Europe & regulation
BSI C5
The C5 criteria catalogue of Germany's Federal Office for Information Security sets minimum requirements for secure cloud services. Univerx is designed for it. We name an attestation only once it exists – with type, period and version.
At a glance
- Designed for
The platform is built toward the requirement. Evidence such as an attestation does not exist yet – we name it as soon as it does.
- On request
The documents exist. You receive them for your review through the contact form.
- Available
Met and evidenced. We assign this level only once the evidence exists.
No documents are listed for this topic. We answer the questions from your questionnaire in conversation.
#What C5 is
The Cloud Computing Compliance Criteria Catalogue, C5 for short, is published by Germany's Federal Office for Information Security (BSI). It sets minimum information security requirements for cloud services and addresses providers, their auditors and their customers.
C5 is not a seal but the basis for an audit. An independent auditor tests the service against the criteria and issues an attestation. The audit report goes to the provider's customers, who use it for their own risk assessment.
#What the catalogue examines
The catalogue covers the whole operation of a cloud service: organisation, people, operations, access, cryptography, communication, suppliers, incidents and continuity. It also asks for transparency, for example about where data is processed.
The table shows where you will find each area in Univerx. It describes what the platform is designed for and does not replace an audit.
| Catalogue area | Where you find it in Univerx |
|---|---|
| Identity and access management | Role rights in central administration |
| Cryptography | Encryption in transit and at rest (Security) |
| Communication security | Network and API security (Security & availability) |
| Business continuity | Multi-zone availability, continuity plans (Resilience) |
| Portability | Data export (Data residency) |
| Security incidents | Reporting lines for your duties (NIS2) |
#Why we do not claim an attestation
In the public sector and regulated industries, C5 is often part of the tender. That is exactly where evidence counts. Calling a service “C5-compliant” without an attestation helps no one who has to justify a procurement decision.
So Univerx says “designed for”. Once an attestation exists, we will list it here with its type, audit period and catalogue version. Until then we answer your security questionnaire in a conversation.
#What comes next
An attestation is the result of a process, not its beginning. Univerx lays the groundwork in the architecture: tenant separation, encryption, role rights, multi-zone operation.
If you are preparing your decision now, the technical and organisational measures from the GDPR package help. The glossary explains the term under BSI C5.
#Sources
- BSI: Cloud Computing Compliance Criteria Catalogue C5 (in German).
- BSI press release of 7 April 2026: C5 published (in German).
Products
Where the topic applies.
The product families this topic matters most for.
Univerx Cloud
One cloud for every customer contact.
- EU
- BSI C5
- NIS2
Univerx Trust Center
Security and regulation as a design principle, not an appendix.
- DSGVO
- EU
- AI Act
- BSI C5
- eIDAS
- NIS2
- DORA
- BFSG
Trust & Europe
Every topic in the trust center.
Every topic carries a status. It tells you what is a design goal, which documents you can request and what is evidenced today.
| Topic | Status |
|---|---|
| GDPR | On request |
| Data residency & hosting in Germany | Designed for · German hosting planned |
| EU AI Act | Designed for |
| BSI C5 | Designed for · goal, no attestation |
| eIDAS & online ID | Designed for |
| NIS2 | Designed for |
| DORA | Designed for |
| European Accessibility Act | Designed for · WCAG 2.1 AA as a goal |
| Responsible AI | Designed for · principles & controls |
| Security & availability | Designed for |
| United States: HIPAA, PCI DSS, SOC 2, TCPA, CCPA | Designed for |
Frequently asked questions
Is Univerx C5-attested?
No. Univerx is designed for the C5 requirements. We will name an attestation on this page once it exists – with its type, audit period and catalogue version.
What is the difference between type 1 and type 2?
A type 1 attestation assesses whether controls are suitably designed at a given date. A type 2 attestation also assesses whether they operated effectively over a period, usually several months.
Which version of the catalogue applies?
The BSI published C5:2026 in spring 2026; C5:2020 applied before. The version your tender requires is usually stated in the procurement documents.
What can we review in the meantime?
The technical and organisational measures from the GDPR package are available on request. We answer the questions in your security questionnaire in a conversation.
Related
Trust & EuropeSecurity & availability
Encryption in transit and at rest, identity and access management, network and API security, multi-zone availability and continuity plans: what Univerx is designed for so your customer service keeps running.
Trust & EuropeData residency & hosting in Germany
The goal: data and media stay in the EU region you choose. Hosting in Germany is planned. What lives where, and who can reach it, is set out in documents you receive on request.
Trust & EuropeNIS2
NIS2 obliges companies in essential sectors to manage risk, report incidents and secure their supply chain. Univerx is a link in that chain and is designed to support your duties with documents and clear reporting lines.
Trust & EuropeGDPR
Processing under Art. 28 GDPR, documents for your data protection impact assessment, retention and deletion policies and role rights. What exists you receive on request; what is a goal we call a goal.
Guides2 November 2026 · 11 min readRunning a contact centre in Europe
What the GDPR, the EU AI Act and German co-determination mean for routing, recording and analytics – and how to answer the questions from procurement, privacy and the works council before the first contact runs on a new platform.
Guides2 November 2026 · 11 min readCloud migration from your existing system
Connect telephony, move channels, train teams: how a contact centre moves step by step from its existing system to the cloud – with inventory, sequencing, a cutover plan, risks and a checklist.
Europe & regulation1 November 2026 · 5 min readData residency: the five questions procurement and privacy ask
"The data stays in Europe" is a good start, but not an answer. Five questions procurement and privacy teams follow up with, and what makes an answer reliable.
GlossaryBSI C5
C5 is the German Federal Office for Information Security's criteria catalogue for secure cloud services. Independent auditors confirm compliance in a Type 1 or Type 2 attestation. Why designed for is not the same as attested.
GlossaryData residency
Data residency describes where data and media are stored and processed. In customer service that covers not just the database but recordings, transcripts, AI processing, backups and support access.
See Univerx on your own example.
In a demo we show the platform along your channels and requests, from AI agents to video, workforce scheduling and analytics.
Online, in German or English, with no preparation on your side.