CertHub
CertHub GmbH runs an ISO/IEC 27001:2022-certified ISMS for the development and operation of its SaaS platform. Customer data is stored in Frankfurt. Encryption, tenant isolation, and a zero-training AI policy are in production. Use this page to download the certificate or request the DPA.
Last reviewed: 16 Jul 2026
Proks Certification GmbH · DE-IS-20260319
Valid until 27 Aug 2029
Certified ISMS covering the secure development, operation, and provision of the CertHub SaaS platform for regulated product manufacturers and conformity assessment bodies.
Download →
Data Processing Agreement (AVV) under Art. 28 GDPR is part of the CertHub contract. Available on request.
Product data and backups are stored in AWS eu-central-1 (Frankfurt). Processing stays in the EU/EEA except where GDPR Chapter V transfer tools apply.
Process software validated according to IEC/TR 80002-2. This is a validation method, not a numbered third-party certificate.
Product data lives in AWS eu-central-1 (Frankfurt). The marketing website is hosted on Vercel. AWS and MongoDB are US-parent providers operating EU regions under SCCs and/or the EU–U.S. Data Privacy Framework.
Customer data and backups reside in AWS Frankfurt (eu-central-1).
Production databases have no direct internet access inside an isolated VPC.
Logical isolation by database schema and JWT tenant claims. Dedicated AI knowledge bases available on request.
Dev, Staging, and Production run in separate AWS accounts with no cross-environment data access.
Staff access uses MFA and least-privilege RBAC. Privileged access is logged in CloudTrail.
Individual named accounts for users and operators. Shared admin accounts are not used.
SSO with external IdPs such as Microsoft Entra ID is available and being rolled out for customers.
All data in transit is protected with TLS 1.2 or higher.
Data at rest is encrypted with AES-256. Keys are managed in AWS KMS and Secrets Manager.
User actions, changes, and AI calls are logged with tenant isolation. Audit-relevant retention is 12 months.
Grafana monitors the platform around the clock. GuardDuty, Security Hub, and Dependabot run continuously.
Mandatory 4-eye code review and CI/CD promotion Dev → Staging → Production.
Platform software is validated according to IEC/TR 80002-2 for process software.
Customer data is never used to train or fine-tune models. Claude runs via AWS Bedrock in Frankfurt with ephemeral inference.
As processor, CertHub notifies customers without delay and within 24 hours of becoming aware of a personal-data breach.
Multi-AZ architecture. Contractual availability 99.2% per month. RTO ≤ 24 h, RPO ≤ 6 h.
Public download
Proks certificate DE-IS-20260319. Valid 28 Aug 2026 – 27 Aug 2029.
Email support@certhub.de
Art. 28 GDPR processing agreement. Part of the CertHub contract. Email support@certhub.de to request it.
| Name | Purpose | Region | Scope |
|---|---|---|---|
| AWS EMEA | Cloud hosting and Bedrock AI inference | Frankfurt (eu-central-1) | Product platform |
| MongoDB Atlas | Managed database | Frankfurt (eu-central-1) | Product platform |
| PostHog | Product analytics | Frankfurt (EU) | Product platform |
| Sentry | Error and performance monitoring | EU | Product platform |
| Freshworks | Customer support | EU | Product platform |
| Vercel | Marketing website hosting | See privacy policy | Marketing website |
CertHub offers AI-fueled software solutions for Technical Documentation, QMS and Design Control - tailored to the MedTech industry.
© CertHub 2026
