VamiReverse Trust Center

Security, compliance and sovereignty — made transparent.

VamiReverse is VamiSec’s AI-assisted multi-agent platform for reverse engineering and malware analysis — for analysts examining Android apps and Windows and Linux binaries; currently in beta. This Trust Center shows how we protect data, where we host and how we develop securely.

ISO/IEC 27001:2022 certified VamiSec GmbH ISMS · Proks Certification GmbH (DAkkS-accredited) · certificate no. DE-IS-20250191 · valid until September 18, 2028 Download certificate (PDF) ⤓

View documents security@vamisec.com

OperatorVamiSec GmbH · Bonn, Germany

HostingT Cloud Public · Germany

Report a security incidentsecurity@vamisec.com

Last updatedOctober 13, 2026

StatusBeta

01 — Compliance & Certifications

Built on certified foundations.

VamiReverse is operated by VamiSec GmbH, whose information security management system is certified to ISO/IEC 27001 by a DAkkS-accredited body. We transparently indicate what is certified, what is in preparation, and what is evidence of the hosting platform.

ISO/IEC 27001

VamiSec GmbH ISMS — certified by the DAkkS-accredited Proks Certification GmbH, valid until 09/2028.

Certified

ISO/IEC 42001

VamiSec AI management system being established — ISO/IEC 42001 certification in preparation.

In preparation

GDPR

Data processing agreement under Art. 28 GDPR on request (privacy@vamisec.com), sub-processors disclosed.

DPA on request

BSI C5 · ISO 27001 · TISAX

Attestation, label & certificates of the operating platform T Cloud Public (Deutsche Telekom).

Hosting platform

ISO 14001

VamiSec GmbH environmental management system built per ISO 14001:2026 — certification in preparation.

In preparation

EcoVadis

Sustainability rating of VamiSec GmbH — Committed badge, awarded in October 2026.

Committed badge

02 — Hosting & Digital Sovereignty

Sovereign hosting in Germany — under European law.

For SaaS operation, VamiReverse relies on Deutsche Telekom’s T Cloud Public (formerly Open Telekom Cloud) — a sovereign European cloud, exclusively in German data centres. Platform data and logs are subject to European law; the contracting party is based in Germany, German law applies and the place of jurisdiction is Germany. Where the AI functions are processed depends on the language model selected; sign-in uses single sign-on with Microsoft Entra ID.

German data centres onlyTwin-core region Biere/Magdeburg (Saxony-Anhalt) — hosting exclusively in Germany, within the EU legal framework.

Language model of your choiceFor the AI functions, VamiReverse provides a choice between the local Qwen3.8 and a public LLM such as Claude (Anthropic) or OpenAI; a public LLM processes requests in the USA. We will tell you in advance which models are active in your deployment.

Local LLM in Sankt AugustinVamiSec operates Qwen3.8 in its data centre in Sankt Augustin — requests to this model stay in Germany, without an external AI provider.

On-premises on your Kubernetes clusterAs an alternative to SaaS: operation of VamiReverse on your organisation’s Kubernetes cluster — on request.

T Cloud PublicDeutsche Telekom · sovereign cloud

BSI C5 Type II (ISAE 3000)
ISO/IEC 27001, 27017, 27018, 27701
SOC 1/2/3, TISAX AL 3
ISO 22301 (BCM), ISO 27001 data centres

Certificates, attestations and labels of the hosting platform (Deutsche Telekom), issued by independent auditors — not of VamiSec GmbH. Source: T Cloud Public certificates & attestations.

03 — Security Controls

How we protect — by domain.

Concrete controls instead of marketing — as of VamiReverse’s current beta phase. Further details are available on request from security@vamisec.com.

Data security

In SaaS operation, data is stored exclusively in German data centres
Retention, deletion and encryption are governed by the DPA, which we provide on request
We process personal data contained in your artefacts as a processor under Art. 28 GDPR
No training on customer data — neither for our own nor for external AI models

Application security

Secure SDLC from requirements to operations (details below)
Threat modeling based on STRIDE and — for the AI agents — MAESTRO
Code review and automated testing before changes are merged

Access & identity

Sign-in via single sign-on with Microsoft Entra ID
Sign-in model, multi-factor authentication and permissions: details on request

Infrastructure

Sovereign hosting on T Cloud Public (DE)
Platform evidence: BSI C5 attestation, ISO/IEC 27001 certificate and TISAX label (AL 3) of Deutsche Telekom
On-premises operation on your organisation’s Kubernetes cluster: on request

Self-hosted analysis tooling

Static analysis with self-operated open-source tools such as Ghidra, ILSpy, jadx, capa, Detect It Easy and YARA
Knowledge bases such as MITRE ATT&CK and CWE are kept as local copies
For the analysis, we do not send your artefacts to the publishers of these tools and knowledge bases; information on optional threat-intelligence lookups is available on request

Incident management

Defined incident response process
Customer notification targeting a report within 24 hours
Responsible disclosure via bugbounty.vamisec.com · security.txt

AI governance & human-in-the-loop

AI results are working hypotheses and must be reviewed by a qualified person before use
The AI supports your analysts rather than replacing them
VamiSec AI policy; AI management system per ISO/IEC 42001 being established

Organisation & governance

ISO/IEC 27001-certified ISMS (DAkkS)
Security awareness training for all employees
Supplier and risk management processes

Business continuity

Hosting platform with an ISO 22301 certificate (BCM) held by Deutsche Telekom
Backup and recovery: details are governed by the DPA (on request)
Operated on T Cloud Public in German data centres

04 — Secure Software Development Lifecycle

We develop as securely as we test.

For VamiReverse, security is part of the development process — from requirements to deployment.

Security Requirements Engineering

Security and data-protection requirements are built into the planning of new features.

Threat Modeling

Threat modeling based on STRIDE and — for AI/agent components — MAESTRO.

Code Review

Changes are reviewed before they are merged — with a focus on security and data protection.

Automated Testing

The automated test suite runs in CI on every pull request.

Deployment

In SaaS operation on T Cloud Public in Germany; operation on your organisation’s Kubernetes cluster on request.

Responsible Disclosure

We accept vulnerability reports via bugbounty.vamisec.com and security@vamisec.com; contact details are machine-readable in security.txt per RFC 9116.

05 — Sub-processors

Disclosed — who processes which data.

We deliberately rely on a lean number of carefully selected sub-processors and disclose the purpose and processing region of each. We inform our customers of changes in advance.

Telekom Deutschland hosts exclusively in German data centres; Telekom provides operations and support services from EU member states. Microsoft (Entra ID) processes within the EU Data Boundary; any access from third countries is covered by the EU Standard Contractual Clauses (SCC). Anthropic and OpenAI are only involved where a public LLM via VamiSec is used in your deployment. They then process the requests in the USA (direct API) on the basis of the EU Standard Contractual Clauses (SCC) and, under their contractual terms, do not use them for training.

Sub-processor	Purpose	Region
Telekom Deutschland GmbH T Cloud Public	Hosting & infrastructure of VamiReverse — SaaS operation only	DE
Microsoft Ireland Operations Limited Microsoft Entra ID	Sign-in via single sign-on — where user accounts are held in VamiSec’s Entra tenant	EU
Anthropic Claude (API)	Language model for the AI functions — where a public LLM via VamiSec is used in your deployment; no training use under the provider’s contractual terms	USA
OpenAI OpenAI API	Language model for the AI functions — where a public LLM via VamiSec is used in your deployment; no training use under the provider’s contractual terms	USA

Not a sub-processor: VamiSec operates the local language model Qwen3.8 itself in its own data centre in Sankt Augustin (Germany). The analysis tools such as Ghidra, jadx or YARA are also self-operated and are not sub-processors.

Complete, always up-to-date list of sub-processors, including a contact for change notifications: privacy@vamisec.com.

06 — Documents & Evidence

VamiSec GmbH, the operator of VamiReverse, runs a documented environmental management system (EMS) per ISO 14001:2026. It is integrated with our ISO/IEC 27001-certified ISMS into one management system, and our sustainability performance is additionally assessed externally by EcoVadis.

Environmental management system per ISO 14001:2026Environmental policy, registers of environmental aspects and legal obligations, measurable environmental objectives with KPIs and clearly assigned EMS responsibility.

Integrated with the ISMSThe EMS uses the processes of our ISO/IEC 27001-certified ISMS — from change and corrective-action management to a joint management review.

Certification in preparationCertification to ISO 14001 by a DAkkS-accredited body is in preparation; the audit is planned for 2027.

EcoVadis Committed – Sustainability Rating

EcoVadisSustainability rating · Committed badge 2026

In the EcoVadis sustainability rating, VamiSec GmbH was awarded the Committed badge in October 2026 — recognising continuous improvement in sustainability.

The rating and the environmental management system relate to VamiSec GmbH as a company, which develops and operates VamiReverse.

08 — FAQ

Common questions from due diligence.

Where is our data stored?

In SaaS operation, we store the platform data of VamiReverse exclusively in data centres in Germany; the contracting party is based in Germany, German law applies and the place of jurisdiction is Germany. Where a function involves external service providers — for identity or AI, for example — we disclose the provider, purpose and processing region in the sub-processor table.

Is VamiReverse ISO 27001 certified?

ISO/IEC 27001 certification applies to the information security management system (ISMS) of VamiSec GmbH, which develops and operates VamiReverse — ISO/IEC 27001 certifies management systems, not individual products. The certificate was issued by the DAkkS-accredited Proks Certification GmbH (certificate DE-IS-20250191, ISO/IEC 27001:2022, valid until September 18, 2028). The scope stated on the German-language certificate reads, in translation: “provision of consulting services in the field of information security, related digital products and supporting information-processing facilities …” — the certificate does not name individual products.

How do users authenticate?

Users sign in to VamiReverse via single sign-on with Microsoft Entra ID. Details on the sign-in model, multi-factor authentication and permissions are available on request from security@vamisec.com.

Which AI models does VamiReverse use, and do they see our data?

For the AI functions — such as naming variables in decompiled code or forming hypotheses about behaviour and vulnerabilities — VamiReverse provides a choice of language model: the local Qwen3.8 in VamiSec’s data centre in Sankt Augustin or a public LLM such as Claude (Anthropic) or OpenAI. We will tell you in advance which models are active in your deployment. VamiSec operates the local model itself; requests to it stay in Germany. With a public LLM, the provider processes the requests in the USA on the basis of the EU Standard Contractual Clauses and, under its contractual terms, does not use them for training. The static analysis itself runs on self-operated tools such as Ghidra, jadx or YARA; AI results are working hypotheses that your analysts review.

How will we be informed in the event of a security incident?

We follow a defined incident response process and notify affected customers promptly — targeting an initial report within 24 hours. Security researchers can reach us via security@vamisec.com and bugbounty.vamisec.com; contact details are machine-readable per RFC 9116 at /.well-known/security.txt.

Is our data used to train AI models?

No. We do not use customer data as training data: we do not train or fine-tune any AI models with it, and we only connect external AI models under contractual terms that exclude training use. Whether and which external AI providers VamiReverse uses is disclosed in the sub-processor table.

How do we obtain access to confidential documents?

Public documents are available directly. For the Statement of Applicability, the security whitepaper or completed questionnaires, a short request to security@vamisec.com is sufficient; evidence subject to an NDA is released after signing.

What data does VamiReverse process?

VamiReverse processes the artefacts you upload — Android apps (APK) and Windows and Linux binaries (PE/ELF) — and the analysis data derived from them: decompiled code, strings and metadata, IOCs, detection rules (YARA, Sigma, Suricata), MITRE ATT&CK mappings and analysis reports. Artefacts may contain personal data; you remain the controller for it, and we process it on your behalf under Art. 28 GDPR. For sign-in, we also process your users’ account data from Microsoft Entra ID, such as name and business e-mail address. Retention and deletion are governed by the DPA, which we provide on request (privacy@vamisec.com).

Still have questions?

Talk to our team.

We answer your security and compliance questions and provide the evidence your procurement needs.

Book a demo security@vamisec.com