Are your data centers GDPR compliant?

A data-centre certification alone does not make a processing activity GDPR compliant. We document the selected location, provider, subprocessors and available certification evidence. Overall assessment depends on the application, configuration, data flows and the controller's organisational measures.

Do you provide a data processing agreement (DPA)?

Yes, where WZ-IT acts as a processor under Article 28 GDPR. The DPA describes processing on instructions, subprocessors and technical and organisational measures; project-specific deviations are recorded before the contract starts.

Can you support ISO 27001 audits?

Yes. We provide the technical and organisational measures, network diagrams, access matrices and patch, backup and incident evidence available within the agreed service scope. These documents do not replace the customer's ISMS or a certification.

How do you ensure only authorized persons have access?

We configure roles, multi-factor authentication, administrative access paths and logging within the supported and agreed scope. The operating documentation states which access events are recorded. Further details can be found on our monitoring page.

Do you help with audit requests from our customers?

Yes. If your customers or their auditors request evidence about the infrastructure - for example via supplier questionnaires or security assessments - we deliver the relevant documents: TOMs, patch reports, backup evidence and data residency confirmation. On request we participate directly in audit meetings or calls.

Can your reports be used as compliance evidence?

Yes. Patch, monitoring and incident reports are documented with timestamps and system references and are exportable (PDF, CSV). They are suitable as evidence of operational measures in your GDPR documentation, in your organization's ISO 27001 audits and towards customer auditors. The reports do not replace your own ISMS, but they provide the operational evidence for it.

Do you support NIS2 requirements?

We support operational implementation with documented patch and vulnerability management, monitoring with defined escalation, backup concepts, agreed recovery evidence and access control. Whether and which NIS2 obligations apply to your organisation should be clarified with your legal counsel.

IT operations with evidence for NIS2, GDPR and ISO 27001

WZ-IT implements technical operating controls for GDPR, ISO 27001, BSI C5, and NIS2 requirements and documents the agreed scope. Legal assessment, the ISMS, and certification remain clearly separate.

GDPR and NIS2
Technical evidence
Provider certificates reviewed

Assess operations View operating controls

Reviews

IT Beratung Service Consulting Soforthilfe

Companies worldwide trust WZ-IT

Read client reviews

Operations & Compliance

What Operations Has to Do with Compliance

Compliance is not created in a binder, but in day-to-day operations. If you want to present evidence in an audit, you have to produce it beforehand - these six points are what ongoing operations deliver to your compliance.

DPA under Art. 28 GDPR
As soon as we operate systems containing personal data, we act as a processor within the meaning of Art. 28 GDPR. The DPA governs processing on instructions, confidentiality and sub-processing - with us it is part of every operations contract, not a paid extra.
TOMs That Match Reality
Technical and organizational measures are only worth as much as their implementation. Our TOMs describe actual operations - encryption, access control, backup processes - and are updated whenever your infrastructure changes.
Patch Records as Audit Artifacts
Every installed update is documented: which system, which package, when, by whom. These reports answer every auditor's standard question - how do you ensure your systems are up to date? - with data instead of declarations of intent.
Data Residency Germany
All systems we operate run in German data centers. For your data protection documentation this means: no third-country transfers, no standard contractual clauses and no transfer impact assessments at the infrastructure level.
Deletion Concepts
The GDPR requires that data is not stored longer than necessary. In operations this means: defined backup retention, documented deletion at contract end and traceable handling of deletion requests - including with regard to backups.
Access Control & SSH Key Management
Who has access to which systems - and why still? We manage SSH keys centrally, work with personal accounts instead of shared root passwords and revoke access in a documented way when employees leave or providers change.

GDPR

Privacy-Focused Operational Controls

Technical and organisational measures designed to support privacy requirements at infrastructure level.

Location

Agreed Data Location
German and European locations are available. Location, subprocessors and any required third-country transfers are documented before the contract starts.

Encryption

Encryption
Encryption in transit and at rest is defined per system. Protocols, key management and rotation are recorded in the operating documentation.

Access

Access Controls & Audit Logs
Roles, multi-factor authentication and logging of administrative access are configured within the supported and agreed scope.

Contract

Data Processing Agreements
Where WZ-IT acts as a processor, we provide a DPA with a description of the technical and organisational measures.

Provider Evidence

Evidence for the selected provider

Certificates and audit reports apply only to the named provider, period and scope. We document which evidence applies to the infrastructure in use.

ISO 27001
Information Security
For the selected infrastructure provider, we review and document available ISO 27001 certificates, including their scope and validity.
BSI C5
Cloud Security
The BSI Cloud Computing Compliance Criteria Catalogue (C5) defines minimum requirements for secure cloud computing - relevant for public administration and regulated industries.
SOC 2
Operational Controls
Where a provider supplies a SOC 2 Type II report, we review its period and scope for the service in use.

NIS2

NIS2: What the Directive Means for Operations

The EU directive NIS2 (EU 2022/2555) obliges essential and important entities to implement cybersecurity risk management. In Germany, the NIS2 implementation act (NIS2UmsuCG) transposes the directive - it has been in force since December 2025. It affects companies from 18 sectors, generally from 50 employees or 10 million euros in annual revenue, and certain entities regardless of size.

What NIS2 Requires, Among Other Things

Risk analysis and security policies for network and information systems
Vulnerability handling, patch and incident management
Backup management, disaster recovery and crisis management
Access control, encryption and multi-factor authentication
Supply chain security, including service providers
Reporting obligations for significant incidents and registration with the BSI

What Ongoing Operations Contribute

Documented patch and vulnerability management with evidence
24/7 monitoring with defined escalation for incident detection
Backup design and evidence; restore tests where agreed in the recovery scope
Central access control and traceable logging
Reports you can present to auditors and customers

Deep dive: NIS2-compliant remote access

Whether and how your company falls under NIS2 should be clarified with your legal counsel - we deliver the operational implementation and the evidence for it.

What We Provide

Compliance Services Overview

From ongoing documentation to audit preparation - we deliver the evidence you need.

Assess operations

Regular Compliance Reports

Reports on patching, backups, monitoring and incidents at the agreed interval and level of detail.

Audit Preparation

We support technical preparation for ISO 27001, BSI C5 and privacy assessments with evidence from our agreed service scope.

Security Documentation

Technical and organizational measures (TOMs), network diagrams, access matrices and incident response plans.

Vulnerability Assessments

Regular vulnerability scans and configuration and hardening reviews with documented tracking of all findings.

Industries

Regulated Industries We Serve

Our infrastructure is designed for the requirements of regulated industries.

Law Firms
Client data, legal communication systems, professional obligations
Healthcare
Patient data, hospital regulations, telematics infrastructure
Finance
Financial regulatory requirements, DORA, critical infrastructure
Public Sector
BSI C5, public IT procurement, digital government compliance
Insurance
Solvency II, insurance regulations, data protection requirements

Frequently Asked Questions

Answers to the most important questions

Knowledge

Further guides

These services and articles complement the compliance topic.

Services and articles

Relevant next steps

Reviews & projects

Operations that visibly relieve customers

Customer feedback on monitoring, updates, maintenance, support and stable production systems.

Networking & Provisioning

WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.

Steve KirchnerManaging Director, nextGYM GmbH

View project

International

Built in Germany's Ruhr Valley. Running worldwide.

WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.