Compliance

ISO 27001 ready

Vuframe® runs its product security as ISO 27001 asks. “ISO 27001 ready” means that the security measures are in place today: hosting in Germany, encryption, role-based access control, automatic backups and full access logging. It is not a certification.

Vuframe® Cloud stores your data in German data centers. Before you use Vuframe® Cloud, we sign a data processing agreement under Art. 28 GDPR with you. The subprocessors page lists every service provider that processes data for us. You can request the DPA.

NIS2

NIS2 is in force in Germany since 6 December 2025. If your company is in scope, use this Trust Center and the documents on request for the assessment of Vuframe® as a supplier.

EU Cyber Resilience Act (CRA)

The CRA applies to standalone software, such as a sales app. For the Vuframe® apps, Vuframe® is the manufacturer and takes the duties of the CRA:

Since 11 September 2026: the reporting duties apply. An actively exploited vulnerability or a severe incident must be reported within 24 hours (early warning) and within 72 hours (notification).
From 11 December 2027: the full obligations apply, including CE conformity.

To report a vulnerability, open a ticket or write to security@vuframe.com.