PROBIS
Book a demo
Security & Compliance

Security you can verify.

PROBIS Software GmbH operates an information security management system that is certified to ISO/IEC 27001:2022. The security controls are also aligned with the SOC 2 Trust Services criteria and cover every system that processes financial and construction cost data in the real estate industry.

✓ Independently certified✓ Hosted on Azure (Western Europe)
security / standards
Certified

ISO/IEC 27001:2022

Information Security Management System. Independently audited and certified.

Cert. No. 122943 (Issue 1)Valid through 08/2028
Certificate (PDF)
Aligned

SOC 2 Trust Services

Security, availability, and confidentiality. There is no independent SOC 2 audit report available.

Available upon request under an NDA
Request Documentation
Certification Report

Three years, as officially documented.

Each piece of information below is taken from our current ISO certificate.

Today
September 1, 2025 Issued
August 31, 2028 Validuntil
1Certificate

No. 122943, Issue 1, in accordance with ISO/IEC 27001:2022

3years

Certificate Validity Period

IAFMLA

Accredited by IAS, member of the Multilateral Recognition Arrangement

Scope of Application

What the certificate covers.

The scope of application covers the cloud-based real estate project management platform of PROBIS Software GmbH, including the production infrastructure as well as all processing, storage, and transmission of customer data.

Within the scope of application

PROBIS Platform

Cloud-Based Real Estate Project Management

Platform

Production Infrastructure

Microsoft Azure, Western Europe

Hosting

Customer Data

Processing, Storage, and Transmission

Data
Issuing AuthorityPrescient Security LLC

Certification Body

Accredited byIAS

International Accreditation Service

Recognized within the framework ofIAF MLA

Multilateral Recognition Agreement

In practice

Certification is proof. That's how it works in practice.

Six checks behind the certificate. Select one to see how it works.

01
Access Control
Role-based permissions and multi-factor authentication for every account with access to customer financial data.
02
Cryptography
Encrypted at all levels: during transmission (TLS 1.3) and at rest (AES-256).
03
Audit Logging
Every access to and every change made to sensitive data records is logged and retained for independent audit purposes.
04
Incident Management
Documented procedures for detecting, escalating, and notifying customers in the event of any security incident.
05
Business Continuity
Tested backup and recovery plans to ensure that customer data remains available even in the event of disruptions.
06
Supplier Relationships
Every subcontractor and supplier is evaluated according to the same security standards that we hold ourselves to.
checks / access control
Permissions by Role
Role
View
Edit
Share
Admin
Viewer
Analyst
Controller
Administrator
✓ Multi-factor authentication for every account
controls / cryptography
Data path
Browser Your Team
→
TLS 1.3During transmission
→
AES-256 in sleep mode
TLS 1.3Protects data during transmission between you and the platform
AES-256Protects data stored on the platform
Inspections / Audit Logging
Sample Audit Trail
9:14Budget line item changedChange
09:02Cost report openedAccess
08:47Contract record updatedChange
8:31 a.m.Role permissions checkedAccess
✓ Retained for independent review
Audits / Incident Management
Incident Timeline
1
Recognize
2
Escalate
3
Notify
4
Fix
✓ A documented procedure for each step
Controls / Business Continuity
Backup and Recovery
Live DataProduction
→
BackupTested
→
Recovery Practiced
✓ Customer data remains available even during system outages
Controls / Supplier Relationships
A standard—for suppliers as well
PROBIS
The Same Standard
Subcontractor
The Same Standard
Suppliers
The Same Standard
Check it yourself

Check in three steps.

Read the explanation, and then verify each statement for yourself.

video / iso-27001-and-soc-2
▶
ViewISO/IEC 27001 and SOC 2, Explained Simply
1

Open the official certificate

Check the certificate number, scope, and validity using the information on this page.

Certificate (PDF) →
2

Check exhibitors

Prescient Security LLC is accredited by IAS. You can verify this accreditation directly with IAS.

3

Request SOC 2-compliant documentation

Our controls are based on the criteria of security, availability, and confidentiality. The documentation is provided under an NDA.

Good to Know: There is no independent SOC 2 audit report available.
Request documentation →
Regulatory Classification

Support for NIS2 and DORA.

Here's how PROBIS helps you meet your regulatory obligations.

EU Framework

NIS2

Requirements for Cybersecurity Risk Management and Incident Reporting for Critical and Important Facilities.

View Details

For customers subject to NIS2, PROBIS can provide relevant information on supplier assessment to support their own risk assessment and supply chain management. The legal classification depends on the specific national implementation, the company’s activities, size, and industry.

Cybersecurity Risk Management & Security Policies
Incident Handling & Escalation
Business Continuity, Crisis Management & Recovery
Supply Chain & Supplier Security
Reliable Procurement, Development, and Maintenance
Vulnerability Management & Disclosure Processes
Access Control, Authentication, and Asset Management
Cryptography & Data Protection
Important to KnowThis support does not relieve the customer of their legal obligations and does not guarantee NIS2 compliance.
EU Framework

DORA

Support regarding third-party ICT risks for clients in the financial sector, in accordance with Regulation (EU) 2022/2554.

View Details

When PROBIS provides ICT services to a financial institution, PROBIS supports that institution as a third-party ICT service provider under the respective DORA agreement. Whether a specific PROBIS service supports a critical or important function is assessed by each financial institution in the context of its own business operations—PROBIS does not make this assessment on behalf of the client.

Clear description of contractual obligations and service levels
Information on Processing and Storage Locations
Disclosure of Subcontractor Agreements
Security Measures for Availability, Integrity, and Confidentiality
Backup, Recovery, Return, and Deletion Policies
Incident Reporting & Support Processes
Information on Business Continuity & Exit Support
Audit, Access, and Review Rights
Current StatusPROBIS is not currently designated by the European supervisory authorities as a critical third-party ICT service provider (CTPP). This statement is reviewed each time the official CTPP list is updated. (Last reviewed: August 13, 2026)
Talk to us

Do you conduct supplier due diligence?

Our security team will be happy to explain our certification, architecture, and controls to you directly.