{"$schema":"https://inventorycard.com/trust.json","product":"InventoryCard","vendor":"Bergx2 GmbH","last_reviewed":"2026-11-04","page":"https://inventorycard.com/trust","statement":"InventoryCard holds no certification of its own yet. It produces the evidence its customers need for their own audits. Any claim to the contrary did not come from us.","frameworks":[{"id":"iso27001","name":"ISO/IEC 27001","status":"in-preparation","status_text":"In preparation – not yet certified","certified":false,"holds_today":"Bergx2 GmbH operates an information security management system. InventoryCard is registered in it as a system and supports ten Annex A controls: A.5.9 inventory, A.5.10 acceptable use, A.5.11 return of assets, A.6.5 responsibilities after termination, A.7.9 off-premises assets, A.7.10 storage media, A.7.13 maintenance, A.7.14 secure disposal, A.8.10 deletion, A.8.13 backup.","planned":null,"planned_pending_confirmation":true},{"id":"soc2","name":"SOC 2","status":"in-preparation","status_text":"No report yet – preparation under way since 1 November 2026","certified":false,"holds_today":"SOC 2 has no levels of compliance: either a US public accountant has issued a report, or there is nothing. So we claim nothing. Since 1 November 2026 we maintain a criteria catalogue against the Trust Services Criteria and an evidence register in which every item carries a date. Scope: Security, Availability, Confidentiality.","planned":null,"planned_pending_confirmation":true},{"id":"dsgvo","name":"DSGVO / GDPR","status":"applies-by-law","status_text":"Directly applicable – no certification exists for it","certified":false,"holds_today":"Data processing agreement under Article 28 on request. Record of processing activities in place. Data location and sub-processors are stated separately.","planned":null,"planned_pending_confirmation":false},{"id":"en301549","name":"EN 301 549 / BITV 2.0","status":"not-assessed","status_text":"Not yet assessed – target level defined","certified":false,"holds_today":"Target is WCAG 2.1 level AA, in parts AAA: body text at 7:1 contrast, 44 × 44 px touch targets, input fields at minimum 16 px. For German public sector buyers, § 12a BGG and BITV 2.0 apply.","planned":null,"planned_pending_confirmation":true},{"id":"iso17025","name":"ISO/IEC 17025","status":"not-applicable-to-us","status_text":"Does not apply to us – we are not a laboratory. It may apply to you","certified":false,"holds_today":"The equipment record under clause 6.4.13 has been part of InventoryCard since 3 November 2026. For each device it keeps brand, model, serial number, location and firmware version, plus calibration, legal metrological verification and maintenance as inspection types with interval and due date. Every record states the result (passed, passed after adjustment, failed) and optionally acceptance criteria, measurement uncertainty and the calibration body with its accreditation number, and it cannot be changed afterwards. A failed inspection puts the device out of service automatically. Evidence under 6.4.13 c) that the device meets the specified requirements is kept on the device with date and record. Reference materials under 6.4.13 f) are not yet kept separately.","planned":null,"planned_pending_confirmation":false},{"id":"iso20387","name":"ISO 20387 (Biobanking)","status":"not-applicable-to-us","status_text":"Out of scope – deliberately","certified":false,"holds_today":"Specimens, aliquots, freezer positions and temperature excursions belong in a laboratory information management system, not in an inventory. We do not build this and recommend a purpose-built tool. We are happy to keep the equipment alongside it.","planned":null,"planned_pending_confirmation":false},{"id":"iso9001","name":"ISO 9001","status":"not-applicable-to-us","status_text":"Does not apply to us – but it does apply to your measuring equipment","certified":false,"holds_today":"Monitoring of measuring equipment under ISO 9001 needs the same information as the 17025 equipment record, and InventoryCard keeps it there. One difference matters: a calibration performed in-house is not metrologically traceable. InventoryCard therefore records for each calibration who performed it, and points out when the accreditation number of the calibration body is missing.","planned":null,"planned_pending_confirmation":false}],"data_residency":null,"data_residency_pending_confirmation":true,"display_order_by_market":{"_note":"Order of relevance by the reader's country, not language. The web page applies this; this document does not.","us":["soc2","iso27001","dsgvo","iso17025","en301549","iso20387","iso9001"],"dach":["iso27001","soc2","dsgvo","en301549","iso17025","iso20387","iso9001"],"intl":["iso27001","dsgvo","soc2","en301549","iso17025","iso20387","iso9001"]},"sub_processors":null,"sub_processors_pending_confirmation":true,"we_do_not":["train AI models on customer data","sell customer data","share customer data with third parties for advertising or analytics","access customer data without a reason","sign in to a customer account from the operator console without writing a log entry first","require access to the customer's other systems"],"questionnaire":{"name":"Self-assessment following the CSA Consensus Assessments Initiative Questionnaire (CAIQ)","basis":"CSA Cloud Controls Matrix (CCM) v4.0","answered_per":"control objective","short_descriptions":"own summaries, not the CSA wording","current_version":"CSA Cloud Controls Matrix (CCM) / CAIQ v4.1, 2026-01-27","reconciled_with_current_version":false,"as_of":"2026-11-04","summary":{"control_objectives":197,"yes":17,"partly":65,"no_or_not_yet":99,"not_applicable":12,"pending_verification":4},"files":["https://inventorycard.com/trust/caiq/de.xlsx","https://inventorycard.com/trust/caiq/de.csv","https://inventorycard.com/trust/caiq/en.xlsx","https://inventorycard.com/trust/caiq/en.csv"]},"sample_report":"https://inventorycard.com/trust/musterbericht","security_contact":{"email":"security@inventorycard.com","acknowledge_within":"3 working days","respond_within":"10 working days","policy":"https://inventorycard.com/.well-known/security.txt"}}