Public sector: digitally sovereign

Four points can be verified: the location of processing, the law to which the provider and its parent company are subject, the certificates in place including their scope, and the ability to leave the provider again. Claims such as “sovereign cloud” or “Made in Germany” without evidence on one of these four points are unusable in a procurement procedure.

With certification based on IT-Grundschutz, the information security management system is additionally audited against the building blocks of the IT-Grundschutz compendium, and the certificate is issued by the German Federal Office for Information Security. This matters for public administration because IT-Grundschutz is the same framework it uses to align its own information security.

With centron, by default in our own data centre in Hallstadt near Bamberg. Other locations are used only at your express request. The scope of the certification covers the Hallstadt, Nuremberg and Frankfurt am Main locations. With other providers, check whether a specific place is named or only a region such as “EU” or “Europe”.

The key certifications are in place: an unrestricted BSI C5:2020 Type 1 certificate, certified to ISO 27001 on the basis of IT-Grundschutz German data centres, GDPR-compliant processing with no transfers to third countries, and contractual SLAs. Our team is on hand to provide direct support with specific tender documents.

The certificates with their stated scope, the BSI C5 attestation, the documentation of technical and organisational measures under Art. 32 GDPR and the data processing agreement under Art. 28 GDPR – all in the Trust Center. For the EVB-IT Cloud annexes we additionally supply details on scope of services, availability, subcontractors and data return.

The EVB-IT Cloud is the contract type you use as a public contracting authority. centron supplies the details with which the annexes can be completed. Which procurement procedure is permissible for your project, and whether a framework agreement exists you can call off from, is for your procurement office to determine.

Through open standards and a contractual arrangement for data return. The centron platform builds on OpenStack, Kubernetes and S3-compatible interfaces. Data and configurations remain portable, and switching providers means migration effort rather than redevelopment. Also check whether proprietary add-on services are used that the next provider does not offer – that is the most common cause of later lock-in.

The EVB-IT Cloud expressly provides for the return of data at the end of the contract, including format, deadline and subsequent deletion at the provider. Specify these points in the service description, not only at termination. centron provides the data via the S3-compatible interface and documents the deletion.

Your institution remains the controller within the meaning of the GDPR and decides on the purposes and means of processing. centron is the processor and processes the data exclusively on your instructions. Our responsibility covers the data centre, platform, network, storage, monitoring and platform backup; specialist applications, operating systems, processes and data remain yours. This boundary is recorded in the scope of our ISO 27001 certification.

The starting prices are deliberately low: Managed Servers from €53.12 per month and cProtect from €0.03 per month. New accounts receive a €200 starting credit valid for 60 days – you can calculate your specific configuration transparently in the price calculator. For budgeting or the service description you receive a quote with firmly calculated line items.

Yes. In the public sector, the GDPR alone is not sufficient – BSI compliance and evidence that meets public procurement regulations are usually also required. centron meets both requirements: full BSI C5:2020 Type 1 certification for ccloud³ / Managed Cloud, ISO 27001, ISO 9001 and ISO 14001, as well as IHK pre-qualification for public sector contracting authorities. All data is processed exclusively in Germany. Further details can be found in the Trust Centre.