Compliance
Our management system is certified to ISO/IEC 27001 and ISO 9001 and covers how we build the platform just as much as how we run it.
On that basis, Loopback meets the requirements of NIS2, DORA, the Data Act, and the Cyber Resilience Act. You get a provider that fits cleanly into your own compliance, and evidence you can take straight into your next audit.
Certificates
ISO/IEC 27001 is the international standard for information security. The certification confirms that Loopback assesses risks systematically, puts effective controls in place, and keeps the confidentiality, integrity, and availability of your data protected.
ISO 9001 stands for reliable quality. Development, release, operations, and support follow clear, documented processes. You get a platform that behaves predictably and gets better with every release.
Both standards run in one integrated management system. Internal audits, management reviews, and the annual surveillance audits keep it current. You can download both certificates right here as PDFs.
Location
Loopback is a German company based in Saarland. Platform, accounts, and billing run in Germany, under German and European law.
Your workloads run where you need them. You choose provider and region for every cluster, in Germany or in other European regions.
The location of every resource is visible in the account. When an audit asks where your data lives, you answer at a glance.
Accounts, organizations, permissions, and billing are in Germany.
Data centers of the selected providers in Germany and Europe. You pick the region.
One permission model for the whole stack. Every product and function runs through Loopback's central RBAC. With organizations, groups, and fine-grained rights, you decide exactly who may use clusters, buckets, images, and domains.
Your team signs in with SSO, OTP, or passkeys, your pipelines with API tokens. When someone leaves the team, their access ends at once, across every product. That is how you put least privilege into practice, in line with ISO 27001.
Loopback processes personal data under the GDPR, as a German company with platform data in Germany and a contracting party you know.
The certified ISMS protects that data with assessed risks, deliberately granted access, and documented processes.
You sign the DPA yourself in the web interface. We provide the TOMs and the list of subprocessors.
Loopback is DORA compliant. For banks, insurers, and other financial entities, we are an ICT third-party service provider that meets the requirements of the regulation. We implement them on the basis of our ISMS certified to ISO/IEC 27001.
You get everything your register of information and your risk assessment need: a German contracting party, a certified ISMS, traceable locations, and a binding SLA.
Your exit strategy stands on solid ground too. Loopback builds on open standards like Kubernetes, S3, and OCI. Your workloads and data stay portable.
Loopback is NIS2 compliant. We implement risk management, incident handling, and supply chain security within our ISMS certified to ISO/IEC 27001.
If your company falls under NIS2 itself, your service providers come under review as well. With Loopback, you have a provider that documents its security measures and a permission model that controls access across every product from one place.
Loopback is Data Act compliant. Your data belongs to you. You can export it at any time and take it to another provider.
Open standards make that possible: Kubernetes with the standard API, S3-compatible Object Storage, and an OCI-compatible Registry. Your workloads keep running wherever these standards apply.
Loopback is CRA compliant. Security is part of every phase for us: development, operations, and updates.
The platform is built under our certified management system. You can report vulnerabilities directly through security.txt. And if you build products on Loopback yourself, you have a platform you can document cleanly in your own CRA records.
Everything your procurement and your audit need, in one place. The certificates are ready as PDFs, the SLA, terms, and privacy notice as their own pages.
Our information security and quality management are certified. On that basis, we ensure compliance with NIS2, DORA, the Data Act, and the Cyber Resilience Act ourselves.
We are happy to answer questions on security, compliance, and procurement. Go to the contact form
Create an account, set up your organization, and get going. The evidence for your audit is already waiting.
