COMPLYD Trust Center
Everything about the security and compliance of our services, in one place.
- ISMS across the whole company
- Development and operations inside the EU
- Assessment publicly available
Verified and certified3 attestations
Scope and evidence for each are listed below.Trust Center: ISO 27001 certified security and compliance
At a glanceAn information security management system certified against ISO 27001:2022 across the whole company, an entry in the CSA STAR Registry and the “IT Security made in EU” trust seal from TeleTrusT.
Anyone who uses compliance software ultimately entrusts it with sensitive product data. Therefore this Trust Center sets out how COMPLYD itself works. As a result, we run a management system certified against ISO/IEC 27001. In addition, we are listed in the CSA STAR Registry and carry the trust seal of TeleTrusT.
If you would rather see the platform itself, our CRA compliance software page shows how COMPLYD takes products through the Cyber Resilience Act. The Cyber Resilience Act guide then describes the process step by step, whereas the CRA compliance packages show which option fits your team. Finally, our privacy policy explains how we process personal data.
ISO 27001 certified, assessed and labelled
CertificationISO 27001:2022A certified information security management system covering every part of the company.
Trust sealTeleTrusTThe German IT security association’s trust seal for our software application.
AssessmentCSA STAR Level 1Listed with the Cloud Security Alliance, assessed against the Cloud Controls Matrix.
In addition, the table below summarises what each attestation covers and where you can verify it.
| Attestation | Scope | Evidence |
|---|---|---|
| ISO 27001:2022 | Information security management system across the whole company, including development and operations | Certificate from an accredited body |
| CSA STAR Level 1 | Cloud services, assessed against the Cloud Controls Matrix | Entry in the CSA STAR Registry |
| TeleTrusT “IT Security made in EU” | Software application, development and operations inside the EU | Membership of the German IT security association |
ISO 27001 certified: what that means in practice
COMPLYD GmbH runs an information security management system (ISMS) that an accredited body certified against ISO 27001:2022.
Moreover, the scope of the ISMS covers every part of the company without exception, and therefore also the development and operations processes behind the product. Auditors return for surveillance audits, so the certificate stays under review.
Documented risk assessments, defined access rules, security requirements for suppliers and a tested process for security incidents. In addition, internal audits check that these controls actually work.
- Certified by an accredited body
- Regular surveillance audits
- Scope: every part of the company
TeleTrusT “IT Security made in EU”
COMPLYD is a member of TeleTrusT, the German IT security association. As a result, we may carry the “IT Security made in EU” trust seal for our software application, and development and operations stay inside the EU.
- Member of the German IT security association
- Covers our software application
- Development and operations inside the EU
ISO 27001 certified and listed in the CSA STAR Registry
The Cloud Security Alliance (CSA) also lists COMPLYD with an assessment against the Cloud Controls Matrix. In addition, anyone can view the full assessment: CSA STAR Registry.
Questions and answers
Trust Center FAQ on security and compliance
What is the Cyber Resilience Act and who does it affect?
The Cyber Resilience Act is an EU regulation that sets binding cybersecurity requirements for products with digital elements. Its aim is to make hardware and software safer across the entire product lifecycle, in other words from development through updates. In addition, the CRA affects every digital product and every new product version sold in the EU, for example fitness trackers, manufacturing machines and highly critical security products. Consequently, no manufacturer is exempt.
Do I need to be a security expert to use your software for CRA compliance?
No. The platform is built so that compliance officers, product managers, developers and CTOs can use it without prior security knowledge. Instead, a guided flow walks you through every requirement.
Which Cyber Resilience Act requirements does COMPLYD cover?
The software covers the entire Cyber Resilience Act: first the technical security requirements in Annex I and II, then vulnerability management and finally conformity assessment.
What is a CRA risk assessment?
First, the risk assessment determines which requirements apply and which security objectives follow from them. Every other CRA obligation then builds on it.
How do I meet the Cyber Resilience Act for a new product version?
To do so, you simply create a new version of your product in the software. The documentation of the previous version serves as the basis. Consequently, the update reaches CRA compliance with far less effort.
What do I do after a cybersecurity incident, and how does incident reporting work?
Once an event occurs that could affect product security, manufacturers must report that incident to the competent authorities under the CRA, and moreover within tight deadlines.
Therefore COMPLYD provides:
- a ready-made workflow for security incidents and vulnerability reports
- templates covering every required notification
- and, if you want it, disclosure straight from the tool
Which certifications and attestations does COMPLYD hold?
In short, this Trust Center brings together three attestations:
- ISO 27001:2022 – a certified information security management system covering every part of the company.
- CSA STAR Registry – an entry with the Cloud Security Alliance, assessed against the Cloud Controls Matrix.
- TeleTrusT “IT Security made in EU” – the German IT security association’s trust seal for our software application.
ISO 27001 certified and still have questions?
We are happy to show you how COMPLYD protects your product data and documents your CRA compliance. Request a free demo, or look at the packages first.
More about the platform: CRA compliance software · Cyber Resilience Act guide