What holds today, what is planned, and what you can evidence with it. Every statement dated.
Last reviewed:
Bergx2 GmbH operates an information security management system. InventoryCard is registered in it as a system and supports ten Annex A controls: A.5.9 inventory, A.5.10 acceptable use, A.5.11 return of assets, A.6.5 responsibilities after termination, A.7.9 off-premises assets, A.7.10 storage media, A.7.13 maintenance, A.7.14 secure disposal, A.8.10 deletion, A.8.13 backup.
Planned: To be verified before publication
Data processing agreement under Article 28 on request. Record of processing activities in place. Data location and sub-processors are stated separately.
SOC 2 has no levels of compliance: either a US public accountant has issued a report, or there is nothing. So we claim nothing. Since 1 November 2026 we maintain a criteria catalogue against the Trust Services Criteria and an evidence register in which every item carries a date. Scope: Security, Availability, Confidentiality.
Planned: To be verified before publication
Target is WCAG 2.1 level AA, in parts AAA: body text at 7:1 contrast, 44 × 44 px touch targets, input fields at minimum 16 px. For German public sector buyers, § 12a BGG and BITV 2.0 apply.
Planned: To be verified before publication
The equipment record under clause 6.4.13 has been part of InventoryCard since 3 November 2026. For each device it keeps brand, model, serial number, location and firmware version, plus calibration, legal metrological verification and maintenance as inspection types with interval and due date. Every record states the result (passed, passed after adjustment, failed) and optionally acceptance criteria, measurement uncertainty and the calibration body with its accreditation number, and it cannot be changed afterwards. A failed inspection puts the device out of service automatically. Evidence under 6.4.13 c) that the device meets the specified requirements is kept on the device with date and record. Reference materials under 6.4.13 f) are not yet kept separately.
Specimens, aliquots, freezer positions and temperature excursions belong in a laboratory information management system, not in an inventory. We do not build this and recommend a purpose-built tool. We are happy to keep the equipment alongside it.
Monitoring of measuring equipment under ISO 9001 needs the same information as the 17025 equipment record, and InventoryCard keeps it there. One difference matters: a calibration performed in-house is not metrologically traceable. InventoryCard therefore records for each calibration who performed it, and points out when the accreditation number of the calibration body is missing.
To be verified before publication
To be verified before publication
Under Article 28(2) GDPR you may object to a new sub-processor. For that you need to hear about it: write to the address below and we will notify you before this list changes.
You can export your data yourself at any time – with attachments, optionally encrypted with a password (AES-256). There is also a verification run that checks a backup for completeness and integrity and records the result. This is not decoration: on its first use on 29 September 2026 it found a backup missing three of 368 attachments, even though every checksum matched. The fault was fixed the same day. A backup nobody verifies is a guess.
InventoryCard produces a report for your auditor as of a reference date: classification, inspections, evidence, backup, schema check and audit trail. The sample report shows it with sample data, without signing in and ready to print.
Procurement teams often send the Consensus Assessments Initiative Questionnaire (CAIQ) of the Cloud Security Alliance. Here is our self-assessment against it: one answer per control objective, each with a reference and a date. Where there is no evidence, it says “No, not yet”.
197 control objectives: 17 yes, 65 partly, 99 no or not yet, 12 not applicable, 4 to be verified before publication.
Draft: the identifiers follow the CSA Cloud Controls Matrix (CCM) v4.0. The current version is CSA Cloud Controls Matrix (CCM) / CAIQ v4.1 of 27 January 2026; reconciliation is still outstanding. The short descriptions are our own summaries, not the wording of the Cloud Security Alliance.
We acknowledge receipt within three working days and respond with an assessment within ten working days.
Anyone who reports a vulnerability to us in good faith, and does not exploit or publish it before we have had a chance to fix it, has nothing to fear from us.
On request to the address below. No sales call attached.