenID Connect)
Sign-in via the OAuth 2.0 authorization code flow before the application can be used
Beta access only for accounts in VamiSec GmbH’s Entra tenant

Infrastructure

Sovereign hosting on T Cloud Public (DE)
Local LLM (Qwen3.8) selectable, run in VamiSec’s data centre in Sankt Augustin
On-premises deployment on your own Kubernetes cluster (on request)

Traceable AI results

Editable data-flow diagram (Mermaid) with trust boundaries as a reviewable model basis
Attack path, risk and response for each threat (Threat · Attack · Risk · Response)
Disclosed methodology: STRIDE, MAESTRO, mapping to MITRE ATT&CK and ATLAS

Incident management

Defined incident response process
Affected customers are informed without undue delay; details are governed by the DPA
Responsible disclosure via bugbounty.vamisec.com · security.txt

AI governance & human-in-the-loop

LLM-assisted, not autonomous: the AI enriches, classifies and proposes remediation
Users review and correct parsed diagrams before they are used
Public LLM providers disclosed — connected only under terms that exclude training use

Organisation & governance

ISO/IEC 27001-certified ISMS (DAkkS)
Security awareness training for all employees
Supplier and risk management processes

Operations & data protection

Operated by VamiSec GmbH, whose ISMS — including the associated digital products — is certified to ISO/IEC 27001
DPA under Art. 28 GDPR on request (privacy@vamisec.com)
Operated on T Cloud Public — twin-core region Biere/Magdeburg

04 — Secure Software Development Lifecycle

We develop as securely as we test.

At VamiThreat, security is not a downstream step but anchored in every phase of development — state of the art, from requirements through to operations.

Security Requirements Engineering

Security and data-protection requirements are defined before the first line of code.

Threat Modeling

Threat modeling to STRIDE and — for AI/agent components — MAESTRO.

Code Review

Changes are reviewed before they are merged — with a focus on security and data protection.

Automated Testing

The automated test suite runs in CI on every pull request.

Secure Deployment

Operated on T Cloud Public in Germany; HTTPS enforced, access only after sign-in.

Responsible Disclosure

We accept security reports via security@vamisec.com and our bug bounty programme — machine-readable via security.txt (RFC 9116).

05 — Sub-processors

Disclosed — who processes which data.

We deliberately rely on a lean number of carefully selected sub-processors and disclose the purpose and processing region of each. We inform customers of changes in advance.

Hosting in Germany, sign-in via Microsoft Entra ID in the EU. If you choose a public LLM via VamiSec for the AI functions, Anthropic or OpenAI process your requests in the USA (direct API); transfers are based on the EU Standard Contractual Clauses (SCC). If you provide your own API key, the contractual relationship exists directly between you and the provider; the provider’s terms with you then apply, including on training use.

Sub-processor	Purpose	Region
Telekom Deutschland GmbH T Cloud Public	Cloud hosting & infrastructure for VamiThreat in the Biere/Magdeburg region — SaaS operation only	DE
Microsoft Microsoft Entra ID	Sign-in (single sign-on) to VamiThreat via VamiSec GmbH’s Entra tenant; tenant region scope EU, group headquarters in the USA — limited access from third countries possible under the Microsoft DPA (SCC)	EU
Anthropic Claude API	AI inference (Claude language model) — only if you choose a public LLM via VamiSec for the AI functions; no training use under the provider’s contractual terms	USA
OpenAI OpenAI API	AI inference (OpenAI language models) — only if you choose a public LLM via VamiSec for the AI functions; no training use under the provider’s contractual terms	USA

Not a sub-processor: VamiSec GmbH operates the local Qwen3.8 itself in its data centre in Sankt Augustin. If you choose this model, AI processing stays in Germany without any third-party provider.

Complete, always up-to-date list of sub-processors, including a contact for change notifications: privacy@vamisec.com.

06 — Documents & Evidence

VamiSec GmbH, the operator of VamiThreat, runs a documented environmental management system (EMS) per ISO 14001:2026. It is integrated with our ISO/IEC 27001-certified ISMS into one management system, and our sustainability performance is additionally assessed externally by EcoVadis.

Environmental management system per ISO 14001:2026Environmental policy, registers of environmental aspects and legal obligations, measurable environmental objectives with KPIs and clearly assigned EMS responsibility.

Integrated with the ISMSThe EMS uses the processes of our ISO/IEC 27001-certified ISMS — from change and corrective-action management to a joint management review.

Certification in preparationCertification to ISO 14001 by a DAkkS-accredited body is in preparation; the audit is planned for 2027.

EcoVadis Committed – Sustainability Rating

EcoVadisSustainability rating · Committed badge 2026

In the EcoVadis sustainability rating, VamiSec GmbH was awarded the Committed badge in October 2026 — recognising continuous improvement in sustainability.

The rating and the environmental management system relate to VamiSec GmbH as a company, which develops and operates VamiThreat.

08 — FAQ

Common questions from due diligence.

Where is our data stored?

In SaaS operation, we store the platform data of VamiThreat exclusively in data centres in Germany; the contracting party is based in Germany, German law applies and the place of jurisdiction is Germany. Where a function involves external service providers — for identity or AI, for example — we disclose the provider, purpose and processing region in the sub-processor table.

Is VamiThreat ISO 27001 certified?

VamiThreat is operated by VamiSec GmbH, whose ISMS is certified to ISO/IEC 27001 by a DAkkS-accredited body; there is no product-specific certificate for VamiThreat. According to the certificate, the scope covers the provision of information security consulting services, “associated digital products and supporting information-processing facilities …” (certificate DE-IS-20250191, ISO/IEC 27001:2022, valid until 18 September 2028).

How do users authenticate?

Via single sign-on with Microsoft Entra ID (OpenID Connect, OAuth 2.0 authorization code flow). The entire application — interface and API — sits behind upstream authentication and cannot be used without signing in. During the beta, users sign in with accounts in VamiSec GmbH’s Entra tenant; access to the beta is available on request.

Which AI models does VamiThreat use, and do they see our data?

VamiThreat is LLM-assisted but does not act autonomously: the language model enriches your architecture information, classifies threats and proposes remediation. To do so, it processes your inputs — descriptions, uploaded documents (Word, text, PDF) and diagram images. The model can be selected: a local Qwen3.8 in VamiSec’s data centre in Sankt Augustin — AI processing then stays in Germany — or a public provider such as Anthropic or OpenAI, with processing in the USA based on the EU Standard Contractual Clauses. We do not use customer data as training data: we do not train or fine-tune any AI models with it, and we only connect external AI models under contractual terms that exclude training use. You review and correct parsed diagrams before they are used.

How will we be informed in the event of a security incident?

We follow a defined incident response process and notify affected customers without undue delay; details are governed by the DPA. Security researchers can reach us via bugbounty.vamisec.com — machine-readable per RFC 9116 at /.well-known/security.txt.

Is our data used to train AI models?

No. We do not use customer data as training data: we do not train or fine-tune any AI models with it, and we only connect external AI models under contractual terms that exclude training use. Whether and which external AI providers VamiThreat uses is disclosed in the sub-processor table.

How do we obtain access to confidential documents?

Public documents are available directly. For the Statement of Applicability, architecture whitepapers or completed questionnaires, a short request to security@vamisec.com is sufficient; evidence subject to an NDA is released after signing.

Is VamiThreat generally available?

VamiThreat is currently in beta. Access to the beta is available on request — the easiest way is to book a demo.

Can we run VamiThreat in our own environment?

Yes, on request. Besides SaaS operation on T Cloud Public, VamiThreat can be operated on premises on your own Kubernetes cluster; Telekom Deutschland GmbH is then not involved as a sub-processor. In this case, a local language model runs on your own GPU infrastructure.

Still have questions?

Talk to our team.

We answer your security and compliance questions and provide the evidence your procurement needs.

Book a demo security@vamisec.com