Trust starts with transparency
amber is a European business AI operated in German data centers. Here you will find every certificate, contract and piece of evidence your security, privacy and procurement teams need to assess amber.
- ISO 27001Certified ISMS
- Hosted in GermanyT Cloud, EU data centers
- GDPR & EU AI ActCompliant by design
- No AI trainingon your data
Certified, audited and EU-regulated
All evidence is available for download below.
Standards we meet
Independent certifications, audits and EU regulations that amber is built and operated against.
CertifiedView certificateISO 27001
amber operates a documented information security management system (ISMS) that is audited and certified to ISO 27001.
- CompliantSee our controls
SOC 2
amber is developed and operated in line with the SOC 2 Trust Services Criteria – security, availability, confidentiality and privacy are built into our controls.
CompliantGDPR overview (PDF)GDPR
Privacy by design and by default (Art. 25 GDPR), deletion on request and breach notification under Art. 33/34 GDPR – with our data protection officer involved in relevant cases.
CompliantAI Act overview (PDF)EU AI Act
amber is designed to meet the obligations of the EU AI Act, including transparency, accountability and human oversight across the product.
- AuditedView pentest certificate
Penetration test
amber is tested through independent penetration tests. The current certificate is available here.
Germany & EULLM hosting explained (PDF)Made in Germany
Developed in Aachen and operated in Telekom T Cloud data centers in Germany – with virtual network isolation for every customer.
Contracts, certificates and evidence
Everything you need for your vendor assessment – freely available in German and English. Missing something? Use the contact form at the end of this page.
Contracts & legal
Data Processing Agreement (DPA) incl. TOMs
Standard DPA for the managed service, including the technical and organizational measures (TOMs) and the list of subprocessors.
Description of services
Scope of services for the user-based managed service.
Privacy policy
How amber processes personal data on the website and in the platform.
Subprocessors & terms
List of subprocessors and the general terms and conditions for using amber.
Certificates & audit reports
ISO 27001 certificate
Proof of certification of the amber information security management system.
Pentest certificate
Proof of the independent penetration test of the amber platform.
Technical overviews
LLM hosting explained
Where and how the AI models behind amber are operated.
EU AI Act – compliance overview
How amber meets the requirements of the EU AI Act.
GDPR – compliance overview
How amber meets the requirements of the GDPR.
Data processing & storage
Which data amber processes, where it is stored and for how long.
Handling of access rights
How amber adopts and enforces the existing permissions of your source systems.
How we protect your data
An excerpt of the technical and organizational measures amber implements. The complete TOMs are part of the DPA.
Infrastructure & hosting
- Operated in T Cloud data centers in Germany
- Virtual network isolation for every customer
- Production firewalls and encrypted remote access via VPN
- Full backups for disaster recovery
Access control & authentication
- Role-based permissions following the least-privilege principle
- 2FA and strong password policies
- SAML 2.0 and LDAP/AD for enterprise SSO
- Existing permissions of your source systems are preserved
- Access rights revoked on departure
Data protection & sovereignty
- Encrypted transmission with TLS 1.2 or higher
- Customer data is never used to train AI models
- Deletion on request, full deletion at the latest 30 days after the contract ends
- AI models run in T Cloud by default, third-party models only from German or European data centers
Vulnerability & patch management
- Independent penetration tests
- Dependency review and control
- Regular container vulnerability scans
- Prioritized patches and hotfixes
- Antivirus and malware protection
Logging & accountability
- Data accesses and changes are logged
- Actions are traceable to user accounts
- Documented permission concept
Organization & incident management
- Certified and continuously maintained ISMS according to ISO 27001
- Need-to-know access and privacy training for all employees
- Structured, severity-based incident process
- Confirmed incidents reported within 72 hours under Art. 33/34 GDPR
- Subprocessors are reviewed before use and contractually bound
Who processes your data
amber works with a small number of vetted service providers. All subprocessors are contractually bound to equivalent data protection obligations and listed in our DPA.
Common questions from security reviews
Still have questions? We are here to help.
Need a document that is missing here, have questions about our security program or want us to complete a security questionnaire? Send us a message – our team will get back to you shortly.
- Security questionnaires
- Custom DPA amendments
- Additional evidence and documents